Privatae
403 lines
24 KiB
PowerShell
403 lines
24 KiB
PowerShell
# privatae-bastion installer — Windows. Usage: irm https://privatae.ai/bastion/install.ps1 | iex
|
|
#
|
|
# It installs the bastion FOR THE WHOLE MACHINE: the Windows service
|
|
# PrivataeBastion, running as LocalSystem, so that no program running as you,
|
|
# an AI agent included, can stop it or change what it allows. Run from an
|
|
# ordinary terminal, it asks Windows for an administrator's yes once (UAC) and
|
|
# runs the install in that elevated window, which fetches this installer again
|
|
# itself; what it printed is shown here afterwards. Your account is recorded as
|
|
# the machine's owner (approvals-owner --sid), whose tray answers approvals.
|
|
# Your own computer is the default (-Personal: one Host at most, chosen at the
|
|
# machine).
|
|
#
|
|
# -JustMe installs it for your account alone, as a logon task, and says what
|
|
# that means: any program running as you can stop it. Where Windows gives no
|
|
# administrator's yes, that is what it falls back to, and it says so; but
|
|
# never beside a bastion already installed for the whole machine.
|
|
#
|
|
# -Shared (also spelled -Networked, its earlier name): a machine several Hosts
|
|
# share, where every Host after the first waits until the one in charge
|
|
# approves it.
|
|
# & ([scriptblock]::Create((irm https://privatae.ai/bastion/install.ps1))) -Shared
|
|
# (NOT `irm ... | iex -Shared` — Invoke-Expression takes no such parameter and
|
|
# that form errors without installing anything.)
|
|
# On an install that already exists, `privatae-bastion set-mode networked` (from
|
|
# an Administrator terminal) changes the mode but not how it runs: it stays a
|
|
# logon task. Re-run this installer with -Networked to make it a service. The
|
|
# service starts with its own state: pairings made by the earlier per-user
|
|
# install stay in that user's profile and are not carried over, so the machine
|
|
# is paired again (claim-anchor with a token from the host).
|
|
#
|
|
# ELEVATE AS YOURSELF, not as a different administrator account. The state
|
|
# directory is per-user (a folder under %APPDATA%), and UAC elevation of your
|
|
# OWN account keeps the same profile — but "Run as different user" does not, and
|
|
# the bastion would then read an empty directory and refuse to see its pairings.
|
|
# This is the Windows shape of the same trap `sudo -H` exists for on Unix.
|
|
#
|
|
# -Pair '<code>': pair as well, with the code from your Host's "Set up a
|
|
# bastion" card, and start the bastion so it serves now and at every sign-in.
|
|
# The one line the card gives is
|
|
# & ([scriptblock]::Create((irm https://privatae.ai/bastion/install.ps1))) -Pair 'skp_…'
|
|
# The code reaches the bastion on standard input, never as an argument, so it
|
|
# is not in the process list. On a machine whose bastion is already the
|
|
# Windows service (installed with -Networked, or by `npx cseries`), -Pair pairs
|
|
# that service from an Administrator PowerShell instead of installing a second
|
|
# bastion beside it.
|
|
param([switch]$Networked, [switch]$Shared, [switch]$Personal, [switch]$JustMe, [string]$Pair,
|
|
[string]$PairFile, [string]$OwnerSid)
|
|
# -PairFile and -OwnerSid are the elevated step's own (see the elevation
|
|
# below): the pairing code in a file, never an argument, and the SID of the
|
|
# account that asked, recorded as the machine's owner.
|
|
#
|
|
# Brought into the repo (this file previously existed ONLY as bytes in the
|
|
# edge webroot, so what customers piped to `iex` had no review history) and
|
|
# given digest verification (version.json had always published correct
|
|
# sha256s and neither installer read them).
|
|
$ErrorActionPreference = 'Stop'
|
|
# dl.privatae.ai — see the note in install.sh. Hardcoded on purpose: the digest
|
|
# is verified against the manifest from this same base, so a redirectable base
|
|
# would defeat the verification it is paired with.
|
|
$base = 'https://dl.privatae.ai'
