update

app/Services/VirtualMachine/Rebuild/VmRebuildPasswordService.php

@@ -6,6 +6,7 @@ namespace App\Services\VirtualMachine\Rebuild;
 
 use App\DTOs\VirtualMachine\Rebuild\RebuildContext;
 use App\Http\Facade\SignRSA;
+use App\Http\Services\vCenter as VCenterService;
 use App\Models\ModuleVmware;
 use App\Models\ReinstallLog;
 use App\Models\vCenter as VCenterModel;
@@ -25,8 +26,10 @@ use RuntimeException;
  */
 final class VmRebuildPasswordService
 {
-    public function __construct(private readonly VsphereHostSshService $ssh)
-    {
+    public function __construct(
+        private readonly VsphereHostSshService $ssh,
+        private readonly VCenterService $vCenter,
+    ) {
     }
 
     /**
@@ -97,9 +100,44 @@ final class VmRebuildPasswordService
             'reinstall_log_id' => $log?->id,
         ]);
 
+        // Windows RDP port is rotated together with the password — a fresh
+        // random port each rebuild. Linux keeps port 22 (no remote SSH-port
+        // change script exists on the jump host yet).
+        if ($ctx->isWindows) {
+            $this->rotatePort($ctx, $newPassword);
+        }
+
         return $newPassword;
     }
 
+    private function rotatePort(RebuildContext $ctx, string $guestPassword): void
+    {
+        $newPort = (string) random_int(10000, 60000);
+
+        $result = $this->vCenter->changeRDPPortWindows(
+            $ctx->transientName,
+            $ctx->guestUser,
+            $guestPassword,
+            $newPort,
+        );
+
+        $status = is_array($result) ? strtolower((string) ($result['status'] ?? '')) : '';
+        if ($status !== 'ok') {
+            throw new RuntimeException(
+                'Rebuild port: changeRDPPortWindows failed — ' . (is_string($result) ? $result : json_encode($result)),
+            );
+        }
+
+        ModuleVmware::where('id', $ctx->moduleVmwareId)->update([
+            'port' => (int) ($result['newPort'] ?? $newPort),
+        ]);
+
+        Log::info('VmRebuildPasswordService: RDP port rotated', [
+            'module_vmware_id' => $ctx->moduleVmwareId,
+            'new_port'         => $result['newPort'] ?? $newPort,
+        ]);
+    }
+
     private function generatePassword(int $length): string
     {
         $sets = [