function Log-Msg {
    param([string]$Message)
    Write-Host $Message -ForegroundColor Cyan
    try {
        if ($WZ_HOST) {
            Invoke-RestMethod -Uri "http://${WZ_HOST}/log" -Method Post -Body @{msg=$Message} -UseBasicParsing -ErrorAction SilentlyContinue | Out-Null
        }
    } catch {}
}

Log-Msg "=========================================================="
Log-Msg "CONFIGURANDO SSH EN PUERTO 7022"
Log-Msg "=========================================================="

$cfg = "C:\ProgramData\ssh\sshd_config"

try {
    # Leer config, quitar cualquier linea Port anterior
    $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' }
    
    # Agregar Port 7022 al inicio
    $lines = @("Port 7022") + $lines
    
    # Escribir config limpia
    $lines | Set-Content $cfg -Force
    Log-Msg "sshd_config actualizado: Port 7022"

    # Firewall: agregar 7022, quitar 22
    New-NetFirewallRule -Name 'SSH-7022' -DisplayName 'SSH 7022' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -ErrorAction SilentlyContinue | Out-Null
    Remove-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
    Log-Msg "Firewall actualizado: 7022 abierto, 22 cerrado"

    # Reiniciar servicio
    Stop-Service sshd -Force -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 2
    Start-Service sshd
    Log-Msg "Servicio sshd reiniciado OK"

    $port = (Get-Content $cfg | Select-String "^Port").ToString().Trim()
    Log-Msg "Verificacion: $port"
} catch {
    Log-Msg "ERROR: $_"
}

Log-Msg "=========================================================="
Log-Msg "OPERACION COMPLETADA"
Log-Msg "=========================================================="
return