|
|
# What the elevated step runs: this installer, fetched again by that step. Like
|
|
# $base, never taken from anywhere else.
|
|
$installScript = 'https://privatae.ai/bastion/install.ps1'
|
|
if ($Networked) { $Shared = $true }
|
|
if ($Shared -and $Personal) { throw "-Shared and -Personal contradict each other; pass one. Nothing was installed." }
|
|
if ($JustMe -and $Shared) { throw "A shared machine's bastion runs for the whole machine; -JustMe and -Shared contradict each other. Nothing was installed." }
|
|
if ($PairFile) {
|
|
$Pair = ([IO.File]::ReadAllText($PairFile)).Trim()
|
|
Remove-Item -Force -LiteralPath $PairFile -ErrorAction SilentlyContinue
|
|
}
|
|
$arch = if ([System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture -eq 'Arm64') {'arm64'} else {'amd64'}
|
|
$key = "windows-$arch.exe"
|
|
|
|
# Checked before anything is downloaded. Never echoed: it holds the token.
|
|
if ($Pair -and -not $Pair.StartsWith('skp_')) {
|
|
throw "-Pair takes the pairing code from your Host's card, which starts skp_. Nothing was installed."
|
|
}
|
|
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
|
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
|
|
$serviceInstalled = [bool](Get-Service -Name 'PrivataeBastion' -ErrorAction SilentlyContinue)
|
|
# A bastion installed for the whole machine is never joined by a second one for
|
|
# an account: the service's own guard would refuse to run it.
|
|
if ($JustMe -and $serviceInstalled) {
|
|
throw ("This machine's bastion is installed for the whole machine, as the Windows service PrivataeBastion, " +
|
|
"and a second one for your account would be refused beside it. Nothing was installed.")
|
|
}
|
|
$Service = -not $JustMe
|
|
$elevatedDone = $false
|
|
$fellBack = $false
|
|
if ($Service -and -not $isAdmin) {
|
|
# The elevated step. Its window cannot show its output here, so it writes
|
|
# it to a file this account reads afterwards. The pairing code goes in a
|
|
# file of this account's, never in the elevated command line.
|
|
Write-Host "Installing the bastion for the whole machine, so that no program running as you, an AI agent included, can stop it or change what it allows."
|
|
Write-Host "Windows asks for an administrator's yes once."
|
|
$kind = if ($Shared) { '-Shared' } else { '-Personal' }
|
|
$sid = ([Security.Principal.WindowsIdentity]::GetCurrent()).User.Value
|
|
$tmpRoot = [IO.Path]::GetTempPath()
|
|
$log = Join-Path $tmpRoot ("privatae-bastion-install-" + [guid]::NewGuid().ToString() + ".log")
|
|
$pf = ''
|
|
if ($Pair) {
|
|
$pf = Join-Path $tmpRoot ("privatae-bastion-pair-" + [guid]::NewGuid().ToString())
|
|
[IO.File]::WriteAllText($pf, $Pair)
|
|
}
|
|
# Every value goes into the elevated command as a single-quoted literal,
|
|
# its own quotes doubled: a profile path like C:\Users\O'Brien would
|
|
# otherwise end the literal and the elevated command would not parse.
|
|
# PowerShell's own escaper: it also doubles the typographic quotes
|
|
# (U+2018-U+201B), which PowerShell reads as single quotes too.
|
|
$q = { param($v) "'" + [System.Management.Automation.Language.CodeGeneration]::EscapeSingleQuotedStringContent([string]$v) + "'" }
|
|
$inner = "& ([scriptblock]::Create((irm $(& $q $installScript)))) $kind -OwnerSid $(& $q $sid)"
|
|
if ($pf) { $inner += " -PairFile $(& $q $pf)" }
|
|
$cmd = "try { $inner *>&1 | Out-File -Encoding utf8 -Append -LiteralPath $(& $q $log); exit 0 } " +
|
|
"catch { `$_.Exception.Message | Out-File -Encoding utf8 -Append -LiteralPath $(& $q $log); exit 1 }"
