One switch for the whole network

This week the networking stack's tangle of separate toggles — mesh overlay, exit VPN, ad-block, DNS — folded into a single master switch. It's exactly the kind of tidying-up that comes before a first release: we're closing in on 0.8, which will be the first proper build and the point where we publish the source.

This week was consolidation — a boring word for a satisfying job: taking a pile of separate switches and turning them into one. The networking stack had quietly grown three or four different toggles — the mesh overlay, the exit VPN, ad-blocking, DNS — and they didn't always agree with each other. Now there's one master switch.

Flip it on and MeshHold brings up a single system-VPN adapter that carries whatever you asked for: just the mesh overlay, an exit, a full tunnel, or nothing but the ad-blocker. The three platforms that had each grown their own path — a unified TUN on Linux, one adapter on Windows, a single VpnService on Android — now share the same shape. And when you flip it off, it actually tears everything down: no half-attached TUN quietly clinging on afterward. vpn up with no exit is a perfectly good command now — that's the mesh-only case.

DNS, sorted

The messiest part of any VPN is DNS, so it got the most attention. System DNS now routes through the mesh resolver on the desktop — on Linux directly, on Windows via an NRPT "." rule — so MagicDNS names and ad-block filtering just work without you configuring a thing. There's a filter-only mode that blocks ads with no mesh and no exit at all, just a local sinkhole. And — the fix I'm quietly most pleased with — it now coexists with Tailscale instead of the two of them wrestling over who owns the default DNS. If you already run a mesh VPN, MeshHold will share the road.

Closing in on 0.8

Here's the part worth saying out loud. This kind of week — folding features together, smoothing the seams, fixing the way things interact — is what the run-up to a first release looks like. The feature surface is essentially there; what's left is debugging and consolidation, one subsystem at a time.

So here's the plan. Once the core features are solid — and this week's VPN unification is a big chunk of that — we cut the first 0.8 release. It'll be the first proper, versioned build rather than a nightly. And at that point we publish the source: MeshHold has been built in the open in spirit, and 0.8 is where it becomes open in the literal sense.

No date yet — it ships when it's solid, not before. But it's close, and it's what everything this month has been pointed at.

Since last week

Unified VPN master toggle: the mesh overlay and the exit VPN now share one system-VPN adapter — a single TUN on Linux, one adapter on Windows, one VpnService on Android — driven by a single switch that can be mesh-only, an exit, a full tunnel, or filter-only, with a real teardown when you turn it off
Mesh-only VPN: vpn up with no exit, and vpn.enabled without a default exit, are now first-class
DNS routing: all system DNS routed through the mesh resolver on desktop (Linux resolver, Windows NRPT "." rule); a filter-only ad-block mode backed by a private DNS sink; docs realigned to the selective + all-DNS model
Tailscale coexistence: MeshHold no longer fights another tool for the default DNS on Windows
Web: the mesh toggle became the master VPN switch, mesh-LAN tiers moved to the top of the Default egress list, and the exit banner got tidied up