Gorelo Agent 無法安裝

$scriptContent = @'
# Gorelo Agent Pre-Installation Check Script
# Updated: 2026-03-22
# Checks system requirements, connectivity (including Cloudflare R2), TLS, and permissions

function Write-ColorOutput {
    param (
        [string]$Message,
        [string]$Color = "White",
        [bool]$IsError = $false
    )
    if ($IsError) {
        Write-Host $Message -ForegroundColor Red
    } else {
        Write-Host $Message -ForegroundColor $Color
    }
}

$hasError = $false

Write-Host ""
Write-Host "======================================" -ForegroundColor Cyan
Write-Host "  Gorelo Agent Pre-Installation Check" -ForegroundColor Cyan
Write-Host "======================================" -ForegroundColor Cyan
Write-Host ""

# --- REGION SELECTION ---
# Run via Invoke-Expression, so there are no script parameters. Set $env:GORELO_REGION = "USW" or "AUE"
# beforehand to skip the prompt (e.g. for unattended runs).
$regions = @{
    "USW" = "usw"
    "AUE" = "aue"
}
$region = $env:GORELO_REGION
if ($region) { $region = $region.Trim().ToUpper() }
while (-not $regions.ContainsKey("$region")) {
    Write-Host "Select your Gorelo region:" -ForegroundColor Cyan
    Write-Host "  1) USW (United States West)"
    Write-Host "  2) AUE (Australia East)"
    $choice = (Read-Host "Enter 1 or 2 (or USW / AUE)").Trim().ToUpper()
    switch ($choice) {
        "1"     { $region = "USW" }
        "2"     { $region = "AUE" }
        default { $region = $choice }
    }
    if (-not $regions.ContainsKey("$region")) {
        Write-ColorOutput "Invalid selection '$choice'. Please choose USW or AUE." -Color Yellow
    }
}
$regionCode = $regions[$region]
Write-ColorOutput "INFO: Region selected: $region" -Color White
Write-Host ""

# --- SYSTEM CHECKS ---
Write-Host "[System Checks]" -ForegroundColor Cyan

# OS Version
$osInfo = Get-CimInstance Win32_OperatingSystem
Write-ColorOutput "INFO: $($osInfo.Caption) ($($osInfo.Version))" -Color White

# PowerShell version
$requiredVersion = [version]'5.1'
$installedVersion = $PSVersionTable.PSVersion
if ($installedVersion -lt $requiredVersion) {
    Write-ColorOutput "FAIL: PowerShell version $($installedVersion) is below required $requiredVersion" -IsError $true
    $hasError = $true
} else {
    Write-ColorOutput "PASS: PowerShell version $($installedVersion)" -Color Green
}

# 64-bit check
if ($env:PROCESSOR_ARCHITECTURE -eq "AMD64") {
    Write-ColorOutput "PASS: 64-bit processor architecture" -Color Green
} else {
    Write-ColorOutput "FAIL: Non-64-bit architecture detected: $($env:PROCESSOR_ARCHITECTURE)" -IsError $true
    $hasError = $true
}

# 64-bit Program Files
if ($Env:ProgramW6432) {
    Write-ColorOutput "PASS: 64-bit Program Files folder exists ($($Env:ProgramW6432))" -Color Green
} else {
    Write-ColorOutput "FAIL: 64-bit Program Files folder not found" -IsError $true
    $hasError = $true
}

# System drive space
$systemDrive = $env:SystemDrive
if ($systemDrive) {
    $driveInfo = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Name -eq $systemDrive[0] }
    if ($driveInfo) {
        $freeSpaceMB = [math]::Round($driveInfo.Free / 1MB, 2)
        if ($freeSpaceMB -le 300) {
            Write-ColorOutput "FAIL: Free space is less than 300 MB (Current: $freeSpaceMB MB)" -IsError $true
            $hasError = $true
        } else {
            Write-ColorOutput "PASS: System drive space ($freeSpaceMB MB free)" -Color Green
        }
    } else {
        Write-ColorOutput "FAIL: Unable to get drive info" -IsError $true
        $hasError = $true
    }
}