|
|
$declined = $false
|
|
try {
|
|
# -EncodedCommand, not -Command: Start-Process joins its arguments
|
|
# with spaces and quotes none of them, so a command carried as text
|
|
# loses runs of spaces and double quotes on the way. Base64 of its
|
|
# UTF-16 bytes arrives exactly as written.
|
|
$enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
|
|
$p = Start-Process -FilePath 'powershell.exe' -Verb RunAs -Wait -PassThru -WindowStyle Hidden `
|
|
-ArgumentList @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', $enc)
|
|
} catch {
|
|
$declined = $true
|
|
}
|
|
if ($pf -and (Test-Path -LiteralPath $pf)) { Remove-Item -Force -LiteralPath $pf -ErrorAction SilentlyContinue }
|
|
if (-not $declined) {
|
|
if (Test-Path -LiteralPath $log) {
|
|
Get-Content -LiteralPath $log | ForEach-Object { Write-Host $_ }
|
|
Remove-Item -Force -LiteralPath $log -ErrorAction SilentlyContinue
|
|
}
|
|
if ($p.ExitCode -ne 0) { throw "The install for the whole machine did not finish (the reason is above)." }
|
|
# What an earlier install for this account alone left that would run
|
|
# a second bastion beside the service.
|
|
$own = Join-Path $env:LOCALAPPDATA 'Programs\privatae-bastion\privatae-bastion.exe'
|
|
if (Test-Path -LiteralPath $own) {
|
|
Remove-Item -Force -LiteralPath $own -ErrorAction SilentlyContinue
|
|
Write-Host "Removed $own, an earlier copy for your account alone."
|
|
}
|
|
$elevatedDone = $true
|
|
} elseif ($serviceInstalled) {
|
|
throw ("This machine's bastion is installed for the whole machine, and updating it needs an administrator's yes. " +
|
|
"Nothing was installed.")
|
|
} else {
|
|
Write-Host "Windows gave no administrator's yes, so the bastion is installed for your account only."
|
|
$Service = $false
|
|
$fellBack = $true
|
|
}
|
|
}
|
|
|
|
# Everything below is the install itself, run here when no elevated step did it.
|
|
if (-not $elevatedDone) {
|
|
# Installed for the whole machine, the bastion runs as a Windows service under
|
|
# LocalSystem, so its program goes under Program Files, which only administrators can change. In
|
|
# the per-user folder anyone signed in could replace the file the service runs
|
|
# as the system, and the bastion refuses to register a service from there.
|
|
$dest = if ($Service) { Join-Path $env:ProgramFiles 'Privatae' } else { Join-Path $env:LOCALAPPDATA 'Programs\privatae-bastion' }
|
|
New-Item -ItemType Directory -Force -Path $dest | Out-Null
|
|
$exe = Join-Path $dest 'privatae-bastion.exe'
|
|
|
|
Write-Host "Fetching manifest..."
|
|
try { $manifest = Invoke-RestMethod -Uri "$base/version.json" }
|
|
catch { throw "cannot fetch $base/version.json - refusing to install unverified" }
|
|
|
|
$expected = $manifest.binaries.$key.sha256
|
|
if (-not $expected -or $expected -notmatch '^[0-9a-f]{64}$') {
|
|
throw "manifest has no usable sha256 for $key - refusing to install unverified"
|
|
}
|
|
|
|
# Download to a TEMP path and only move it into place after the digest matches,
|
|
# so a failed verification can never leave a runnable executable behind.
|
|
# For the service the download is made inside the destination folder. A file
|
|
# moved within one volume keeps the permissions it was created with, so one
|
|
# made under %TEMP% would carry this account's full control into Program Files
|
|
# and let this account, unelevated, replace the program the service runs as
|
|
# the system. Made here, it has the folder's permissions from the start.
|
|
$tmpDir = if ($Service) { $dest } else { [System.IO.Path]::GetTempPath() }
|
|
$tmp = Join-Path $tmpDir ("privatae-bastion-" + [System.Guid]::NewGuid().ToString() + ".exe")
|
|
try {
|
|
# Take the URL FROM THE MANIFEST, never build one. The manifest's url now
|
|
# carries ?v=<version>, which is what stops Cloudflare handing back the
|
|
# PREVIOUS release's binary against the CURRENT release's digest — a stale
|
|
# cache that surfaces as "checksum MISMATCH" and reads like a corrupt or
|
|
# tampered download. Building the path here would silently opt out of that.
|
|
# Falls back to the constructed path for a manifest that predates the field.
|
|
$url = $manifest.binaries.$key.url
|
|
if (-not $url) { $url = "$base/dl/privatae-bastion-$key" }
|
|
Write-Host "Downloading privatae-bastion ($key)..."
|
|
Invoke-WebRequest -Uri $url -OutFile $tmp
|
|
|
|
$actual = (Get-FileHash -Algorithm SHA256 -Path $tmp).Hash.ToLower()
|
|
if ($actual -ne $expected.ToLower()) {
|
|
throw ("checksum MISMATCH for privatae-bastion-$key`n expected $expected`n actual $actual`n" +
|
|
"The downloaded binary is not the one the platform published. Nothing was installed.")
