MeshHold
Download
Reference

Installing on Windows

Per-user tray or per-machine service, what the installer puts where, the firewall rule a service install cannot ask for, and moving a node between the two.

MeshHoldSetup.msi from the downloads page. There is a separate -arm64.msi; the plain one is x86-64.

The installer asks one real question, and it is the first screen after the licence.

Per-user or per-machine

Per-user — "Install just for me". MeshHold runs as a tray application under your account, with its data in %USERPROFILE%\.meshhold. It starts when you sign in and stops when you sign out. No administrator rights are needed. This is the right answer for a laptop or a desktop you sit at.

Per-machine — "Install for all users". The daemon is registered with the Windows Service Control Manager as a LocalSystem auto-start service, with its data in %ProgramData%\MeshHold. It runs whether or not anybody is signed in, which is the point: a node that is only up while you are logged in is not a node the rest of your mesh can rely on. This one needs administrator rights, and it is the right answer for a machine that is meant to stay reachable.

Going from one to the other is supported and does not mean starting over. A per-machine install adopts the node from %USERPROFILE%\.meshhold if there is one and the machine-wide directory is empty, so the node ID, the vaults and the paired peers all survive the move. It never overwrites a live node — if the target already has one, the import is skipped. IMPORTNODE=0 on the command line opts out.

What gets installed

There is no component picker, and that is deliberate: every node is the same and fully capable. The pieces below are a few megabytes between them, so choosing among them would save nothing and would turn "does this node have the VPN helper" into a question somebody has to ask.

  • The daemon and the tray app. The same binary; the tray is the desktop shell around it.
  • meshhold.exe, the command-line client, on the PATH.
  • The VPN helper service, so mesh-LAN and the exit-VPN work without a UAC prompt every time.
  • The meshhold:// protocol handler, which is what makes an invite link clickable.
  • A "Send with MeshHold" entry on the right-click menu.
  • Start with Windows — per-user installs only. A service does not need it, and a machine that ran both would be running two nodes.

Mounting a vault as a drive

That needs WinFsp, a filesystem driver MeshHold does not bundle: most installs never mount anything, and a kernel driver is not something to hand out unasked. The installer's last page says so if you do not already have it.

It is the one program MeshHold will fetch for you — the vendor's own signed package, checked against a checksum fixed at build time:

meshhold tools install winfsp --yes

Or from the installer itself, if you would rather not open a command prompt:

msiexec /i MeshHoldSetup.msi INSTALLWINFSP=1

Everything else on the tools list is yours to install. See below.

Everything a node can do with a file

Converting a document, transcoding a film, making previews and letting office files reach the search index all need programs MeshHold does not install — ffmpeg and LibreOffice. A fresh Windows install has neither, and the node works perfectly well without them for storage, sync, chat and VPN.

To see where you stand:

meshhold tools

or Settings → Tools in the app, which shows the same list and a button to look again after you install something. The programs a node needs has the command for each one.

Two things worth knowing

A service install opens the firewall itself — on private and domain networks only. For a per-user tray install, Windows prompts on the first inbound connection and you click Allow. A LocalSystem service has no interactive session, so there is no prompt; meshhold service install therefore adds two inbound rules for meshhold.exe, named MeshHold P2P inbound (UDP …) and (TCP …): the port of node.listen_addr on UDP, and node.link_tcp_port — or that listen port plus one — on TCP, both on the Private and Domain profiles. service uninstall removes them; re-running the install after changing those ports replaces them. On a network Windows classes as Public they do not apply — make the network private, or add your own rule for that profile if you mean it.

The data directory is not selectable at install time. A per-user install takes %USERPROFILE%\.meshhold and a service install takes %ProgramData%\MeshHold. Putting a node on a second drive means installing, stopping the daemon, moving the directory and pointing config.yaml at the new location.

Managing the service

meshhold service status --json
meshhold service start
meshhold service stop

meshhold status is the daemon's own health summary — version, network, listen addresses, TLS, and what tools are missing — and needs the node to be running. See the CLI reference.

Uninstalling

Through Apps & features, as usual. It removes the services and the program files; it does not remove your data directory, because that holds the node's identity and the only copy of anything not yet replicated elsewhere. Delete %ProgramData%\MeshHold or %USERPROFILE%\.meshhold by hand once you are sure.