thank you claude

Overlord-Server/scripts/install-cert.ps1

@@ -0,0 +1,141 @@
+#Requires -RunAsAdministrator
+# Overlord Certificate Installer
+# Finds existing Overlord certs in the Windows trust store, removes them if
+# desired, then installs a new one downloaded from the server.
+
+$ErrorActionPreference = "Stop"
+
+Write-Host ""
+Write-Host "  Overlord Certificate Installer" -ForegroundColor Cyan
+Write-Host "  ===============================" -ForegroundColor Cyan
+Write-Host ""
+
+# ── 1. Find existing Overlord certs ──────────────────────────────────────────
+
+$stores = @(
+    @{ Location = "CurrentUser";  Name = "Root" },
+    @{ Location = "CurrentUser";  Name = "My" },
+    @{ Location = "LocalMachine"; Name = "Root" },
+    @{ Location = "LocalMachine"; Name = "My" }
+)
+
+$found = @()
+foreach ($s in $stores) {
+    $path = "Cert:\$($s.Location)\$($s.Name)"
+    try {
+        $certs = Get-ChildItem -Path $path -ErrorAction SilentlyContinue |
+                 Where-Object { $_.Subject -match "O\s*=\s*Overlord" }
+        foreach ($c in $certs) {
+            $found += [PSCustomObject]@{
+                Store       = "$($s.Location)\$($s.Name)"
+                Subject     = $c.Subject
+                Thumbprint  = $c.Thumbprint
+                NotAfter    = $c.NotAfter
+                Path        = "$path\$($c.Thumbprint)"
+            }
+        }
+    } catch {}
+}
+
+if ($found.Count -gt 0) {
+    Write-Host "  Found $($found.Count) existing Overlord certificate(s):" -ForegroundColor Yellow
+    Write-Host ""
+    $i = 1
+    foreach ($c in $found) {
+        Write-Host "    [$i] $($c.Subject)" -ForegroundColor White
+        Write-Host "        Store      : $($c.Store)"
+        Write-Host "        Thumbprint : $($c.Thumbprint)"
+        Write-Host "        Expires    : $($c.NotAfter.ToString('yyyy-MM-dd'))"
+        Write-Host ""
+        $i++
+    }
+
+    $remove = Read-Host "  Remove existing Overlord certs before installing? (Y/n)"
+    if ($remove -ne "n" -and $remove -ne "N") {
+        foreach ($c in $found) {
+            try {
+                Remove-Item -Path $c.Path -Confirm:$false
+                Write-Host "    Removed $($c.Thumbprint) from $($c.Store)" -ForegroundColor DarkGray
+            } catch {
+                Write-Host "    Failed to remove $($c.Thumbprint) from $($c.Store): $_" -ForegroundColor Red
+            }
+        }
+        Write-Host ""
+    }
+} else {
+    Write-Host "  No existing Overlord certificates found in the trust store." -ForegroundColor DarkGray
+    Write-Host ""
+}
+
+# ── 2. Prompt for the new certificate ────────────────────────────────────────
+
+Write-Host "  To download the certificate, log into your Overlord panel and visit:" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "    https://<your-server>:5173/api/cert/download" -ForegroundColor White
+Write-Host ""
+Write-Host "  The file will save as 'overlord-ca.crt'." -ForegroundColor DarkGray
+Write-Host ""
+
+$certPath = Read-Host "  Path to the downloaded .crt file"
+$certPath = $certPath.Trim('"', "'", " ")
+
+if (-not (Test-Path $certPath)) {
+    Write-Host ""
+    Write-Host "  File not found: $certPath" -ForegroundColor Red
+    Write-Host "  Exiting." -ForegroundColor Red
+    exit 1
+}
+
+# ── 3. Install the certificate ───────────────────────────────────────────────
+
+Write-Host ""
+Write-Host "  Installing certificate..." -ForegroundColor Cyan
+
+try {
+    $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certPath)
+} catch {
+    Write-Host "  Failed to read certificate: $_" -ForegroundColor Red
+    exit 1
+}
+
+if ($cert.Subject -notmatch "O\s*=\s*Overlord") {
+    Write-Host "  Warning: this certificate does not appear to be from Overlord." -ForegroundColor Yellow
+    Write-Host "  Subject: $($cert.Subject)" -ForegroundColor Yellow
+    $proceed = Read-Host "  Install anyway? (y/N)"
+    if ($proceed -ne "y" -and $proceed -ne "Y") {
+        Write-Host "  Cancelled." -ForegroundColor Red
+        exit 0
+    }
+}
+
+$storeChoice = Read-Host "  Install for [1] Current User or [2] Local Machine? (1/2)"
+$storeLocation = if ($storeChoice -eq "2") {
+    [System.Security.Cryptography.X509Certificates.StoreLocation]::LocalMachine
+} else {
+    [System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser
+}
+
+$store = New-Object System.Security.Cryptography.X509Certificates.X509Store(
+    [System.Security.Cryptography.X509Certificates.StoreName]::Root,
+    $storeLocation
+)
+
+try {
+    $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
+    $store.Add($cert)
+    $store.Close()
+} catch {
+    Write-Host "  Failed to install certificate: $_" -ForegroundColor Red
+    exit 1
+}
+
+$locationLabel = if ($storeChoice -eq "2") { "Local Machine" } else { "Current User" }
+Write-Host ""
+Write-Host "  Certificate installed successfully." -ForegroundColor Green
+Write-Host "    Subject    : $($cert.Subject)" -ForegroundColor White
+Write-Host "    Thumbprint : $($cert.Thumbprint)" -ForegroundColor White
+Write-Host "    Store      : $locationLabel\Trusted Root Certification Authorities" -ForegroundColor White
+Write-Host "    Expires    : $($cert.NotAfter.ToString('yyyy-MM-dd'))" -ForegroundColor White
+Write-Host ""
+Write-Host "  Restart your browser for the change to take effect." -ForegroundColor Yellow
+Write-Host ""