|
|
}
|
|
Write-Host "Checksum verified ($expected)."
|
|
# A running service holds its program open, and Windows will not replace an
|
|
# open program. Stop it first; `service install` below starts it again.
|
|
if ($Service -and (Get-Service -Name 'PrivataeBastion' -ErrorAction SilentlyContinue)) {
|
|
Stop-Service -Name 'PrivataeBastion' -Force -ErrorAction SilentlyContinue
|
|
}
|
|
Move-Item -Force -Path $tmp -Destination $exe
|
|
} finally {
|
|
if (Test-Path $tmp) { Remove-Item -Force $tmp -ErrorAction SilentlyContinue }
|
|
}
|
|
|
|
# ── AUTOSTART: a Scheduled Task at logon ──────────────────────────────────────
|
|
# Until now this installer registered NOTHING: no service, no task, no Run key.
|
|
# So the bastion lived in whatever terminal you happened to start it in, died
|
|
# with that window, and never came back after a reboot. A person with no
|
|
# terminal open had no way to tell where it was running — a fair question
|
|
# whose real answer was that 0.24.0 restarts itself DETACHED after a self-update,
|
|
# so it was serving with no console and nothing on screen saying so.
|
|
#
|
|
# A SCHEDULED TASK, NOT A WINDOWS SERVICE, and that is not laziness. The
|
|
# bastion's state directory is per-USER (under %APPDATA% — see the note at the
|
|
# top of this file). A service registered with the SCM runs as SYSTEM or
|
|
# a service account, which has a DIFFERENT %APPDATA%, so it would start cleanly
|
|
# and then read an empty state directory and see no pairings at all. That is the
|
|
# same "Run as different user" trap this installer already warns about, wearing
|
|
# a service's clothes. A logon task runs as the user, so the state is the state.
|
|
#
|
|
# -Force replaces an existing registration, so re-running the installer updates
|
|
# the task instead of failing on a duplicate.
|
|
#
|
|
# THE WHOLE MACHINE IS THE DEFAULT, AND THE SERVICE IS THE POINT OF IT. A machine an
|
|
# organisation enrols needs the bastion to run whoever is signed in, and not be
|
|
# stoppable by them. So there the bastion registers itself as a Windows service
|
|
# running as LocalSystem (`privatae-bastion service install`). The state-folder
|
|
# trap above does not apply: the bastion keeps a service's state in
|
|
# LocalSystem's own profile and points an administrator's commands at the same
|
|
# folder (client-go/sysservice.go). A logon task left over from an earlier
|
|
# install would start a second bastion beside the service, so it is removed.
|
|
#
|
|
# Removing the task does not stop a copy it already started, and after a
|
|
# self-update that copy runs detached, outside the task altogether. It holds
|
|
# 127.0.0.1:7878, which is the port the service's first pairing is given, so the
|
|
# service would fail to bind and restart every few seconds until that copy
|
|
# exited at sign-out. So any bastion running from another path is stopped here.
|
|
if ($Service) {
|
|
$task = Get-ScheduledTask -TaskName 'PrivataeBastion' -ErrorAction SilentlyContinue
|
|
if ($task) {
|
|
Unregister-ScheduledTask -TaskName 'PrivataeBastion' -Confirm:$false
|
|
Write-Host "Removed the logon task from an earlier install; the service replaces it."
|
|
}
|
|
Get-Process -Name 'privatae-bastion' -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Path -and ($_.Path -ne $exe) } |
|
|
ForEach-Object {
|
|
Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue
|
|
Write-Host "Stopped the bastion running from $($_.Path) (an earlier per-user install)."
