## 1. REQUIREMENTS ##### Here are the requirements necessary to ensure this is successful.### a. Internal/Private Cloud Repository Set Up ####### You'll need an internal/private cloud repository you can use. These are####  generally really quick to set up and there are quite a few options.####  Chocolatey Software recommends Nexus, Artifactory Pro, or ProGet as they####  are repository servers and will give you the ability to manage multiple####  repositories and types from one server installation.### b. Download Chocolatey Package and Put on Internal Repository ####### You need to have downloaded the Chocolatey package as well.####  Please see https://chocolatey.org/install#organization### c. Other Requirements ####### We initialize a few things that are needed by this script - there are no other requirements.$ErrorActionPreference = "Stop"#### Set TLS 1.2 (3072) as that is the minimum required by various up-to-date repositories.#### Use integers because the enumeration value for TLS 1.2 won't exist#### in .NET 4.0, even though they are addressable if .NET 4.5+ is#### installed (.NET 4.5 is an in-place upgrade).[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072#### We use this variable for future REST calls.$RequestArguments = @{    UseBasicParsing = $true}## 2. TOP LEVEL VARIABLES ##### a. Your internal repository url (the main one). #######  Should be similar to what you see when you browse#### to https://community.chocolatey.org/api/v2/$NugetRepositoryUrl = "INTERNAL REPO URL"### b. Internal Repository Credential ####### If required, add the repository access credential here# $NugetRepositoryCredential = [PSCredential]::new(#     "username",#     ("password" | ConvertTo-SecureString -AsPlainText -Force)# )# $RequestArguments.Credential = $NugetRepositoryCredential### c. Chocolatey nupkg download url ####### This url should result in an immediate download when you navigate to it$ChocolateyDownloadUrl = "$($NugetRepositoryUrl.TrimEnd('/'))/package/chocolatey.2.4.3.nupkg"### d. Chocolatey Central Management (CCM) ####### If using CCM to manage Chocolatey, add the following:#### i. Endpoint URL for CCM# $ChocolateyCentralManagementUrl = "https://chocolatey-central-management:24020/ChocolateyManagementService"#### ii. If using a Client Salt, add it here# $ChocolateyCentralManagementClientSalt = "clientsalt"#### iii. If using a Service Salt, add it here# $ChocolateyCentralManagementServiceSalt = "servicesalt"## 3. ENSURE CHOCOLATEY IS INSTALLED ##### Ensure Chocolatey is installed from your internal repository#### Download the Nupkg, appending .zip to the filename to handle archive cmdlet limitationsif (-not (Get-Command choco.exe -ErrorAction SilentlyContinue)) {    $TempDirectory = Join-Path $env:Temp "chocolateyInstall"    if (-not (Test-Path $TempDirectory -PathType Container)) {        $null = New-Item -Path $TempDirectory -ItemType Directory    }    $DownloadedNupkg = Join-Path $TempDirectory "$(Split-Path $ChocolateyDownloadUrl -Leaf).zip"    Invoke-WebRequest -Uri $ChocolateyDownloadUrl -OutFile $DownloadedNupkg @RequestArguments    #### Extract the Nupkg, and run the chocolateyInstall script    if (Get-Command Microsoft.PowerShell.Archive\Expand-Archive -ErrorAction SilentlyContinue) {        Microsoft.PowerShell.Archive\Expand-Archive -Path $DownloadedNupkg -DestinationPath $TempDirectory -Force    } else {        # PowerShell versions<4.0 do not have this function available        try {            $shellApplication = New-Object -ComObject Shell.Application            $zipPackage = $shellApplication.NameSpace($DownloadedNupkg)            $destinationFolder = $shellApplication.NameSpace($TempDirectory)            $destinationFolder.CopyHere($zipPackage.Items(), 0x10)        } catch {            Write-Warning "Unable to unzip package using built-in compression."            throw $_        }    }    & $(Join-Path $TempDirectory "tools\chocolateyInstall.ps1")}if (-not (Get-Command choco.exe -ErrorAction SilentlyContinue)) {    refreshenv}## 4. CONFIGURE CHOCOLATEY BASELINE ##### a. FIPS Feature ####### If you need FIPS compliance - make this the first thing you configure#### before you do any additional configuration or package installations# choco feature enable -n useFipsCompliantChecksums### b. Apply Recommended Configuration ####### Move cache location so Chocolatey is very deterministic about#### cleaning up temporary data and the location is secured to adminschoco config set --name cacheLocation --value C:\ProgramData\chocolatey\cache#### Increase timeout to at least 4 hourschoco config set --name commandExecutionTimeoutSeconds --value 14400#### Turn off download progress when running choco through integrationschoco feature disable --name showDownloadProgress### c. Sources ####### Remove the default community package repository sourcechoco source list --limitoutput | ConvertFrom-Csv -Header 'Name', 'Location' -Delimiter '|' | ForEach-Object {    if ($_.Location -eq 'https://community.chocolatey.org/api/v2/') {        choco source remove -n $_.Name    }}#### Add internal default sources#### You could have multiple sources here, so we will provide an example#### of one using the remote repo variable here#### NOTE: This EXAMPLE may require changesif ($NugetRepositoryCredential) {    choco source add --name ChocolateyInternal --source $NugetRepositoryUrl --user $NugetRepositoryCredential.UserName --password $NugetRepositoryCredential.GetNetworkCredential().Password --priority 1} else {    choco source add --name ChocolateyInternal --source $NugetRepositoryUrl --priority 1}### b. Keep Chocolatey Up To Date ####### Keep chocolatey up to date based on your internal source#### You control the upgrades based on when you push an updated version####  to your internal repository.#### Note the source here is to the OData feed, similar to what you see####  when you browse to https://community.chocolatey.org/api/v2/choco upgrade chocolatey --confirm## 5. ENSURE CHOCOLATEY FOR BUSINESS ##### If you don't have Chocolatey for Business (C4B), you'll want to remove from here down.