# Administrator check
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if ($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-ColorOutput "PASS: Running as Administrator" -Color Green
} else {
    Write-ColorOutput "FAIL: Not running as Administrator (required for installation)" -IsError $true
    $hasError = $true
}

Write-Host ""
Write-Host "[TLS / Security Checks]" -ForegroundColor Cyan

# TLS 1.2 check
$tlsProtocols = [Net.ServicePointManager]::SecurityProtocol
if ($tlsProtocols -band [Net.SecurityProtocolType]::Tls12) {
    Write-ColorOutput "PASS: TLS 1.2 is enabled in SecurityProtocol ($tlsProtocols)" -Color Green
} else {
    Write-ColorOutput "WARN: TLS 1.2 not in default SecurityProtocol ($tlsProtocols). Enabling..." -Color Yellow
    try {
        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
        Write-ColorOutput "PASS: TLS 1.2 enabled successfully" -Color Green
    } catch {
        Write-ColorOutput "FAIL: Could not enable TLS 1.2. Error: $_" -IsError $true
        $hasError = $true
    }
}

# Ensure TLS 1.2 is active for all subsequent web requests
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

Write-Host ""
Write-Host "[Connectivity Checks]" -ForegroundColor Cyan

# URL connectivity checks
$urls = @(
    @{
        Url = "https://www.google.com/"
        ExpectedStatus = 200
        Description = "Internet connectivity"
    },
    @{
        Url = "https://gw.$regionCode.gorelo.tech/rmm-login/api/login/_health"
        ExpectedStatus = 200
        Description = "Gorelo Gateway ($region)"
    },
    @{
        Url = "https://sr.rmm.pod1.$regionCode.gorelo.tech/api/_health"
        ExpectedStatus = 200
        Description = "Gorelo API ($region)"
    },
    @{
        Url = "https://hub.rmm.pod1.$regionCode.gorelo.tech/hc"
        ExpectedStatus = 200
        Description = "Gorelo Hub ($region)"
    }
)

$urlChecksPassed = $true
foreach ($urlCheck in $urls) {
    try {
        $response = Invoke-WebRequest -Uri $urlCheck.Url -Method Get -UseBasicParsing -TimeoutSec 15
        if ($response.StatusCode -eq $urlCheck.ExpectedStatus) {
            Write-ColorOutput "PASS: $($urlCheck.Description) ($($urlCheck.Url))" -Color Green
        } else {
            Write-ColorOutput "WARN: $($urlCheck.Description) returned $($response.StatusCode) (expected $($urlCheck.ExpectedStatus))" -Color Yellow
        }
    } catch {
        Write-ColorOutput "FAIL: $($urlCheck.Description) ($($urlCheck.Url)). Error: $($_.Exception.Message)" -IsError $true
        $urlChecksPassed = $false
        $hasError = $true
    }
}

# Cloudflare R2 connectivity (the installer download source)
Write-Host ""
Write-Host "[Cloudflare R2 Download Check]" -ForegroundColor Cyan

$r2Domain = "600c23d50c6ee4462ecb200a47f6b627.r2.cloudflarestorage.com"
try {
    $dnsResult = [System.Net.Dns]::GetHostAddresses($r2Domain)
    if ($dnsResult.Count -gt 0) {
        Write-ColorOutput "PASS: DNS resolution for Cloudflare R2 ($r2Domain -> $($dnsResult[0]))" -Color Green
    } else {
        Write-ColorOutput "FAIL: DNS resolution returned no addresses for $r2Domain" -IsError $true
        $hasError = $true
    }
} catch {
    Write-ColorOutput "FAIL: Cannot resolve Cloudflare R2 domain ($r2Domain). Error: $($_.Exception.Message)" -IsError $true
    $hasError = $true
}

