# Install Windows collections
ansible-galaxy collection install ansible.windows community.windows

# Install pywinrm on the controller
pip install pywinrm

# Inventory for Windows hosts
all:
  hosts:
    win01:
      ansible_host: 192.168.1.100
      ansible_user: Administrator
      ansible_password: "{{ vault_win_password }}"
      ansible_connection: winrm
      ansible_winrm_transport: ntlm
      ansible_winrm_server_cert_validation: ignore
      ansible_port: 5986

---
- name: AD DS Setup
  hosts: windows
  tasks:
    - name: Gather Windows facts
      ansible.windows.setup:

    - name: Display Windows version
      ansible.builtin.debug:
        msg: "{{ ansible_os_name }} {{ ansible_os_version }}"

    - name: Ensure required Windows features
      ansible.windows.win_feature:
        name: "{{ item }}"
        state: present
      loop:
        - Web-Server
        - Web-Mgmt-Tools

    - name: Configure Windows settings
      ansible.windows.win_regedit:
        path: HKLM:\SOFTWARE\MyApp
        name: Setting1
        data: enabled
        type: string

    - name: Manage Windows services
      ansible.windows.win_service:
        name: W3SVC
        start_mode: auto
        state: started

    - name: Copy configuration files
      ansible.windows.win_copy:
        src: files/config.xml
        dest: C:\App\config.xml

    - name: Install software via Chocolatey
      chocolatey.chocolatey.win_chocolatey:
        name:
          - git
          - vscode
          - python3
          - 7zip
        state: present

    - name: Install MSI package
      ansible.windows.win_package:
        path: C:\Temp\installer.msi
        state: present
        arguments: /quiet /norestart

    - name: Install from URL
      ansible.windows.win_package:
        path: https://example.com/setup.exe
        product_id: '{product-guid}'
        arguments: /S

    - name: Install Windows updates
      ansible.windows.win_updates:
        category_names:
          - SecurityUpdates
          - CriticalUpdates
        reboot: true
        reboot_timeout: 3600
      register: update_result

    - name: Show update results
      ansible.builtin.debug:
        msg: "Installed {{ update_result.installed_update_count }} updates"

    - name: Run PowerShell script
      ansible.windows.win_powershell:
        script: |
          Get-Service | Where-Object {Status -eq 'Running'} |
            Select-Object -Property Name, DisplayName |
            ConvertTo-Json
      register: services

    - name: Execute remote PowerShell script
      ansible.windows.win_powershell:
        script: "{ lookup('file', 'scripts/setup.ps1') }"
        parameters:
          Environment: production
          Verbose: true

    - name: Create scheduled task
      community.windows.win_scheduled_task:
        name: DailyMaintenance
        description: Daily maintenance scripts
        actions:
          - path: powershell.exe
            arguments: -File C:\Scripts\maintenance.ps1
        triggers:
          - type: daily
            start_boundary: '2026-01-01T03:00:00'
        username: SYSTEM
        run_level: highest
        state: present

    - name: Configure Windows Firewall
      community.windows.win_firewall_rule:
        name: "{{ item.name }}"
        localport: "{{ item.port }}"
        action: allow
        direction: in
        protocol: tcp
        state: present
        enabled: true
      loop:
        - { name: 'Allow HTTP', port: 80 }
        - { name: 'Allow HTTPS', port: 443 }
        - { name: 'Allow RDP', port: 3389 }