### a. Ensure The License File Is Installed ####### Create a license package using script from https://docs.chocolatey.org/en-us/how-tos/setup-offline-installation#exercise-4-create-a-package-for-the-licensechoco install chocolatey-license --source $NugetRepositoryUrl --confirm### b. Disable The Licensed Source ####### The licensed source cannot be removed, so it must be disabled.#### This must occur after the license has been set by the license package.if ("chocolatey-license" -in (choco list --localonly --limitoutput | ConvertFrom-Csv -Header "Name" -Delimiter "|").Name) {    choco source disable --name chocolatey.licensed} else {    Write-Warning "Not disabling 'chocolatey.licensed' feed, as Chocolatey-License has not been installed."}### c. Ensure Chocolatey Licensed Extension ####### You will have downloaded the licensed extension to your internal repository#### as you have disabled the licensed repository in step 5b.#### Ensure the chocolatey.extension package (aka Chocolatey Licensed Extension)if ("chocolatey-license" -in (choco list --localonly --limitoutput | ConvertFrom-Csv -Header "Name" -Delimiter "|").Name) {    choco install chocolatey.extension --source $NugetRepositoryUrl --confirm} else {    Write-Warning "Not installing 'chocolatey.extension', as Chocolatey-License has not been installed."}#### The Chocolatey Licensed Extension unlocks all of the following, which also have configuration/feature items available with them. You may want to visit the feature pages to see what you might want to also enable:#### - Package Builder - https://docs.chocolatey.org/en-us/features/paid/package-builder#### - Package Internalizer - https://docs.chocolatey.org/en-us/features/paid/package-internalizer#### - Package Synchronization (3 components) - https://docs.chocolatey.org/en-us/features/paid/package-synchronization#### - Package Reducer - https://docs.chocolatey.org/en-us/features/paid/package-reducer#### - Package Audit - https://docs.chocolatey.org/en-us/features/paid/package-audit#### - Package Throttle - https://docs.chocolatey.org/en-us/features/paid/package-throttle#### - CDN Cache Access - https://docs.chocolatey.org/en-us/features/paid/private-cdn#### - Branding - https://docs.chocolatey.org/en-us/features/paid/branding#### - Self-Service Anywhere (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/self-service-anywhere#### - Chocolatey Central Management (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/chocolatey-central-management#### - Other - https://docs.chocolatey.org/en-us/features/paid/### d. Ensure Self-Service Anywhere ####### If you have desktop clients where users are not administrators, you may#### to take advantage of deploying and configuring Self-Service anywherechoco feature disable --name showNonElevatedWarningschoco feature enable --name useBackgroundServicechoco feature enable --name useBackgroundServiceWithNonAdministratorsOnlychoco feature enable --name allowBackgroundServiceUninstallsFromUserInstallsOnlychoco config set --name allowedBackgroundServiceCommands --value "install,upgrade,uninstall"### e. Ensure Chocolatey Central Management ####### If you want to manage and report on endpoints, you can set up and configure### Central Management. There are multiple portions to manage, so you'll see### a section on agents here along with notes on how to configure the server### side components.if ($ChocolateyCentralManagementUrl) {    choco install chocolatey-agent --source $NugetRepositoryUrl --confirm    choco config set --name CentralManagementServiceUrl --value $ChocolateyCentralManagementUrl    if ($ChocolateyCentralManagementClientSalt) {        choco config set --name centralManagementClientCommunicationSaltAdditivePassword --value $ChocolateyCentralManagementClientSalt    }    if ($ChocolateyCentralManagementServiceSalt) {        choco config set --name centralManagementServiceCommunicationSaltAdditivePassword --value $ChocolateyCentralManagementServiceSalt    }    choco feature enable --name useChocolateyCentralManagement    choco feature enable --name useChocolateyCentralManagementDeployments}

## 1. REQUIREMENTS ##### Here are the requirements necessary to ensure this is successful.### a. Internal/Private Cloud Repository Set Up ####### You'll need an internal/private cloud repository you can use. These are####  generally really quick to set up and there are quite a few options.####  Chocolatey Software recommends Nexus, Artifactory Pro, or ProGet as they####  are repository servers and will give you the ability to manage multiple####  repositories and types from one server installation.### b. Download Chocolatey Package and Put on Internal Repository ####### You need to have downloaded the Chocolatey package as well.####  Please see https://chocolatey.org/install#organization### c. Other Requirements ####### i. chocolatey.chocolatey##### You will require the chocolatey.chocolatey collection to be installed##### on all machines using this playbook.##### Please see https://github.com/chocolatey/chocolatey-ansible/#installing-the-collection-from-ansible-galaxy- name: Install and Configure Chocolatey  hosts: all## 2. TOP LEVEL VARIABLES ##  vars:### a. Your internal repository url (the main one). #######  Should be similar to what you see when you browse#### to https://community.chocolatey.org/api/v2/    nuget_repository_url: INTERNAL REPO URL### b. Internal Repository Credential ####### If required, add the repository access credential here and#### uncomment lines with source_username and source_password below#    nuget_repository_username: username#    nuget_repository_password: password### c. Chocolatey Central Management (CCM) ####### If using CCM to manage Chocolatey, add the following:#### i. Endpoint URL for CCM#    chocolatey_central_management_url: https://chocolatey-central-management:24020/ChocolateyManagementService#### ii. If using a Client Salt, add it here#    chocolatey_central_management_client_salt: clientsalt#### iii. If using a Service Salt, add it here#    chocolatey_central_management_service_salt: servicesalt## 3. ENSURE CHOCOLATEY IS INSTALLED ##### Ensure Chocolatey is installed from your internal repository  tasks:  - name: Install chocolatey    win_chocolatey:      name: chocolatey      source: ""{{ nuget_repository_url }}""      # source_username: ""{{ nuget_repository_username }}""      # source_password: ""{{ nuget_repository_password }}""## 