<#
.SYNOPSIS
    Installs and configures OpenSSH Client and Server on Windows 10/11.

.DESCRIPTION
    Automates the installation of OpenSSH Client and Server Windows Capabilities, configures
    the OpenSSH SSHD service to start automatically, starts the service, and verifies/creates
    the necessary inbound firewall rule for Port 22.

.EXAMPLE
    irm https://gist.githubusercontent.com/raw/YOUR_GIST_ID/install-openssh.ps1 | iex
    Downloads and executes the OpenSSH setup remotely via an elevated PowerShell session.

.EXAMPLE
    .\install-openssh.ps1
    Executes the script locally from an elevated PowerShell session.

.NOTES
    Prerequisites:
    - Must run in an Elevated PowerShell Session (Run as Administrator).
    - Requires Windows 10 (1809+) or Windows 11 with internet or WSUS access for Windows Capabilities.

    Key Features:
    - Idempotent Execution: Safely skips installation/configuration steps if components are already present.
    - Automated Service Setup: Configures `sshd` startup type to 'Automatic' and ensures it is running.
    - Firewall Provisioning: Verifies or generates the 'OpenSSH-Server-In-TCP' inbound firewall rule.

.LINK
    https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
#>

# Requires Elevated PowerShell Session
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw "This script must be executed in a PowerShell session running as Administrator."
}

$ErrorActionPreference = 'Stop'

# 1. Install OpenSSH Client
Write-Host "Checking OpenSSH Client status..." -ForegroundColor Cyan
$clientCapability = Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Client*'

if ($clientCapability.State -ne 'Installed') {
    Write-Host "Installing OpenSSH Client..." -ForegroundColor Cyan
    Add-WindowsCapability -Online -Name $clientCapability.Name | Out-Null
    Write-Host "OpenSSH Client installed successfully." -ForegroundColor Green
} else {
    Write-Host "OpenSSH Client is already installed." -ForegroundColor Yellow
}

# 2. Install OpenSSH Server
Write-Host "Checking OpenSSH Server status..." -ForegroundColor Cyan
$serverCapability = Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'

if ($serverCapability.State -ne 'Installed') {
    Write-Host "Installing OpenSSH Server..." -ForegroundColor Cyan
    Add-WindowsCapability -Online -Name $serverCapability.Name | Out-Null
    Write-Host "OpenSSH Server installed successfully." -ForegroundColor Green
} else {
    Write-Host "OpenSSH Server is already installed." -ForegroundColor Yellow
}

# 3. Configure and Start SSHD Service
Write-Host "Configuring OpenSSH Server service (sshd)..." -ForegroundColor Cyan
Set-Service -Name sshd -StartupType 'Automatic'

$sshdService = Get-Service -Name sshd
if ($sshdService.Status -ne 'Running') {
    Start-Service sshd
    Write-Host "OpenSSH Server service started." -ForegroundColor Green
} else {
    Write-Host "OpenSSH Server service is already running." -ForegroundColor Yellow
}

# 4. Verify/Create Firewall Rule
Write-Host "Verifying Firewall Configuration..." -ForegroundColor Cyan
if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue)) {
    Write-Host "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..." -ForegroundColor Cyan
    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 | Out-Null
    Write-Host "Firewall rule created successfully." -ForegroundColor Green
} else {
    Write-Host "Firewall rule 'OpenSSH-Server-In-TCP' already exists." -ForegroundColor Yellow
}

Write-Host "`nOpenSSH Client and Server installation and configuration complete!" -ForegroundColor Green