|
|
|
@@ -1,8 +1,12 @@
|
|
|
|
|
<#
|
|
|
|
|
GTI Fiscal Agent - Windows operations script (RC1). No Python editing needed.
|
|
|
|
|
|
|
|
|
|
Usage (elevated PowerShell for install/start/stop/restart/uninstall):
|
|
|
|
|
.\gti-agent.ps1 install create venv, install dependencies, register the Windows Service (does NOT start it)
|
|
|
|
|
Usage (elevated PowerShell for install/install-auto/start/stop/restart/uninstall):
|
|
|
|
|
.\gti-agent.ps1 install-auto bundle downloaded from the panel's "Nova instalação": verifies the
|
|
|
|
|
package's SHA-256, enrolls with the Hub using enrollment.json (deleted
|
|
|
|
|
right after, single use), writes .env, registers the service. Does NOT
|
|
|
|
|
start it — Firebird is still unconfigured; fill it in and run start.
|
|
|
|
|
.\gti-agent.ps1 install manual path: create venv, install dependencies, register the Windows Service (does NOT start it)
|
|
|
|
|
.\gti-agent.ps1 configure [-FromTemplate f] write <install>\.env (secrets are prompted, never echoed, never stored in the package)
|
|
|
|
|
.\gti-agent.ps1 preflight PREFLIGHT=PASS|FAIL with blockers (read-only)
|
|
|
|
|
.\gti-agent.ps1 start | stop | restart service control (start refuses to run when preflight fails)
|
|
|
|
@@ -13,7 +17,7 @@
|
|
|
|
|
#>
|
|
|
|
|
param(
|
|
|
|
|
[Parameter(Position = 0, Mandatory = $true)]
|
|
|
|
|
[ValidateSet('install', 'configure', 'preflight', 'start', 'stop', 'restart', 'status', 'uninstall')]
|
|
|
|
|
[ValidateSet('install', 'install-auto', 'configure', 'preflight', 'start', 'stop', 'restart', 'status', 'uninstall')]
|
|
|
|
|
[string]$Command,
|
|
|
|
|
[string]$FromTemplate,
|
|
|
|
|
[switch]$Purge
|
|
|
|
@@ -58,6 +62,90 @@ switch ($Command) {
|
|
|
|
|
sc.exe failure $ServiceName reset= 86400 actions= restart/60000/restart/60000/restart/60000 | Out-Null
|
|
|
|
|
Write-Host "Service $ServiceName registered (Automatic). Next: .\gti-agent.ps1 configure ; .\gti-agent.ps1 preflight ; .\gti-agent.ps1 start"
|
|
|
|
|
}
|
|
|
|
|
'install-auto' {
|
|
|
|
|
Assert-Admin
|
|
|
|
|
$EnrollmentFile = Join-Path $Root 'enrollment.json'
|
|
|
|
|
$ManifestFile = Join-Path $Root 'MANIFEST.json'
|
|
|
|
|
|
|
|
|
|
# Idempotent: a second run after a successful enroll must not re-enroll,
|
|
|
|
|
# re-register the service, or touch the existing identity.
|
|
|
|
|
if ((Test-Path $EnvFile) -and (Select-String -Path $EnvFile -Pattern '^AGENT_TOKEN=\S' -Quiet) -and (Get-Service $ServiceName -ErrorAction SilentlyContinue)) {
|
|
|
|
|
Write-Host "Already enrolled and installed ($EnvFile exists, service $ServiceName registered). Nothing to do."
|
|
|
|
|
exit 0
|
|
|
|
|
}
|
|
|
|
|
if (-not (Test-Path $EnrollmentFile)) { throw "enrollment.json not found in $Root — this bundle was already installed, or was not downloaded from a pending installation link." }
|
|
|
|
|
if (-not (Get-Command python -ErrorAction SilentlyContinue)) { throw 'Python 3.12 (64-bit) is required on PATH.' }
|
|
|
|
|
|
|
|
|
|
$enrollment = Get-Content $EnrollmentFile -Raw | ConvertFrom-Json
|
|
|
|
|
if ($enrollment.hub_url -notmatch '^https://') { throw "Refusing: hub_url must be https:// (got: $($enrollment.hub_url))" }
|
|
|
|
|
|
|
|
|
|
# Package integrity: every file this manifest lists must still match its
|
|
|
|
|
# recorded SHA-256 — catches a corrupted or tampered extraction before
|
|
|
|
|
# anything in it runs or is installed as a service.
|
|
|
|
|
if (Test-Path $ManifestFile) {
|
|
|
|
|
$manifest = Get-Content $ManifestFile -Raw | ConvertFrom-Json
|
|
|
|
|
$checked = 0
|
|
|
|
|
foreach ($entry in $manifest.files.PSObject.Properties) {
|
|
|
|
|
$target = Join-Path $Root $entry.Name
|
|
|
|
|
if (-not (Test-Path $target)) { throw "SHA256_VALIDATION=FAIL: missing file $($entry.Name)" }
|
|
|
|
|
$actual = (Get-FileHash -Path $target -Algorithm SHA256).Hash.ToLower()
|
|
|
|
|
if ($actual -ne $entry.Value) { throw "SHA256_VALIDATION=FAIL: $($entry.Name) does not match the published manifest" }
|
|
|
|
|
$checked++
|
|
|
|
|
}
|
|
|
|
|
Write-Host "SHA256_VALIDATION=PASS ($checked files)"
|
|
|
|
|
} else {
|
|
|
|
|
Write-Host 'SHA256_VALIDATION=SKIPPED (no MANIFEST.json in this bundle)'
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$agentVersion = ((Get-Content (Join-Path $Root 'VERSION') -Raw) -replace '\s', '')
|
|
|
|
|
$machineId = try { (Get-CimInstance Win32_ComputerSystemProduct -ErrorAction Stop).UUID } catch { '' }
|
|
|
|
|
$body = @{
|
|
|
|
|
installation_id = $enrollment.installation_id
|
|
|
|
|
enrollment_token = $enrollment.enrollment_token
|
|
|
|
|
agent_version = $agentVersion
|
|
|
|
|
hostname = $env:COMPUTERNAME
|
|
|
|
|
platform = 'windows'
|
|
|
|
|
machine_fingerprint = $machineId
|
|
|
|
|
} | ConvertTo-Json
|
|
|
|
|
|
|
|
|
|
Write-Host "Enrolling installation $($enrollment.installation_id) at $($enrollment.hub_url)..."