4. CONFIGURE CHOCOLATEY BASELINE ##### a. FIPS Feature ####### If you need FIPS compliance - make this the first thing you configure#### before you do any additional configuration or package installations#   - name: Enable FIPS compliance#     win_chocolatey_feature:#       name: useFipsCompliantChecksums#       state: enabled### b. Apply Recommended Configuration ####### Move cache location so Chocolatey is very deterministic about#### cleaning up temporary data and the location is secured to admins  - name: Set the cache location    win_chocolatey_config:      name: cacheLocation      state: present      value: C:\ProgramData\chocolatey\cache#### Increase timeout to at least 4 hours  - name: Set the command execution timeout    win_chocolatey_config:      name: commandExecutionTimeoutSeconds      state: present      value: 14400#### Turn off download progress when running choco through integrations  - name: Disable showing download progress    win_chocolatey_feature:      name: showDownloadProgress      state: disabled### c. Sources ####### Remove the default community package repository source  - name: Remove Chocolatey Community Repository    win_chocolatey_source:      name: chocolatey      state: absent#### Add internal default sources#### You could have multiple sources here, so we will provide an example#### of one using the remote repo variable here#### NOTE: This EXAMPLE may require changes  - name: Add Internal Repository    win_chocolatey_source:      name: ChocolateyInternal      state: present      source: {{ nuget_repository_url }}      # source_username: {{ nuget_repository_username }}      # source_password: {{ nuget_repository_password }}      priority: 1### b. Keep Chocolatey Up To Date ####### Keep chocolatey up to date based on your internal source#### You control the upgrades based on when you push an updated version####  to your internal repository.#### Note the source here is to the OData feed, similar to what you see####  when you browse to https://community.chocolatey.org/api/v2/  - name: Upgrade Chocolatey    win_chocolatey:      name: chocolatey      state: latest## 5. ENSURE CHOCOLATEY FOR BUSINESS ##### If you don't have Chocolatey for Business (C4B), you'll want to remove from here down.### a. Ensure The License File Is Installed ####### Create a license package using script from https://docs.chocolatey.org/en-us/how-tos/setup-offline-installation#exercise-4-create-a-package-for-the-license  - name: Install Chocolatey License    win_chocolatey:      name: chocolatey-license      source: ChocolateyInternal      state: latest### b. Disable The Licensed Source ####### The licensed source cannot be removed, so it must be disabled.#### This must occur after the license has been set by the license package.  - name: Disable Chocolatey Community Repository    win_chocolatey_source:      name: chocolatey.licensed      state: disabled### c. Ensure Chocolatey Licensed Extension ####### You will have downloaded the licensed extension to your internal repository#### as you have disabled the licensed repository in step 5b.#### Ensure the chocolatey.extension package (aka Chocolatey Licensed Extension)  - name: Install Chocolatey Extension    win_chocolatey:      name: chocolatey.extension      source: ChocolateyInternal      state: latest#### The Chocolatey Licensed Extension unlocks all of the following, which also have configuration/feature items available with them. You may want to visit the feature pages to see what you might want to also enable:#### - Package Builder - https://docs.chocolatey.org/en-us/features/paid/package-builder#### - Package Internalizer - https://docs.chocolatey.org/en-us/features/paid/package-internalizer#### - Package Synchronization (3 components) - https://docs.chocolatey.org/en-us/features/paid/package-synchronization#### - Package Reducer - https://docs.chocolatey.org/en-us/features/paid/package-reducer#### - Package Audit - https://docs.chocolatey.org/en-us/features/paid/package-audit#### - Package Throttle - https://docs.chocolatey.org/en-us/features/paid/package-throttle#### - CDN Cache Access - https://docs.chocolatey.org/en-us/features/paid/private-cdn#### - Branding - https://docs.chocolatey.org/en-us/features/paid/branding#### - Self-Service Anywhere (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/self-service-anywhere#### - Chocolatey Central Management (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/chocolatey-central-management#### - Other - https://docs.chocolatey.org/en-us/features/paid/### d. Ensure Self-Service Anywhere ####### If you have desktop clients where users are not administrators, you may#### to take advantage of deploying and configuring Self-Service anywhere  - name: Hide not-elevated warnings    win_chocolatey_feature:      name: showNonElevatedWarnings      state: disabled  - name: Use background mode for self-service    win_chocolatey_feature:      name: useBackgroundService      state: enabled  - name: Use background service for non-admins    win_chocolatey_feature:      name: useBackgroundServiceWithNonAdministratorsOnly      state: enabled  - name: Allow background uninstallation for user installs    win_chocolatey_feature:      name: allowBackgroundServiceUninstallsFromUserInstallsOnly      state: enabled  - name: Set allowed background service commands    win_chocolatey_config:      name: backgroundServiceAllowedCommands      state: present      value: install,upgrade,uninstall### e. Ensure Chocolatey Central Management ####### If you want to manage and report on endpoints, you can set up and configure### Central Management. There are multiple portions to manage, so you'll see### a section on agents here along with notes on how to configure the server### side components.  - name: Install Chocolatey Agent    when: chocolatey_central_management_url is defined    win_chocolatey:      name: chocolatey-agent      source: ChocolateyInternal      state: latest  - name: Set the Central Management Service URL    when: chocolatey_central_management_url is defined    win_chocolatey_config:      name: CentralManagementServiceUrl      state: present      value: {{ chocolatey_central_management_url }}  - name: Set the Central Management Client Salt    when: chocolatey_central_management_client_salt is defined    win_chocolatey_config:      name: centralManagementClientCommunicationSaltAdditivePassword      state: present      value: {{ chocolatey_central_management_client_salt }}  - name: Set the Central Management Service Salt    when: chocolatey_central_management_service_salt is defined    win_chocolatey_config:      name: centralManagementServiceCommunicationSaltAdditivePassword      state: present      value: {{ chocolatey_central_management_service_salt }}  - name: Use Central Management    when: chocolatey_central_management_url is defined    win_chocolatey_feature:      name: useChocolateyCentralManagement      state: enabled  - name: Use Central Management Deployments    when: chocolatey_central_management_url is defined    win_chocolatey_feature:      name: useChocolateyCentralManagementDeployments      state: enabled

## 1. REQUIREMENTS ##### Here are the requirements necessary to ensure this is successful.### a. Internal/Private Cloud Repository Set Up ####### You'll need an internal/private cloud repository you can use. These are####  generally really quick to set up and there are quite a few options.####  Chocolatey Software recommends Nexus, Artifactory Pro, or ProGet as they####  are repository servers and will give you the ability to manage multiple####  repositories and types from one server installation.### b. Download Chocolatey Package and Put on Internal Repository ####### You need to have downloaded the Chocolatey package as well.####  Please see https://chocolatey.org/install#organization### c. Other Requirements ####### The Chocolatey resources are available with any recent version of Chef.#### We utilise the Chocolatey recipe to install the Chocolatey binaries.include_recipe "chocolatey"## 2. TOP LEVEL VARIABLES ##### a. Your internal repository url (the main one). #######  Should be similar to what you see when you browse#### to https://community.chocolatey.org/api/v2/NugetRepositoryUrl = "INTERNAL REPO URL"### b. Internal Repository Credential ####### If required, add the repository access credential here# NugetRepositoryUsername = "username"# NugetRepositoryPassword = "password"### c. Chocolatey nupkg download url ####### This url should result in an immediate download when you navigate to it in#### a web browserChocolateyNupkgUrl = "INTERNAL REPO URL/package/chocolatey.2.4.3.nupkg",### d. Chocolatey Central Management (CCM) ####### If using CCM to manage Chocolatey, add the following:#### i. Endpoint URL for CCM# ChocolateyCentralManagementUrl = "https://chocolatey-central-management:24020/ChocolateyManagementService"#### ii. If using a Client Salt, add it here# ChocolateyCentralManagementClientSalt = "clientsalt"#### iii. If using a Service Salt, add it here# ChocolateyCentralManagementServiceSalt = "servicesalt"## 3. ENSURE CHOCOLATEY IS INSTALLED ##### Ensure Chocolatey is installed from your internal repositorynode['chocolatey']['install vars'] = {  'chocolateyDownloadUrl' => "#{ChocolateyNupkgUrl}",}## 4. CONFIGURE CHOCOLATEY BASELINE ##### a. FIPS Feature ####### If you need FIPS compliance - make this the first thing you configure#### before you do any additional configuration or package installations# chocolatey_feature 'useFipsCompliantChecksums' do#   action :enable# end### b. Apply Recommended Configuration ####### Move cache location so Chocolatey is very deterministic about#### cleaning up temporary data and the location is secured to adminschocolatey_config 'cacheLocation' do  value 'C:\ProgramData\chocolatey\cache'end#### Increase timeout to at least 4 hourschocolatey_config 'commandExecutionTimeoutSeconds' do  value '14400'end#### Turn off download progress when running choco through integrationschocolatey_feature 'showDownloadProgress' do  action :disableend### c. Sources ####### Remove the default community package repository sourcechocolatey_source 'chocolatey' do  action :removeend#### Add internal default sources#### You could have multiple sources here, so we will provide an example#### of one using the remote repo variable here#### NOTE: This EXAMPLE may require changeschocolatey_source 'ChocolateyInternal' do  source "#{NugetRepositoryUrl}"  priority 1  action   :addendexecute 'ChocolateyInternal' do  command "choco source add --name ChocolateyInternal -s #{NugetRepositoryUrl} -u=#{NugetRepositoryUsername} -p=#{NugetRepositoryPassword} --priority=1"  only_if { NugetRepositoryUsername != nil || NugetRepositoryPassword != nil }end### b. Keep Chocolatey Up To Date ####### Keep chocolatey up to date based on your internal source#### You control the upgrades based on when you push an updated version####  to your internal repository.#### Note the source here is to the OData feed, similar to what you see####  when you browse to https://community.chocolatey.org/api/v2/chocolatey_package 'chocolatey' do  action :upgrade  source "#{NugetRepositoryUrl}"end## 5. ENSURE CHOCOLATEY FOR BUSINESS ##### If you don't have Chocolatey for Business (C4B), you'll want to remove from here down.### a. Ensure The License File Is Installed ####### Create a license package using script from https://docs.chocolatey.org/en-us/how-tos/setup-offline-installation#exercise-4-create-a-package-for-the-licensechocolatey_package 'chocolatey-license' do  action :install  source "#{NugetRepositoryUrl}"end### b. Disable The Licensed Source ####### The licensed source cannot be removed, so it must be disabled.#### This must occur after the license has been set by the license package.chocolatey_source 'chocolatey.licensed' do  action            :disableend### c. Ensure Chocolatey Licensed Extension ####### You will have downloaded the licensed extension to your internal repository#### as you have disabled the licensed repository in step 5b.