netbird: Claude-Diag setup-key + PowerShell-скрипт для Windows

Создан reusable setup-key tenant'а netbird.io для временных диагностических подключений Claude к хостам. Группа Claude-Diag (d7jra32fadhs73dmqv5g), ключ 83301E74-6F86-4CBD-AF77-0C65730103CA, истекает 2026-05-21. snippets/netbird-claude-install.ps1 — идемпотентный PowerShell-скрипт: ставит MSI, регистрирует в tenant, включает RDP и WinRM, открывает firewall только для 100.70.0.0/16. credentials.md — добавлена секция Netbird (API token, setup keys, команда перевыпуска ключа).
2026-04-21 20:38:43 +03:00
parent c1819f96a8
commit f203bf96e3
3 changed files with 112 additions and 0 deletions
--- a/projects/dttb/credentials.md
+++ b/projects/dttb/credentials.md
@@ -96,6 +96,29 @@ tags: [dttb]
 | 10.0.0.250 (Proxmox) | 22 | root / `1qaz!QAZ` |
 | VPS swtest.ru (`89.111.140.86` / `100.70.93.36`) | 22 | root / ключ `~/.ssh/vps_znam_key` (RSA). Алиас SSH: `ssh vps-znam` (через Netbird) или `ssh vps-znam-public`. Ключ развёрнут на Mac и openclaw LXC 137. Подробности: [vps-swtest.md](vps-swtest.md) |

+## Netbird (netbird.io cloud)
+
+| Параметр | Значение |
+|----------|----------|
+| API Token | `nbp_YTEmAVpS0hLhnTeJ09q3wYaC0AAXjN21NPvM` |
+| API URL | `https://api.netbird.io` |
+| SSO | `batlaew@yandex.ru` |
+
+### Setup keys
+
+| Назначение | Ключ | Группа | Истекает | Тип |
+|------------|------|--------|----------|-----|
+| **Claude-Diag** (временные подключения Claude для диагностики) — скрипт: [snippets/netbird-claude-install.ps1](../../snippets/netbird-claude-install.ps1) | `83301E74-6F86-4CBD-AF77-0C65730103CA` | Claude-Diag (`d7jra32fadhs73dmqv5g`) | 2026-05-21 | reusable, unlimited |
+| Glavtorg | `5D1E3507-6F1C-41FC-B86F-05C60364A146` | Glavtorg | — | — |
+
+**Продление Claude-Diag ключа** (через API при истечении):
+```bash
+curl -s -X POST -H "Authorization: Token nbp_YTEmAVpS0hLhnTeJ09q3wYaC0AAXjN21NPvM" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"Claude Diagnostic","type":"reusable","expires_in":2592000,"auto_groups":["d7jra32fadhs73dmqv5g"],"usage_limit":0,"ephemeral":false}' \
+  https://api.netbird.io/api/setup-keys
+```
+
 ---

