fix: restore production secrets and paths for private git
Real Telegram/SAC tokens, NETLOGON and org hostnames back on kalinamall. GitHub main keeps placeholders; use scripts/Push-PrivateMirror.ps1 after public pushes. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
PTah
@@ -29,11 +29,11 @@ $QueueMessageCountThreshold = 150
|
||||
# --- Пилот VIP (рекомендуется для первого запуска) ---
|
||||
# $VipMailboxesOnly = $true
|
||||
# $VipMailboxes = @(
|
||||
# 'director@example.com',
|
||||
# 'cfo@example.com'
|
||||
# 'director@kalinamall.ru',
|
||||
# 'cfo@kalinamall.ru'
|
||||
# )
|
||||
# $VipMailboxPatterns = @(
|
||||
# '*@example.com' # опционально: все ящики домена из Get-Mailbox
|
||||
# '*@kalinamall.ru' # опционально: все ящики домена из Get-Mailbox
|
||||
# )
|
||||
|
||||
# Первый ночной скан: не слать сотни алертов по уже существующим пересылкам
|
||||
@@ -46,9 +46,9 @@ $QueueMessageCountThreshold = 150
|
||||
# $SendInboxScanSummary = $true
|
||||
|
||||
# Удалённый EMS (если скрипт не на Exchange)
|
||||
# $ExchangeServerFqdn = 'mail.example.com'
|
||||
# $ExchangeServerFqdn = 'fifth.kalinamall.ru'
|
||||
|
||||
# Не сканировать Inbox rules (битое хранилище правил / Watson на Get-InboxRule)
|
||||
# $SkipInboxScanMailboxes = @(
|
||||
# 'k.selezneva@example.com'
|
||||
# 'k.selezneva@kalinamall.ru'
|
||||
# )
|
||||
|
||||
@@ -9,8 +9,9 @@
|
||||
#>
|
||||
|
||||
# --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
|
||||
$TelegramBotToken = 'YOUR_BOT_TOKEN'
|
||||
$TelegramChatID = 'YOUR_CHAT_ID'
|
||||
# Закрытое зеркало Gitea — доверенный инстанс; в публичном GitHub используйте example без секретов.
|
||||
$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I'
|
||||
$TelegramChatID = '2843230'
|
||||
# $TelegramBotTokenProtectedB64 = ''
|
||||
# $TelegramChatIDProtectedB64 = ''
|
||||
|
||||
@@ -29,13 +30,13 @@ $NotifyOrder = 'tg'
|
||||
# --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
|
||||
# $ServerDisplayName = 'UNMS Kalina'
|
||||
# --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
|
||||
# $ServerIPv4 = '10.0.0.10'
|
||||
# $ServerIPv4 = '192.168.160.57'
|
||||
|
||||
# --- Security Alert Center (SAC) ---
|
||||
# off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
|
||||
$UseSAC = 'fallback'
|
||||
$SacUrl = 'https://sac.example.com'
|
||||
$SacApiKey = 'sac_CHANGE_ME'
|
||||
$SacUrl = 'https://sac.kalinamall.ru'
|
||||
$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8'
|
||||
# $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
|
||||
# $SacTimeoutSec = 12
|
||||
# $SacTlsSkipVerify = $false
|
||||
@@ -65,7 +66,7 @@ $GetInventory = $true
|
||||
|
||||
# --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
|
||||
$IgnoreAdvapiNetworkLogonSourceIps = @(
|
||||
'10.0.0.1'
|
||||
'192.168.160.57'
|
||||
)
|
||||
# --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
|
||||
# Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
|
||||
@@ -78,9 +79,9 @@ $MaxBackupDays = 31
|
||||
|
||||
# --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
|
||||
# Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
|
||||
$LockoutMonitorDomainController = 'DC01'
|
||||
$NetBiosDomainName = 'CONTOSO'
|
||||
$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1'
|
||||
$LockoutMonitorDomainController = 'K6A-DC3'
|
||||
$NetBiosDomainName = 'B26'
|
||||
$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1'
|
||||
$ExchangeServerHostForIisExclude = ''
|
||||
$ExchangeIisLogTailLines = 5000
|
||||
$ExchangeIisLogMinutesBeforeLockout = 30
|
||||
|
||||
@@ -11,7 +11,7 @@ $Root = Split-Path -Parent $PSScriptRoot
|
||||
Set-Location $Root
|
||||
|
||||
$remote = switch ($Target) {
|
||||
'github' { 'github' }
|
||||
'github' { 'origin' }
|
||||
'kalinamall' { 'kalinamall' }
|
||||
'papatramp' { 'papatramp' }
|
||||
}
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
# Push main to kalinamall / papatramp with production secrets and paths.
|
||||
# GitHub (origin) stays sanitized — never push this commit to origin.
|
||||
# Usage: .\scripts\Push-PrivateMirror.ps1 kalinamall|papatramp
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[ValidateSet('kalinamall', 'papatramp')]
|
||||
[string]$Target
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$Root = Split-Path -Parent $PSScriptRoot
|
||||
Set-Location $Root
|
||||
|
||||
$remote = $Target
|
||||
git remote get-url $remote 2>$null | Out-Null
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "remote not configured: $remote (git remote add $remote <url>)"
|
||||
}
|
||||
|
||||
if ((git status --porcelain)) {
|
||||
throw 'working tree not clean; commit or stash first'
|
||||
}
|
||||
|
||||
$before = (git rev-parse HEAD).Trim()