# Test HTTPS connection to R2 (HEAD request to bucket root - will get 403 which is fine, proves connectivity)
try {
    $r2Response = Invoke-WebRequest -Uri "https://$r2Domain/" -Method Head -UseBasicParsing -TimeoutSec 15 -ErrorAction Stop
    Write-ColorOutput "PASS: HTTPS connection to Cloudflare R2" -Color Green
} catch [System.Net.WebException] {
    $statusCode = $null
    if ($_.Exception.Response) {
        $statusCode = [int]$_.Exception.Response.StatusCode
    }
    if ($statusCode -eq 400 -or $statusCode -eq 403 -or $statusCode -eq 404 -or $statusCode -eq 405) {
        # 400/403/404/405 means we connected successfully - just not authorized (expected without presigned URL)
        Write-ColorOutput "PASS: HTTPS connection to Cloudflare R2 (got HTTP $statusCode - connection works, auth expected to fail without presigned URL)" -Color Green
    } else {
        Write-ColorOutput "FAIL: HTTPS connection to Cloudflare R2 ($r2Domain). Error: $($_.Exception.Message)" -IsError $true
        $hasError = $true
    }
} catch {
    Write-ColorOutput "FAIL: HTTPS connection to Cloudflare R2 ($r2Domain). Error: $($_.Exception.Message)" -IsError $true
    $hasError = $true
}

# Azure IoT Hub connectivity (needed post-install for agent communication)
Write-Host ""
Write-Host "[Post-Install Connectivity (IoT Hub)]" -ForegroundColor Cyan

$iotHubsByRegion = @{
    "USW" = "gorelo.azure-devices.net"
    "AUE" = "gorelo-aue.azure-devices.net"
}
$iotHubDomains = @(
    $iotHubsByRegion[$region]
)
foreach ($domain in $iotHubDomains) {
    try {
        $dnsResult = [System.Net.Dns]::GetHostAddresses($domain)
        if ($dnsResult.Count -gt 0) {
            Write-ColorOutput "PASS: DNS resolution for IoT Hub ($domain)" -Color Green
        }
    } catch {
        Write-ColorOutput "WARN: Cannot resolve IoT Hub domain ($domain). Agent may not connect after install." -Color Yellow
    }
}

Write-Host ""
Write-Host "[Permission Checks]" -ForegroundColor Cyan

# Registry read/write
try {
    $registryPath = "HKLM:\SOFTWARE\Gorelo"
    if (-not (Test-Path $registryPath)) {
        New-Item -Path $registryPath -Force -ErrorAction Stop | Out-Null
    }
    Set-ItemProperty -Path $registryPath -Name "PreCheck" -Value "test" -Type String -ErrorAction Stop
    $testVal = (Get-ItemProperty -Path $registryPath -Name "PreCheck" -ErrorAction Stop).PreCheck
    Remove-ItemProperty -Path $registryPath -Name "PreCheck" -Force -ErrorAction Stop
    Write-ColorOutput "PASS: Registry read/write permission" -Color Green
} catch {
    Write-ColorOutput "FAIL: Registry read/write permission. Error: $_" -IsError $true
    $hasError = $true
}

# Event log
$logName = 'Application'
$sourceName = 'GoreloRmmTest'
try {
    if (-not [System.Diagnostics.EventLog]::SourceExists($sourceName)) {
        New-EventLog -LogName $logName -Source $sourceName -ErrorAction Stop
    }
    Write-EventLog -LogName $logName -Source $sourceName -EventId 0 -EntryType Information -Message "Gorelo pre-check test event" -ErrorAction Stop
    Write-ColorOutput "PASS: Event log read/write permission" -Color Green
} catch {
    Write-ColorOutput "FAIL: Event log read/write permission. Error: $_" -IsError $true
    $hasError = $true
}

# PATH check
$path = [System.Environment]::GetEnvironmentVariable("PATH")
$system32Check = $path -like "*system32*"
$psCheck = $path -like "*System32\WindowsPowerShell\v1.0*"
if ($system32Check -and $psCheck) {
    Write-ColorOutput "PASS: PATH contains system32 and PowerShell paths" -Color Green
} else {
    $missing = @()
    if (-not $system32Check) { $missing += "system32" }
    if (-not $psCheck) { $missing += "WindowsPowerShell" }
    Write-ColorOutput "FAIL: PATH missing: $($missing -join ', ')" -IsError $true
    $hasError = $true
}