 ## Заметки
--- a/snippets/README.md
+++ b/snippets/README.md
@@ -5,3 +5,4 @@

 - [[snippets/clawdbot-cliproxy-config]]
 - [[snippets/proxmox-console-quirks]]
+- [netbird-claude-install.ps1](netbird-claude-install.ps1) — установка Netbird на Windows + RDP/WinRM для диагностики через Claude-Diag ключ
--- a/snippets/netbird-claude-install.ps1
+++ b/snippets/netbird-claude-install.ps1
@@ -0,0 +1,88 @@
+# netbird-claude-install.ps1
+# Установка Netbird на Windows + регистрация в tenant netbird.io (группа Claude-Diag)
+# + включение RDP и WinRM для удалённой диагностики через Netbird-интерфейс.
+#
+# Запуск: PowerShell от администратора
+#   iwr -useb https://git.dttb.ru/oleg/knowledge-base/raw/branch/main/snippets/netbird-claude-install.ps1 | iex
+# Или скачать и выполнить локально:
+#   powershell -ExecutionPolicy Bypass -File .\netbird-claude-install.ps1
+#
+# Идемпотентно: можно запускать повторно.
+
+$ErrorActionPreference = "Stop"
+
+# ===== Параметры =====
+$SETUP_KEY    = "83301E74-6F86-4CBD-AF77-0C65730103CA"   # Claude-Diag, истекает 2026-05-21
+$NETBIRD_CIDR = "100.70.0.0/16"                          # адресное пространство tenant'а
+$NETBIRD_EXE  = "C:\Program Files\Netbird\netbird.exe"
+
+# ===== 1. Проверка прав =====
+$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Error "Нужен PowerShell от администратора."
+    exit 1
+}
+
+Write-Host "=== Netbird Claude-Diag setup ===" -ForegroundColor Cyan
+
+# ===== 2. Установка Netbird =====
+if (-not (Test-Path $NETBIRD_EXE)) {
+    Write-Host "[1/5] Скачиваю Netbird MSI..."
+    $msi = "$env:TEMP\netbird.msi"
+    Invoke-WebRequest -UseBasicParsing -Uri "https://pkgs.netbird.io/windows/x64" -OutFile $msi
+    Write-Host "[2/5] Устанавливаю (silent)..."
+    Start-Process msiexec.exe -ArgumentList "/i `"$msi`" /qn" -Wait
+    Start-Sleep 5
+} else {
+    Write-Host "[1-2/5] Netbird уже установлен: $NETBIRD_EXE"
+}
+
+# ===== 3. Регистрация =====
+Write-Host "[3/5] Регистрация в tenant с Claude-Diag ключом..."
+& $NETBIRD_EXE up --setup-key $SETUP_KEY
+Start-Sleep 3
+
+# ===== 4. RDP =====
+Write-Host "[4/5] Включаю RDP..."
+Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0
+Enable-NetFirewallRule -DisplayGroup "Remote Desktop" -ErrorAction SilentlyContinue
+
+# ===== 5. WinRM + firewall только для Netbird-подсети =====
+Write-Host "[5/5] Включаю WinRM и правила firewall для $NETBIRD_CIDR..."
+try {
+    Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
+} catch {
+    winrm quickconfig -force -q | Out-Null
+}
+Set-Item WSMan:\localhost\Service\Auth\Basic -Value $true -Force
+Set-Item WSMan:\localhost\Service\AllowUnencrypted -Value $true -Force
+
+$rules = @(
+    @{Name = "Claude-Diag-RDP";        Port = 3389},
+    @{Name = "Claude-Diag-WinRM-HTTP"; Port = 5985},
+    @{Name = "Claude-Diag-WinRM-HTTPS";Port = 5986}
+)
+foreach ($r in $rules) {
+    Get-NetFirewallRule -DisplayName $r.Name -ErrorAction SilentlyContinue | Remove-NetFirewallRule
+    New-NetFirewallRule -DisplayName $r.Name `
+        -Direction Inbound -Protocol TCP -LocalPort $r.Port `
+        -RemoteAddress $NETBIRD_CIDR -Action Allow | Out-Null
+}
+
+# ===== Итог =====
+Write-Host ""
+Write-Host "=== Статус ===" -ForegroundColor Green
+& $NETBIRD_EXE status
+
+$nbIp = (Get-NetIPAddress -AddressFamily IPv4 -ErrorAction SilentlyContinue |
+         Where-Object {$_.IPAddress -like "100.70.*"} | Select-Object -First 1).IPAddress
+
+Write-Host ""
+Write-Host "=== Данные для Claude ===" -ForegroundColor Yellow
+Write-Host "Netbird IP : $nbIp"
+Write-Host "Hostname   : $env:COMPUTERNAME"
+Write-Host "User       : $env:USERNAME"
+Write-Host "RDP        : mstsc /v:$nbIp  (логин $env:USERNAME)"
+Write-Host "WinRM      : 5985/tcp (HTTP), 5986/tcp (HTTPS) — доступны с 100.70.0.0/16"
+Write-Host ""
+Write-Host "Пришли Claude: IP $nbIp + пароль пользователя $env:USERNAME"