|
|
|
|
|
try {
|
|
|
|
|
$response = Invoke-RestMethod -Method Post -Uri "$($enrollment.hub_url)$($enrollment.enroll_path)" -Body $body -ContentType 'application/json'
|
|
|
|
|
} catch {
|
|
|
|
|
throw "ENROLLMENT_REJECTED: $($_.Exception.Message)"
|
|
|
|
|
}
|
|
|
|
|
if ($response.hostname_mismatch) {
|
|
|
|
|
Write-Warning 'hostname_mismatch=true: the operator expected a different hostname for this installation. Enrollment still succeeded — confirm this is the intended machine.'
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# The Hub already rejects any reuse of this token, but the bundle's own
|
|
|
|
|
# copy is deleted immediately too, so it never lingers on disk.
|
|
|
|
|
Remove-Item $EnrollmentFile -Force
|
|
|
|
|
|
|
|
|
|
$lines = @(
|
|
|
|
|
"GTI_HUB_URL=$($response.hub_url)", "AGENT_TOKEN=$($response.agent_token)", "AGENT_ID=$($response.agent_id)",
|
|
|
|
|
'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', "AGENT_VERSION=$agentVersion",
|
|
|
|
|
'FIREBIRD_DATABASE_PATH=', 'FB_USER=SYSDBA', 'FB_PASSWORD=', 'COMPANY_CODE=', 'COMPANY_CNPJ=', 'COMPANY_CRT_SOURCE=AUTO'
|
|
|
|
|
)
|
|
|
|
|
Set-Content -Path $EnvFile -Value $lines -Encoding UTF8
|
|
|
|
|
# Only Administrators and SYSTEM may read the file that now holds AGENT_TOKEN.
|
|
|
|
|
icacls $EnvFile /inheritance:r /grant:r 'Administrators:(F)' 'SYSTEM:(F)' | Out-Null
|
|
|
|
|
|
|
|
|
|
if (-not (Test-Path $Py)) { python -m venv $Venv }
|
|
|
|
|
& $Py -m pip install --upgrade pip | Out-Null
|
|
|
|
|
& $Py -m pip install -r (Join-Path $Root 'requirements-agent.txt')
|
|
|
|
|
$post = Join-Path $Venv 'Scripts\pywin32_postinstall.py'
|
|
|
|
|
if (Test-Path $post) { & $Py $post -install | Out-Null }
|
|
|
|
|
$svc = Join-Path $Root 'agent\service\gti_agent_windows_service.py'
|
|
|
|
|
& $Py $svc --startup=auto install
|
|
|
|
|
sc.exe failure $ServiceName reset= 86400 actions= restart/60000/restart/60000/restart/60000 | Out-Null
|
|
|
|
|
|
|
|
|
|
Write-Host ''
|
|
|
|
|
Write-Host "ENROLLMENT_SUCCEEDED: agent_id=$($response.agent_id) hub=$($response.hub_url)"
|
|
|
|
|
Write-Host "Service $ServiceName registered (Automatic) but NOT started — Firebird is still unconfigured (by design: this script never guesses a client's database path or credentials)."
|
|
|
|
|
Write-Host "Next: edit $EnvFile (FIREBIRD_DATABASE_PATH, FB_USER, FB_PASSWORD, and COMPANY_CODE/COMPANY_CNPJ if needed),"
|
|
|
|
|
Write-Host ' then: .\gti-agent.ps1 preflight ; .\gti-agent.ps1 start'
|
|
|
|
|
}
|
|
|
|
|
'configure' {
|
|
|
|
|
if ($FromTemplate) {
|
|
|
|
|
Copy-Item -Path $FromTemplate -Destination $EnvFile -Force
|
|
|
|
@@ -76,7 +164,7 @@ switch ($Command) {
|
|
|
|
|
"GTI_HUB_URL=$hub", "AGENT_TOKEN=$token", "AGENT_ID=$agentId",
|
|
|
|
|
"COMPANY_CODE=$code", "COMPANY_CNPJ=$cnpj", "COMPANY_CRT_SOURCE=$crtSource",
|
|
|
|
|
"FIREBIRD_DATABASE_PATH=$db", "FB_USER=$fbUser", "FB_PASSWORD=$fbPass",
|
|
|
|
|
'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.0.0-rc1'
|
|
|
|
|
'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.1.0'
|
|
|
|
|
)
|
|
|
|
|
Set-Content -Path $EnvFile -Value $lines -Encoding UTF8
|
|
|
|
|
}
|
|
|
|
|
gti
Claude Sonnet 5