|
|
}
|
|
& $exe service install
|
|
if ($LASTEXITCODE -ne 0) { throw "could not register the Windows service (exit $LASTEXITCODE)" }
|
|
} else {
|
|
try {
|
|
$taskName = 'PrivataeBastion'
|
|
# DOMAIN\user rather than a bare name: a bare one is ambiguous on a machine
|
|
# that is domain-joined, and the task would be registered for the wrong
|
|
# identity — which is the same empty-%APPDATA% trap as a service.
|
|
$me = ([Security.Principal.WindowsIdentity]::GetCurrent()).Name
|
|
$action = New-ScheduledTaskAction -Execute $exe -Argument 'run'
|
|
$trigger = New-ScheduledTaskTrigger -AtLogOn -User $me
|
|
# LogonType Interactive is LOAD-BEARING, not a default worth inheriting. A
|
|
# task that runs with a background (S4U) or service logon has no window
|
|
# station, so the tray icon (tray_windows.go) would never appear and the
|
|
# bastion would be exactly as invisible as it was before any of this — while
|
|
# still reporting itself as started. Interactive puts it in the session the
|
|
# person is actually looking at. RunLevel Limited because the bastion needs
|
|
# no elevation to serve; only `claim-anchor` and friends do, and those are
|
|
# typed by hand.
|
|
$principal = New-ScheduledTaskPrincipal -UserId $me -LogonType Interactive -RunLevel Limited
|
|
# RunOnlyIfNetworkAvailable is deliberately OFF: the tunnel dials out and
|
|
# retries, and a machine that boots before its NIC is up would otherwise
|
|
# never start the bastion at all.
|
|
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries `
|
|
-DontStopIfGoingOnBatteries -StartWhenAvailable `
|
|
-ExecutionTimeLimit ([TimeSpan]::Zero)
|
|
Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger `
|
|
-Principal $principal `
|
|
-Settings $settings -Description 'Privatae bastion — serves this machine to your Hosts.' `
|
|
-Force | Out-Null
|
|
Write-Host "Autostart registered: Task Scheduler -> $taskName (runs at your logon)."
|
|
Write-Host " Stop it with: Stop-ScheduledTask -TaskName $taskName"
|
|
Write-Host " Remove it with: Unregister-ScheduledTask -TaskName $taskName -Confirm:`$false"
|
|
} catch {
|
|
# Never fail the install over autostart — the binary is on disk and usable.
|
|
Write-Host "NOTE: could not register autostart ($($_.Exception.Message))."
|
|
Write-Host " The bastion still works; start it with 'privatae-bastion run'."
|
|
}
|
|
}
|
|
|
|
# A whole-machine install is the machine's, so its command goes on the MACHINE
|
|
# path, where an administrator's terminal finds it whoever installed it.
|
|
#
|
|
# The machine Path is read and written in the registry as it is stored, NOT
|
|
# through [Environment]::GetEnvironmentVariable: that returns it with every
|
|
# %VARIABLE% already expanded, and writing it back stores the expanded text as
|
|
# a plain string, which fixes those entries for the whole machine. The new
|
|
# value takes effect in new sessions; this terminal is updated below.
|
|
if ($Service) {
|
|
$envKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(
|
|
'SYSTEM\CurrentControlSet\Control\Session Manager\Environment', $true)
|
|
try {
|
|
$raw = [string]$envKey.GetValue('Path', '',
|
|
[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
|
|
if (($raw -split ';') -notcontains $dest) {
|
|
$envKey.SetValue('Path', ($raw.TrimEnd(';') + ';' + $dest),
|
|
[Microsoft.Win32.RegistryValueKind]::ExpandString)
|
|
}
|
|
} finally {
|
|
$envKey.Close()
|
|
}
|
|
} else {
|
|
$userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
|
|
if ($userPath -notlike "*$dest*") { [Environment]::SetEnvironmentVariable('Path', ($userPath.TrimEnd(';') + ';' + $dest), 'User') }
|
|
}
|
|
$env:Path = "$env:Path;$dest"
|
|
Write-Host ""
|
|
Write-Host "Installed: $exe"
|
|
|
|
if ($Service) {
|
|
# After `service install`, so these elevated commands already write into
|
|
# the service's state folder rather than this administrator's own profile.
|
|
if ($Shared) {
|
|
& $exe set-mode networked
|
|
if ($LASTEXITCODE -ne 0) { throw "could not set networked mode (exit $LASTEXITCODE)" }
|
|
}
|
|
# The machine's owner: the account that asked for this install, or this
|
|
# one when run elevated by hand. A second administrator's reinstall leaves
|
|
# the first owner in place; the bastion says so.
|
|
$owner = if ($OwnerSid) { $OwnerSid } else { ([Security.Principal.WindowsIdentity]::GetCurrent()).User.Value }
|
|
& $exe approvals-owner --sid $owner
|
|
if ($LASTEXITCODE -ne 0) { Write-Host "NOTE: your account was not recorded as this machine's owner (the reason is above)." }
|
|
Write-Host ""
|
|
Write-Host "The bastion runs for the whole machine as the Windows service 'PrivataeBastion' (LocalSystem), and starts with Windows."
