WindowsServer/ConfigWinRMForZabbix/Download-WinRMConfigScript.ps1

<#
.SYNOPSIS
    Downloads ConfigWinRM.ps1 and ConfigWinRM.xml to C:\WinRM and optionally sets the
    Zabbix Proxy IP address as the WinRM firewall trusted host.

.DESCRIPTION
    Downloads ConfigWinRM.ps1 and ConfigWinRM.xml from the internal Git server
    (git.totalservice.cz, WindowsServer repo) into C:\WinRM, creating that folder if it
    does not already exist. After the download, it asks for the Zabbix Proxy IP
    address: if one is entered, it is written into the <FWWinRMTrustedHosts> element of
    the downloaded ConfigWinRM.xml; if the prompt is left empty (Enter only),
    ConfigWinRM.xml is left unchanged. The IP address can also be supplied directly via
    the -ZabbixProxyIPAddress parameter to run the script non-interactively.

.PARAMETER ZabbixProxyIPAddress
    Zabbix Proxy IP address to allow through the WinRM firewall rule
    (FWWinRMTrustedHosts in ConfigWinRM.xml). Omit this parameter to be prompted
    interactively; pass an empty string to skip the prompt and leave the existing
    value in ConfigWinRM.xml unchanged.

.EXAMPLE
    PS> .\Download-WinRMConfigScript.ps1
    Downloads both files to C:\WinRM and interactively prompts for the Zabbix Proxy IP
    address.

.EXAMPLE
    PS> .\Download-WinRMConfigScript.ps1 -ZabbixProxyIPAddress '192.168.10.50'
    Downloads both files and sets FWWinRMTrustedHosts to 192.168.10.50 without prompting.

.EXAMPLE
    PS> .\Download-WinRMConfigScript.ps1 -ZabbixProxyIPAddress '192.168.10.50' -WhatIf
    Shows what would be downloaded/changed without actually downloading or modifying
    anything.

.EXAMPLE
    PS> irm https://s.tslab.cz/ZBXWinRM | iex
    Runs the script directly from the repo without saving it locally first, prompting
    interactively for the Zabbix Proxy IP address. To pass -ZabbixProxyIPAddress in the
    same one-liner, wrap it as a script block instead:
    PS> iex "& { $(irm https://s.tslab.cz/ZBXWinRM) } -ZabbixProxyIPAddress '192.168.10.50'"

.NOTES
    Author:   Petr Štěpán
    Created:  2026-07-21
    Version:  1.0.0
    Changelog:
        1.0.0 - Initial version
#>

[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Medium')]
param(
    [Parameter(Mandatory = $false, HelpMessage = 'Zabbix Proxy IP address to allow through the WinRM firewall rule. Leave empty to keep the existing value.')]
    [string]
    $ZabbixProxyIPAddress
)

# --- Safety preamble -------------------------------------------------------
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# Older Windows Server releases don't enable TLS 1.2 by default, which would make the
# download below fail silently against a TLS-1.2-only server.
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

$SourceBaseUri   = 'https://git.totalservice.cz/PSScripts/WindowsServer/raw/branch/main/ConfigWinRMForZabbix'
$DestinationPath = 'C:\WinRM'
$ScriptFile      = Join-Path -Path $DestinationPath -ChildPath 'ConfigWinRM.ps1'
$ConfigFile      = Join-Path -Path $DestinationPath -ChildPath 'ConfigWinRM.xml'

# --- Functions ---------------------------------------------------------

function Invoke-RemoteFileDownload {
    <#
    .SYNOPSIS
        Downloads a single file from a URI to a local path.
    .PARAMETER Uri
        Source URI to download from.
    .PARAMETER OutFile
        Local destination file path.
    #>
    [CmdletBinding(SupportsShouldProcess = $true)]
    param(
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [string]
        $Uri,

        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [string]
        $OutFile
    )

    if ($PSCmdlet.ShouldProcess($OutFile, "Download from $Uri")) {
        try {
            Invoke-WebRequest -Uri $Uri -OutFile $OutFile -UseBasicParsing
            Write-Host "Downloaded '$Uri' to '$OutFile'."
        }
        catch {
            Write-Error "Failed to download '$Uri' to '$OutFile': $_"
            throw
        }
    }
}

function Update-WinRMTrustedHostConfig {
    <#
    .SYNOPSIS
        Sets the <FWWinRMTrustedHosts> element of a ConfigWinRM.xml file.
    .PARAMETER Path
        Path to the ConfigWinRM.xml file to update.
    .PARAMETER TrustedHost
        Value to write into <FWWinRMTrustedHosts>.
    #>
    [CmdletBinding(SupportsShouldProcess = $true)]
    param(
        [Parameter(Mandatory = $true)]
        [ValidateScript({ Test-Path -Path $_ -PathType Leaf })]
        [string]
        $Path,

        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [string]
        $TrustedHost
    )

    try {
        # PreserveWhitespace keeps the original file's indentation/comments intact -
        # without it, XmlDocument.Save() would reformat the whole file.
        $xml = New-Object -TypeName System.Xml.XmlDocument
        $xml.PreserveWhitespace = $true
        $xml.Load($Path)

        $node = $xml.ConfigWinRM.Options.FWWinRMTrustedHosts
        if ($null -eq $node) {
            throw "Element <FWWinRMTrustedHosts> was not found in '$Path'."
        }

        if ($PSCmdlet.ShouldProcess($Path, "Set FWWinRMTrustedHosts to '$TrustedHost'")) {
            $xml.ConfigWinRM.Options.FWWinRMTrustedHosts = $TrustedHost
            $xml.Save($Path)
            Write-Host "FWWinRMTrustedHosts set to '$TrustedHost' in '$Path'."
        }
    }
    catch {
        Write-Error "Failed to update '$Path': $_"
        throw
    }
}

# --- Main --------------------------------------------------------------
try {
    if (-not (Test-Path -Path $DestinationPath)) {
        if ($PSCmdlet.ShouldProcess($DestinationPath, 'Create directory')) {
            New-Item -Path $DestinationPath -ItemType Directory -Force | Out-Null
            Write-Host "Created directory '$DestinationPath'."
        }
    }

    Invoke-RemoteFileDownload -Uri "$SourceBaseUri/ConfigWinRM.ps1" -OutFile $ScriptFile
    Invoke-RemoteFileDownload -Uri "$SourceBaseUri/ConfigWinRM.xml" -OutFile $ConfigFile

    # Only prompt when the caller did not pass the parameter at all - an explicit empty
    # string ("") means "skip the prompt, leave ConfigWinRM.xml unchanged".
    if (-not $PSBoundParameters.ContainsKey('ZabbixProxyIPAddress')) {
        $ZabbixProxyIPAddress = Read-Host -Prompt 'Enter Zabbix Proxy IP address (press Enter to keep the current value)'
    }

    if ([string]::IsNullOrWhiteSpace($ZabbixProxyIPAddress)) {
        Write-Host 'No Zabbix Proxy IP address provided - ConfigWinRM.xml left unchanged.'
    }
    else {
        $parsedIp = $null
        if (-not [System.Net.IPAddress]::TryParse($ZabbixProxyIPAddress, [ref] $parsedIp)) {
            throw "'$ZabbixProxyIPAddress' is not a valid IP address."
        }

        Update-WinRMTrustedHostConfig -Path $ConfigFile -TrustedHost $ZabbixProxyIPAddress
    }
}
catch {
    Write-Error "Script failed: $_"
    exit 1
}

exit 0