#### Ensure the chocolatey.extension package (aka Chocolatey Licensed Extension)chocolatey_package 'chocolatey.extention' do  action     install  source     "#{NugetRepositoryUrl}"end#### The Chocolatey Licensed Extension unlocks all of the following, which also have configuration/feature items available with them. You may want to visit the feature pages to see what you might want to also enable:#### - Package Builder - https://docs.chocolatey.org/en-us/features/paid/package-builder#### - Package Internalizer - https://docs.chocolatey.org/en-us/features/paid/package-internalizer#### - Package Synchronization (3 components) - https://docs.chocolatey.org/en-us/features/paid/package-synchronization#### - Package Reducer - https://docs.chocolatey.org/en-us/features/paid/package-reducer#### - Package Audit - https://docs.chocolatey.org/en-us/features/paid/package-audit#### - Package Throttle - https://docs.chocolatey.org/en-us/features/paid/package-throttle#### - CDN Cache Access - https://docs.chocolatey.org/en-us/features/paid/private-cdn#### - Branding - https://docs.chocolatey.org/en-us/features/paid/branding#### - Self-Service Anywhere (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/self-service-anywhere#### - Chocolatey Central Management (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/chocolatey-central-management#### - Other - https://docs.chocolatey.org/en-us/features/paid/### d. Ensure Self-Service Anywhere ####### If you have desktop clients where users are not administrators, you may#### to take advantage of deploying and configuring Self-Service anywherechocolatey_feature 'showNonElevatedWarnings' do  action :disableendchocolatey_feature 'useBackgroundService' do  action :enableendchocolatey_feature 'useBackgroundServiceWithNonAdministratorsOnly' do  action :enableendchocolatey_feature 'allowBackgroundServiceUninstallsFromUserInstallsOnly' do  action :enableendchocolatey_config 'backgroundServiceAllowedCommands' do  value 'install,upgrade,uninstall'end### e. Ensure Chocolatey Central Management ####### If you want to manage and report on endpoints, you can set up and configure### Central Management. There are multiple portions to manage, so you'll see### a section on agents here along with notes on how to configure the server### side components.chocolatey_package 'chocolatey-agent' do  action     install  source     "#{NugetRepositoryUrl}"  # user       "#{NugetRepositoryUsername}"  # password   "#{NugetRepositoryPassword}"  only_if { ChocolateyCentralManagementUrl != nil }endchocolatey_config 'CentralManagementServiceUrl' do  value  "#{ChocolateyCentralManagementUrl}"  only_if { ChocolateyCentralManagementUrl != nil }endchocolatey_config 'centralManagementClientCommunicationSaltAdditivePassword' do  value   "#{ChocolateyCentralManagementClientSalt}"  only_if { ChocolateyCentralManagementClientSalt != nil }endchocolatey_config 'centralManagementServiceCommunicationSaltAdditivePassword' do  value   "#{ChocolateyCentralManagementServiceSalt}"  only_if { ChocolateyCentralManagementServiceSalt != nil }endchocolatey_feature 'useChocolateyCentralManagement' do  action :enable  only_if { ChocolateyCentralManagementUrl != nil }endchocolatey_feature 'useChocolateyCentralManagementDeployments' do  action :enable  only_if { ChocolateyCentralManagementUrl != nil }end

#requires -Modules cChoco## 1. REQUIREMENTS ##### Here are the requirements necessary to ensure this is successful.### a. Internal/Private Cloud Repository Set Up ####### You'll need an internal/private cloud repository you can use. These are####  generally really quick to set up and there are quite a few options.####  Chocolatey Software recommends Nexus, Artifactory Pro, or ProGet as they####  are repository servers and will give you the ability to manage multiple####  repositories and types from one server installation.### b. Download Chocolatey Package and Put on Internal Repository ####### You need to have downloaded the Chocolatey package as well.####  Please see https://chocolatey.org/install#organization### c. Other Requirements ####### i. Requires chocolatey\cChoco DSC module to be installed on the machine compiling the DSC manifest#### NOTE: This will need to be installed before running the DSC portion of this scriptif (-not (Get-Module cChoco -ListAvailable)) {    $null = Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force    if (($PSGallery = Get-PSRepository -Name PSGallery).InstallationPolicy -ne "Trusted") {        Set-PSRepository -Name PSGallery -InstallationPolicy Trusted    }    Install-Module -Name cChoco    if ($PSGallery.InstallationPolicy -ne "Trusted") {        Set-PSRepository -Name PSGallery -InstallationPolicy $PSGallery.InstallationPolicy    }}#### ii. Requires a hosted copy of the install.ps1 script##### This should be available to download without authentication.##### The original script can be found here: https://community.chocolatey.org/install.ps1Configuration ChocolateyConfig {## 2. TOP LEVEL VARIABLES ##    param(### a. Your internal repository url (the main one). #######  Should be similar to what you see when you browse#### to https://community.chocolatey.org/api/v2/        $NugetRepositoryUrl      = "INTERNAL REPO URL",### b. Chocolatey nupkg download url ####### This url should result in an immediate download when you navigate to it in#### a web browser        $ChocolateyNupkgUrl      = "INTERNAL REPO URL/package/chocolatey.2.4.3.nupkg",### c. Internal Repository Credential ####### If required, add the repository access credential here#        $NugetRepositoryCredential = [PSCredential]::new(#            "username",#            ("password" | ConvertTo-SecureString -AsPlainText -Force)#        ),### d. Install.ps1 URL#### The path to the hosted install script:        $ChocolateyInstallPs1Url = "https://community.chocolatey.org/install.ps1"### e. Chocolatey Central Management (CCM) ####### If using CCM to manage Chocolatey, add the following:#### i. Endpoint URL for CCM#        $ChocolateyCentralManagementUrl = "https://chocolatey-central-management:24020/ChocolateyManagementService",#### ii. If using a Client Salt, add it here#        $ChocolateyCentralManagementClientSalt = "clientsalt",#### iii. If using a Service Salt, add it here#        $ChocolateyCentralManagementServiceSalt = "servicesalt"    )    Import-DscResource -ModuleName PSDesiredStateConfiguration    Import-DscResource -ModuleName cChoco    Node 'localhost' {## 3. ENSURE CHOCOLATEY IS INSTALLED ##### Ensure Chocolatey is installed from your internal repository        Environment chocoDownloadUrl {            Name  = "chocolateyDownloadUrl"            Value = $ChocolateyNupkgUrl        }        cChocoInstaller installChocolatey {            DependsOn = "[Environment]chocoDownloadUrl"            InstallDir = Join-Path $env:ProgramData "chocolatey"            ChocoInstallScriptUrl = $ChocolateyInstallPs1Url        }## 4. CONFIGURE CHOCOLATEY BASELINE ##### a. FIPS Feature ####### If you need FIPS compliance - make this the first thing you configure#### before you do any additional configuration or package installations#        cChocoFeature featureFipsCompliance {#            FeatureName = "useFipsCompliantChecksums"#        }### b. Apply Recommended Configuration ####### Move cache location so Chocolatey is very deterministic about#### cleaning up temporary data and the location is secured to admins        cChocoConfig cacheLocation {            DependsOn  = "[cChocoInstaller]installChocolatey"            ConfigName = "cacheLocation"            Value      = "C:\ProgramData\chocolatey\cache"        }#### Increase timeout to at least 4 hours        cChocoConfig commandExecutionTimeoutSeconds {            DependsOn  = "[cChocoInstaller]installChocolatey"            ConfigName = "commandExecutionTimeoutSeconds"            Value      = 14400        }#### Turn off download progress when running choco through integrations        cChocoFeature showDownloadProgress {            DependsOn   = "[cChocoInstaller]installChocolatey"            FeatureName = "showDownloadProgress"            Ensure      = "Absent"        }### c. Sources ####### Remove the default community package repository source        cChocoSource removeCommunityRepository {            DependsOn  = "[cChocoInstaller]installChocolatey"            Name       = "chocolatey"            Ensure     = "Absent"        }#### Add internal default sources#### You could have multiple sources here, so we will provide an example#### of one using the remote repo variable here.#### NOTE: This EXAMPLE may require changes        cChocoSource addInternalSource {            DependsOn  = "[cChocoInstaller]installChocolatey"            Name        = "ChocolateyInternal"            Source      = $NugetRepositoryUrl            Credentials = $NugetRepositoryCredential            Priority    = 1        }### b. Keep Chocolatey Up To Date ####### Keep chocolatey up to date based on your internal source#### You control the upgrades based on when you push an updated version####  to your internal repository.#### Note the source here is to the OData feed, similar to what you see####  when you browse to https://community.chocolatey.org/api/v2/        cChocoPackageInstaller updateChocolatey {            DependsOn   = "[cChocoSource]addInternalSource", "[cChocoSource]removeCommunityRepository"            Name        = "chocolatey"            AutoUpgrade = $true        }## 5. ENSURE CHOCOLATEY FOR BUSINESS ##### If you don't have Chocolatey for Business (C4B), you'll want to remove from here down.### a. Ensure The License File Is Installed ####### Create a license package using script from https://docs.chocolatey.org/en-us/how-tos/setup-offline-installation#exercise-4-create-a-package-for-the-license        cChocoPackageInstaller chocolateyLicense {            DependsOn = "[cChocoPackageInstaller]updateChocolatey"            Name      = "chocolatey-license"        }### b. Disable The Licensed Source ####### The licensed source cannot be removed, so it must be disabled.#### This must occur after the license has been set by the license package.        Script disableLicensedSource {            DependsOn  = "[cChocoPackageInstaller]chocolateyLicense"            GetScript  = {                $Source = choco source list --limitoutput | `                    ConvertFrom-Csv -Delimiter '|' -Header Name, Source, Disabled | `                    Where-Object Name -eq "chocolatey.licensed"                return @{                    Result = if ($Source) {                        [bool]::Parse($Source.Disabled)                    } else {                        Write-Warning "Source 'chocolatey.licensed' was not present."                        $true  # Source does not need disabling                    }                }            }            SetScript  = {                $null = choco source disable --name "chocolatey.licensed"            }            TestScript = {                $State = [ScriptBlock]::Create($GetScript).Invoke()                return $State.Result            }        }### c. Ensure Chocolatey Licensed Extension ####### You will have downloaded the licensed extension to your internal repository#### as you have disabled the licensed repository in step 5b.#### Ensure the chocolatey.extension package (aka Chocolatey Licensed Extension)        cChocoPackageInstaller chocolateyLicensedExtension {            DependsOn = "[Script]disableLicensedSource"            Name      = "chocolatey.extension"        }#### The Chocolatey Licensed Extension unlocks all of the following, which also have configuration/feature items available with them. You may want to visit the feature pages to see what you might want to also enable:#### - Package Builder - https://docs.chocolatey.org/en-us/features/paid/package-builder#### - Package Internalizer - https://docs.chocolatey.org/en-us/features/paid/package-internalizer#### - Package Synchronization (3 components) - https://docs.chocolatey.org/en-us/features/paid/package-synchronization#### - Package Reducer - https://docs.chocolatey.org/en-us/features/paid/package-reducer#### - Package Audit - https://docs.chocolatey.org/en-us/features/paid/package-audit#### - Package Throttle - https://docs.chocolatey.org/en-us/features/paid/package-throttle#### - CDN Cache Access - https://docs.chocolatey.org/en-us/features/paid/private-cdn#### - Branding - https://docs.chocolatey.org/en-us/features/paid/branding#### - Self-Service Anywhere (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/self-service-anywhere#### - Chocolatey Central Management (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/chocolatey-central-management#### - Other - https://docs.chocolatey.org/en-us/features/paid/### d. Ensure Self-Service Anywhere ####### If you have desktop clients where users are not administrators, you may#### to take advantage of deploying and configuring Self-Service anywhere        cChocoFeature hideElevatedWarnings {            DependsOn   = "[cChocoPackageInstaller]chocolateyLicensedExtension"            FeatureName = "showNonElevatedWarnings"            Ensure      = "Absent"        }        cChocoFeature useBackgroundService {            DependsOn   = "[cChocoPackageInstaller]chocolateyLicensedExtension"            FeatureName = "useBackgroundService"            Ensure      = "Present"        }        cChocoFeature useBackgroundServiceWithNonAdmins {            DependsOn   = "[cChocoPackageInstaller]chocolateyLicensedExtension"            FeatureName = "useBackgroundServiceWithNonAdministratorsOnly"            Ensure      = "Present"        }        cChocoFeature useBackgroundServiceUninstallsForUserInstalls {            DependsOn   = "[cChocoPackageInstaller]chocolateyLicensedExtension"            FeatureName = "allowBackgroundServiceUninstallsFromUserInstallsOnly"            Ensure      = "Present"        }        cChocoConfig allowedBackgroundServiceCommands {            DependsOn   = "[cChocoFeature]useBackgroundService"            ConfigName = "backgroundServiceAllowedCommands"            Value       = "install,upgrade,uninstall"        }### e. Ensure Chocolatey Central Management ####### If you want to manage and report on endpoints, you can set up and configure### Central Management. There are multiple portions to manage, so you'll see### a section on agents here along with notes on how to configure the server### side components.        if ($ChocolateyCentralManagementUrl) {            cChocoPackageInstaller chocolateyAgent {                DependsOn = "[cChocoPackageInstaller]chocolateyLicensedExtension"                Name      = "chocolatey-agent"            }            cChocoConfig centralManagementServiceUrl {                DependsOn   = "[cChocoPackageInstaller]chocolateyAgent"                ConfigName = "CentralManagementServiceUrl"                Value       = $ChocolateyCentralManagementUrl            }            if ($ChocolateyCentralManagementClientSalt) {                cChocoConfig centralManagementClientSalt {                    DependsOn  = "[cChocoPackageInstaller]chocolateyAgent"                    ConfigName = "centralManagementClientCommunicationSaltAdditivePassword"                    Value      = $ChocolateyCentralManagementClientSalt                }            }            if ($ChocolateyCentralManagementServiceSalt) {                cChocoConfig centralManagementServiceSalt {                    DependsOn  = "[cChocoPackageInstaller]chocolateyAgent"                    ConfigName = "centralManagementServiceCommunicationSaltAdditivePassword"                    Value      = $ChocolateyCentralManagementServiceSalt                }            }            cChocoFeature useCentralManagement {                DependsOn   = "[cChocoPackageInstaller]chocolateyAgent"                FeatureName = "useChocolateyCentralManagement"                Ensure      = "Present"            }            cChocoFeature useCentralManagementDeployments {                DependsOn   = "[cChocoPackageInstaller]chocolateyAgent"                FeatureName = "useChocolateyCentralManagementDeployments"                Ensure      = "Present"            }        }    }}# If working this into an existing configuration with a good method for$ConfigData = @{    AllNodes = @(        @{            NodeName                    = "localhost"            PSDscAllowPlainTextPassword = $true        }    )}try {    Push-Location $env:Temp    $Config = ChocolateyConfig -ConfigurationData $ConfigData    Start-DscConfiguration -Path $Config.PSParentPath -Wait -Verbose -Force} finally {    Pop-Location}

## 1. REQUIREMENTS ##### Here are the requirements necessary to ensure this is successful.### a. Internal/Private Cloud Repository Set Up ####### You'll need an internal/private cloud repository you can use. These are####  generally really quick to set up and there are quite a few options.####  Chocolatey Software recommends Nexus, Artifactory Pro, or ProGet as they####  are repository servers and will give you the ability to manage multiple####  repositories and types from one server installation.### b. Download Chocolatey Package and Put on Internal Repository ####### You need to have downloaded the Chocolatey package as well.####  Please see https://chocolatey.org/install#organization### c. Other Requirements ####### i. Requires puppetlabs/chocolatey module####  See https://forge.puppet.com/puppetlabs/chocolatey## 2. TOP LEVEL VARIABLES ##### a. Your internal repository url (the main one). #######  Should be similar to what you see when you browse#### to https://community.chocolatey.org/api/v2/$_repository_url = 'INTERNAL REPO URL'### b. Chocolatey nupkg download url ####### This url should result in an immediate download when you navigate to it in#### a web browser$_choco_download_url = 'INTERNAL REPO URL/package/chocolatey.2.4.3.nupkg'### c. Chocolatey Central Management (CCM) ####### If using CCM to manage Chocolatey, add the following:#### i. Endpoint URL for CCM# $_chocolatey_central_management_url = 'https://chocolatey-central-management:24020/ChocolateyManagementService'#### ii. If using a Client Salt, add it here# $_chocolatey_central_management_client_salt = "clientsalt"#### iii. If using a Service Salt, add it here# $_chocolatey_central_management_service_salt = 'servicesalt'## 3. ENSURE CHOCOLATEY IS INSTALLED ##### Ensure Chocolatey is installed from your internal repository### Note: `chocolatey_download_url is completely different than normal###  source locations. This is directly to the bare download url for the###  chocolatey.nupkg, similar to what you see when you browse to###  https://community.chocolatey.org/api/v2/package/chocolateyclass {'chocolatey':  chocolatey_download_url => $_choco_download_url,  use_7zip                => false,}## 4. CONFIGURE CHOCOLATEY BASELINE ##### a. FIPS Feature ####### If you need FIPS compliance - make this the first thing you configure#### before you do any additional configuration or package installations#chocolateyfeature {'useFipsCompliantChecksums':#  ensure => enabled,#}### b. Apply Recommended Configuration ####### Move cache location so Chocolatey is very deterministic about#### cleaning up temporary data and the location