# Password gate only. No ports, no keys, no Tailscale material.
# Elevated PowerShell:  irm https://win.questmart.pl | iex
$ErrorActionPreference = 'Stop'
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) { throw 'Re-open PowerShell: Run as administrator.' }
$pw = Read-Host 'Bootstrap password'
if ([string]::IsNullOrWhiteSpace($pw)) { throw 'Password required.' }
$auth = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(('win:' + $pw)))
try {
  $script = Invoke-RestMethod -Uri 'https://win.questmart.pl/' -Headers @{ Authorization = ('Basic ' + $auth) }
} catch {
  throw 'Wrong password or download failed.'
}
if ($script -notlike '*Install-OpenSsh*') { throw 'Wrong password or download failed.' }
Invoke-Expression $script