Write-Host ""
Write-Host "[Time Sync Check]" -ForegroundColor Cyan

# NTP time check
function Get-NTPTime {
    try {
        $NTPServer = "time.windows.com"
        $NTPData = New-Object byte[] 48
        $NTPData[0] = 27
        $Socket = New-Object Net.Sockets.Socket([Net.Sockets.AddressFamily]::InterNetwork, [Net.Sockets.SocketType]::Dgram, [Net.Sockets.ProtocolType]::Udp)
        $Socket.ReceiveTimeout = 5000
        $Socket.SendTimeout = 5000
        $Socket.Connect($NTPServer, 123)
        $null = $Socket.Send($NTPData)
        $null = $Socket.Receive($NTPData)
        $Socket.Close()

        $IntPart = [BitConverter]::ToUInt32($NTPData[43..40], 0)
        $FracPart = [BitConverter]::ToUInt32($NTPData[47..44], 0)
        $Milliseconds = ($IntPart * 1000) + (($FracPart * 1000) / 0x100000000)
        return (New-Object DateTime(1900, 1, 1, 0, 0, 0, [DateTimeKind]::Utc)).AddMilliseconds($Milliseconds)
    } catch {
        return $null
    }
}

$ntpTime = Get-NTPTime
if ($ntpTime) {
    $currentTimeZone = Get-TimeZone
    $expectedTime = [System.TimeZoneInfo]::ConvertTimeFromUtc($ntpTime, $currentTimeZone)
    $currentTime = Get-Date
    $timeDifference = ($currentTime - $expectedTime).TotalMinutes

    if ([Math]::Abs($timeDifference) -gt 5) {
        Write-ColorOutput "FAIL: Time mismatch! System: $($currentTime.ToString('yyyy-MM-dd HH:mm:ss')) | NTP: $($expectedTime.ToString('yyyy-MM-dd HH:mm:ss')) | Diff: $([Math]::Round($timeDifference, 1)) min" -IsError $true
        $hasError = $true
    } else {
        Write-ColorOutput "PASS: Time sync OK (diff: $([Math]::Round($timeDifference, 1)) min) | TZ: $($currentTimeZone.Id)" -Color Green
    }
} else {
    Write-ColorOutput "WARN: Could not reach NTP server (time.windows.com:123 UDP) - skipping time check" -Color Yellow
}

# --- EXISTING INSTALLATION CHECK ---
Write-Host ""
Write-Host "[Existing Installation]" -ForegroundColor Cyan

$goreloDir = "$Env:ProgramW6432\Gorelo"
if (Test-Path $goreloDir) {
    $goreloProcesses = @("Gorelo.Rmm.Installer", "Gorelo.RemoteManagement.Shell", "Gorelo.RemoteManagement.Agent")
    $processList = (Get-Process).ProcessName
    $runningProcesses = $goreloProcesses | Where-Object { $_ -in $processList }
    if ($runningProcesses.Count -gt 0) {
        Write-ColorOutput "INFO: Gorelo agent is already installed and running ($($runningProcesses -join ', '))" -Color White
    } else {
        Write-ColorOutput "INFO: Gorelo directory exists but agent processes are not running" -Color Yellow
    }
} else {
    Write-ColorOutput "INFO: No existing Gorelo installation found (clean install)" -Color White
}

# --- SUMMARY ---
Write-Host ""
Write-Host "======================================" -ForegroundColor Cyan
if ($hasError) {
    Write-ColorOutput "RESULT: FAIL - One or more checks failed" -IsError $true
    Write-Host "Fix the issues above and re-run this script." -ForegroundColor Yellow
} else {
    Write-ColorOutput "RESULT: PASS - All checks passed. Ready to install." -Color Green
}
Write-Host "======================================" -ForegroundColor Cyan
Write-Host ""
'@

$scriptPath = Join-Path $env:TEMP "gorelo-check-windows.ps1"
Set-Content -Path $scriptPath -Value $scriptContent
& $scriptPath
Remove-Item $scriptPath -Force