|
|
if (-not $Pair -and $Shared) {
|
|
Write-Host "Next, anchor this machine to the Host that should govern it:"
|
|
Write-Host " privatae-bastion claim-anchor"
|
|
Write-Host " (add --host <name> if this machine already serves several Hosts)"
|
|
Write-Host "Every host paired after the anchor waits, pending, until that Host approves it."
|
|
} elseif (-not $Pair) {
|
|
Write-Host "It is watching the AI agents on this computer now; no Host is needed."
|
|
Write-Host " Its approvals open from the tray. Set up your code, from an Administrator terminal:"
|
|
Write-Host " privatae-bastion stepup-enroll --machine"
|
|
Write-Host " Connect a Host, if you run one (optional), from an Administrator terminal: privatae-bastion pair <token>"
|
|
}
|
|
} else {
|
|
Write-Host "WARNING: installed for your account only. Any program running as you, an AI agent included, can stop"
|
|
Write-Host " the bastion or change what it allows."
|
|
if ($JustMe) { Write-Host " To install it for the whole machine instead, run this installer again without -JustMe." }
|
|
elseif ($fellBack) { Write-Host " To install it for the whole machine, run this installer again and answer Windows' prompt with an administrator's yes." }
|
|
if (-not $Pair) {
|
|
# Started now, not only at the next sign-in: it watches with no Host.
|
|
try { Start-ScheduledTask -TaskName 'PrivataeBastion'; $now = 'It is running now, and' } catch { $now = 'It' }
|
|
Write-Host "$now starts each time you sign in. Open a NEW terminal, then: privatae-bastion ui"
|
|
Write-Host "Connect a Host, if you run one (optional): privatae-bastion pair <token>"
|
|
}
|
|
}
|
|
|
|
if ($Pair) {
|
|
Write-Host ""
|
|
# The full path, never the name on PATH, which this window may not have
|
|
# picked up yet. The code goes on standard input: `pair -` reads its first
|
|
# line. `pair` exits 3 when this computer is already paired with that Host,
|
|
# which is success here too. On a computer that already serves another
|
|
# Host, `pair` asks in this window whether to add this one.
|
|
$Pair | & $exe pair -
|
|
$rc = $LASTEXITCODE
|
|
if ($rc -eq 0) { $done = 'This computer is paired.' }
|
|
elseif ($rc -eq 3) { $done = 'This computer was already paired with this Host; nothing changed there.' }
|
|
else { throw "Pairing did not finish (the reason is above). The bastion is installed; nothing else changed." }
|
|
|
|
# A running bastion reads a new pairing at its next start, so it is
|
|
# restarted, not just started.
|
|
if ($Service) {
|
|
Restart-Service -Name 'PrivataeBastion'
|
|
$how = 'The bastion runs as the Windows service PrivataeBastion, and starts with Windows.'
|
|
} else {
|
|
# Every copy is stopped first, from wherever it was started (a terminal,
|
|
# an older install, a detached copy after a self-update): each would
|
|
# hold this machine's first control port, 127.0.0.1:7878, and the new
|
|
# one would fail to start beside it.
|
|
Stop-ScheduledTask -TaskName 'PrivataeBastion' -ErrorAction SilentlyContinue
|
|
Get-Process -Name 'privatae-bastion' -ErrorAction SilentlyContinue | ForEach-Object {
|
|
Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue
|
|
}
|
|
try {
|
|
Start-ScheduledTask -TaskName 'PrivataeBastion'
|
|
$how = 'The bastion is running, and starts again each time you sign in to Windows.'
|
|
} catch {
|
|
Start-Process -FilePath $exe -ArgumentList 'run' -WindowStyle Hidden
|
|
$how = "The bastion is running until you sign out (its sign-in task could not be started: $($_.Exception.Message))."
|
|
}
|
|
}
|
|
Start-Sleep -Seconds 3
|
|
& $exe status
|
|
Write-Host ""
|
|
Write-Host "$done $how"
|
|
}
|
|
Write-Host "privatae-bastion is free software under the GNU GPL v3 or later: https://privatae.ai/bastion/LICENSE.txt"
|
|
}
|