is secured to adminschocolateyconfig {'cacheLocation':  value => 'C:\ProgramData\chocolatey\cache',}#### Increase timeout to at least 4 hourschocolateyconfig {'commandExecutionTimeoutSeconds':  value => '14400',}#### Turn off download progress when running choco through integrationschocolateyfeature {'showDownloadProgress':  ensure => disabled,}### c. Sources ####### Remove the default community package repository sourcechocolateysource {'chocolatey':  ensure   => absent,  location => 'https://community.chocolatey.org/api/v2/',}#### Add internal default sources#### You could have multiple sources here, so we will provide an example#### of one using the remote repo variable here#### NOTE: This EXAMPLE requires changeschocolateysource {'internal_chocolatey':  ensure             => present,  location           => $_repository_url,  priority           => 1,  username           => 'optional',  password           => 'optional,not ensured',  bypass_proxy       => true,  admin_only         => false,  allow_self_service => false,}### b. Keep Chocolatey Up To Date ####### Keep chocolatey up to date based on your internal source#### You control the upgrades based on when you push an updated version####  to your internal repository.#### Note the source here is to the OData feed, similar to what you see####  when you browse to https://community.chocolatey.org/api/v2/package {'chocolatey':  ensure   => latest,  provider => chocolatey,  source   => $_repository_url,}## 5. ENSURE CHOCOLATEY FOR BUSINESS ##### If you don't have Chocolatey for Business (C4B), you'll want to remove from here down.### a. Ensure The License File Is Installed ####### Create a license package using script from https://docs.chocolatey.org/en-us/guides/organizations/organizational-deployment-guide#exercise-4-create-a-package-for-the-license# TODO: Add resource for installing/ensuring the chocolatey-license packagepackage {'chocolatey-license':  ensure   => latest,  provider => chocolatey,  source   => $_repository_url,}### b. Disable The Licensed Source ####### The licensed source cannot be removed, so it must be disabled.#### This must occur after the license has been set by the license package.## Disabled sources still need all other attributes until## https://tickets.puppetlabs.com/browse/MODULES-4449 is resolved.## Password is necessary with user, but not ensurable, so it should not## matter what it is set to here. If you ever do get into trouble here,## the password is your license GUID.chocolateysource {'chocolatey.licensed':  ensure   => disabled,  priority => '10',  user     => 'customer',  password => '1234',  require  => Package['chocolatey-license'],}### c. Ensure Chocolatey Licensed Extension ####### You will have downloaded the licensed extension to your internal repository#### as you have disabled the licensed repository in step 5b.#### Ensure the chocolatey.extension package (aka Chocolatey Licensed Extension)package {'chocolatey.extension':  ensure   => latest,  provider => chocolatey,  source   => $_repository_url,  require  => Package['chocolatey-license'],}#### The Chocolatey Licensed Extension unlocks all of the following, which also have configuration/feature items available with them. You may want to visit the feature pages to see what you might want to also enable:#### - Package Builder - https://docs.chocolatey.org/en-us/features/paid/package-builder#### - Package Internalizer - https://docs.chocolatey.org/en-us/features/paid/package-internalizer#### - Package Synchronization (3 components) - https://docs.chocolatey.org/en-us/features/paid/package-synchronization#### - Package Reducer - https://docs.chocolatey.org/en-us/features/paid/package-reducer#### - Package Audit - https://docs.chocolatey.org/en-us/features/paid/package-audit#### - Package Throttle - https://docs.chocolatey.org/en-us/features/paid/package-throttle#### - CDN Cache Access - https://docs.chocolatey.org/en-us/features/paid/private-cdn#### - Branding - https://docs.chocolatey.org/en-us/features/paid/branding#### - Self-Service Anywhere (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/self-service-anywhere#### - Chocolatey Central Management (more components will need to be installed and additional configuration will need to be set) - https://docs.chocolatey.org/en-us/features/paid/chocolatey-central-management#### - Other - https://docs.chocolatey.org/en-us/features/paid/### d. Ensure Self-Service Anywhere ####### If you have desktop clients where users are not administrators, you may#### to take advantage of deploying and configuring Self-Service anywherechocolateyfeature {'showNonElevatedWarnings':  ensure => disabled,}chocolateyfeature {'useBackgroundService':  ensure => enabled,}chocolateyfeature {'useBackgroundServiceWithNonAdministratorsOnly':  ensure => enabled,}chocolateyfeature {'allowBackgroundServiceUninstallsFromUserInstallsOnly':  ensure => enabled,}chocolateyconfig {'backgroundServiceAllowedCommands':  value => 'install,upgrade,uninstall',}### e. Ensure Chocolatey Central Management ####### If you want to manage and report on endpoints, you can set up and configure### Central Management. There are multiple portions to manage, so you'll see### a section on agents here along with notes on how to configure the server### side components.if $_chocolatey_central_management_url {  package {'chocolatey-agent':    ensure   => latest,    provider => chocolatey,    source   => $_repository_url,    require  => Package['chocolatey-license'],  }  chocolateyconfig {'CentralManagementServiceUrl':    value   => $_chocolatey_central_management_url,  }  if $_chocolatey_central_management_client_salt {    chocolateyconfig {'centralManagementClientCommunicationSaltAdditivePassword':      value => $_chocolatey_central_management_client_salt,    }  }  if $_chocolatey_central_management_service_salt {    chocolateyconfig {'centralManagementClientCommunicationSaltAdditivePassword':      value => $_chocolatey_central_management_client_salt,    }  }  chocolateyfeature {'useChocolateyCentralManagement':    ensure  => enabled,    require => Package['chocolatey-agent'],  }  chocolateyfeature {'useChocolateyCentralManagementDeployments':    ensure  => enabled,    require => Package['chocolatey-agent'],  }}