$ErrorActionPreference = 'Stop'

# Install and enable Windows SSH.
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Out-Null
Set-Service sshd -StartupType Automatic
Start-Service sshd

# Authorize the dedicated key I created on p16v.
$pub = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJzZpsGbDSPpcO3jh/WkVi7NRZyYJEvn5H5hPez6bGd+ p16v-codex-coco'
$keys = "$env:ProgramData\ssh\administrators_authorized_keys"
if (!(Test-Path $keys)) {
    New-Item -ItemType File -Path $keys -Force | Out-Null
}
if (!(Select-String -LiteralPath $keys -SimpleMatch $pub -Quiet)) {
    Add-Content -LiteralPath $keys -Value "`r`n$pub" -Encoding ascii
}
icacls.exe $keys /inheritance:r /grant '*S-1-5-32-544:F' '*S-1-5-18:F'

# Restrict the standard SSH firewall rule to p16v over Tailscale.
$rule = 'OpenSSH-Server-In-TCP'
if (!(Get-NetFirewallRule -Name $rule -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -Name $rule -DisplayName 'OpenSSH Server' `
        -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow | Out-Null
}
Set-NetFirewallRule -Name $rule -Enabled True `
    -LocalAddress 100.84.234.87 -RemoteAddress 100.80.118.29

whoami
Get-Service sshd