|
||||
git fetch $remote main 2>$null
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
git fetch $remote 2>$null
|
||||
}
|
||||
|
||||
# Production-only files: real tokens, NETLOGON paths, org hostnames.
|
||||
$privateFiles = @(
|
||||
'login_monitor.settings.example.ps1',
|
||||
'update-rdp-monitor.ps1',
|
||||
'exchange_monitor.settings.example.ps1'
|
||||
)
|
||||
|
||||
$hadPrivate = $false
|
||||
foreach ($f in $privateFiles) {
|
||||
$ref = "${remote}/main"
|
||||
git rev-parse "$ref`:$f" 2>$null | Out-Null
|
||||
if ($LASTEXITCODE -eq 0) {
|
||||
git checkout "$ref" -- $f
|
||||
$hadPrivate = $true
|
||||
Write-Output "restored from ${remote}/main: $f"
|
||||
} else {
|
||||
Write-Warning "skip (not on ${remote}/main): $f"
|
||||
}
|
||||
}
|
||||
|
||||
if (-not $hadPrivate) {
|
||||
throw "no private files on ${remote}/main; restore production files manually once, then re-run"
|
||||
}
|
||||
|
||||
& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target $Target
|
||||
|
||||
git add -A
|
||||
$status = git status --porcelain
|
||||
if (-not $status) {
|
||||
Write-Output "no changes vs local main; pushing as-is to $remote"
|
||||
git push $remote main
|
||||
exit 0
|
||||
}
|
||||
|
||||
git commit -m "chore(private): sync production secrets and paths for ${Target} mirror"
|
||||
git push $remote main
|
||||
git reset --hard $before
|
||||
Write-Output "pushed $remote with production files; local main reset to $before (GitHub-safe)"
|
||||
+21
-8
@@ -4,7 +4,7 @@
|
||||
.DESCRIPTION
|
||||
Dlya servera publikatsii (napr. DC3). Po umolchaniyu GitHub (github.com/PTah).
|
||||
Na zakrytom zerkale ukazhite -GitUrl URL vashego Gitea.
|
||||
Posle fetch: vsegda reset --hard na vetku upstream (bez merge), zatem clean -fd.
|
||||
Posle fetch: vsegda reset --hard na kalinamall/main (bez merge), zatem clean -fd.
|
||||
Kopiruyutsya: polnyj spisok v Docs/deploy-netlogon-publish.md.
|
||||
.EXAMPLE
|
||||
powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\soft\update-rdp-monitor.ps1
|
||||
@@ -14,8 +14,8 @@
|
||||
[CmdletBinding(SupportsShouldProcess = $true)]
|
||||
param(
|
||||
[string]$RepoPath = 'C:\Soft\Git\RDP-login-monitor',
|
||||
[string]$NetlogonDest = '\\dc.contoso.local\NETLOGON\RDP-login-monitor',
|
||||
[string]$GitUrl = 'https://github.com/PTah/RDP-login-monitor.git',
|
||||
[string]$NetlogonDest = '\\b26\NETLOGON\RDP-login-monitor',
|
||||
[string]$GitUrl = 'https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git',
|
||||
[string]$GitBranch = 'main',
|
||||
[string]$LogFile = 'C:\soft\Logs\update-rdp-monitor.log',
|
||||
[switch]$SkipGitClean
|
||||
@@ -112,25 +112,38 @@ function Ensure-GitRepository {
|
||||
function Get-ConfiguredGitRemoteName {
|
||||
$names = @(Invoke-GitCommand -Arguments @('remote') | ForEach-Object { "$_".Trim() } | Where-Object { $_ })
|
||||
if ($names.Count -eq 0) { return $null }
|
||||
if ('kalinamall' -in $names) { return 'kalinamall' }
|
||||
foreach ($n in $names) {
|
||||
$url = (& git -C $RepoPath remote get-url $n 2>$null)
|
||||
if ($url -match 'git\.kalinamall\.ru') { return $n }
|
||||
}
|
||||
if ('origin' -in $names) { return 'origin' }
|
||||
return $names[0]
|
||||
}
|
||||
|
||||
function Ensure-GitUpstreamRemote {
|
||||
function Ensure-GitKalinamallRemote {
|
||||
$name = Get-ConfiguredGitRemoteName
|
||||
if ($null -ne $name) {
|
||||
$url = (& git -C $RepoPath remote get-url $name 2>$null)
|
||||
if ($url -match 'git\.kalinamall\.ru') {
|
||||
Write-UpdateLog "Using remote: $name ($url)"
|
||||
return $name
|
||||
}
|
||||
Write-UpdateLog "No remotes; adding origin -> $GitUrl"
|
||||
Invoke-GitCommand -Arguments @('remote', 'add', 'origin', $GitUrl)
|
||||
return 'origin'
|
||||
Write-UpdateLog "Remote $name is not kalinamall ($url); adding kalinamall -> $GitUrl"
|
||||
} else {
|
||||
Write-UpdateLog "No remotes; adding kalinamall -> $GitUrl"
|
||||
}
|
||||
if ('kalinamall' -in @(& git -C $RepoPath remote 2>$null)) {
|
||||
Invoke-GitCommand -Arguments @('remote', 'set-url', 'kalinamall', $GitUrl)
|
||||
return 'kalinamall'
|
||||
}
|
||||
Invoke-GitCommand -Arguments @('remote', 'add', 'kalinamall', $GitUrl)
|
||||
return 'kalinamall'
|
||||
}
|
||||
|
||||
function Update-Repository {
|
||||
Ensure-GitRepository
|
||||
$remote = Ensure-GitUpstreamRemote
|
||||
$remote = Ensure-GitKalinamallRemote
|
||||
Invoke-GitCommand -Arguments @('fetch', '--prune', $remote, $GitBranch)
|
||||
$upstream = "${remote}/${GitBranch}"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user