From ad18d49dc917a0cd23c4f168b0e4314320597892 Mon Sep 17 00:00:00 2001
From: christian <christian@waterschurch.org>
Date: Thu, 8 Oct 2026 14:40:04 -0400
Subject: [PATCH] windows-setup: allow SSH from NA Ingest on any network
 profile

Windows' OpenSSH firewall rule covers Private networks only, so SSH timed out
on the Bible TV PC (Wi-Fi). Open it on any profile, but only to NA Ingest's
two addresses, and print each adapter's network category in the RESULT.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 remote-access/windows-setup.ps1 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/remote-access/windows-setup.ps1 b/remote-access/windows-setup.ps1
index fc7577a..6ce6807 100644
--- a/remote-access/windows-setup.ps1
+++ b/remote-access/windows-setup.ps1
@@ -15,6 +15,7 @@
 
 $ErrorActionPreference = 'Stop'
 $Key = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM2BPUpVpbMxKumLayVSutUsFWUXEfJ/4vxIJ0thbgY status-panel@NA-Ingest'
+$IngestIPs = @('10.1.1.1', '10.6.3.222')   # NA Ingest on the 10.1 and 10.6 networks
 $notes = @()
 
 # 1. OpenSSH Server, started now and at every boot, allowed through the firewall
@@ -40,6 +41,8 @@ if (-not (Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction Silentl
     New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True `
         -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 | Out-Null
 }
+# Windows' own rule covers "Private" networks only; open it on any network, but to NA Ingest alone.
+Set-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -Profile Any -RemoteAddress $IngestIPs
 Enable-NetFirewallRule -Name 'OpenSSH-Server-In-TCP'
 
 # 2. NA Ingest's key. Administrators read C:\ProgramData\ssh\administrators_authorized_keys,
@@ -96,7 +99,7 @@ Write-Host ''
 Write-Host '===== RESULT (send this to Claude) ====='
 Write-Host ('pc=' + $env:COMPUTERNAME + ' user=' + $env:USERNAME + ' domain=' + $env:USERDOMAIN)
 Write-Host ('sshd=' + (Get-Service sshd).Status)
-foreach ($nic in $nics) { Write-Host ('nic=' + $nic.Name + ' mac=' + $nic.MacAddress + ' ip=' + ((Get-NetIPAddress -InterfaceIndex $nic.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue).IPAddress -join ',')) }
+foreach ($nic in $nics) { Write-Host ('nic=' + $nic.Name + ' mac=' + $nic.MacAddress + ' ip=' + ((Get-NetIPAddress -InterfaceIndex $nic.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue).IPAddress -join ',') + ' network=' + (Get-NetConnectionProfile -InterfaceIndex $nic.ifIndex -ErrorAction SilentlyContinue).NetworkCategory) }
 if ($tasks) { $tasks | ForEach-Object { Write-Host ('task: ' + $_) } } else { Write-Host 'task: none (no known apps found)' }
 $notes | ForEach-Object { Write-Host ('note: ' + $_) }
 Write-Host '========================================'