MeshHold
Download
Reference

Installing on Windows

Per-user tray or per-machine service, what the installer puts where, the firewall rule a service install cannot ask for, and moving a node between the two.

MeshHoldSetup.msi from the downloads page. There is a separate -arm64.msi; the plain one is x86-64.

The installer asks one real question, and it is the first screen after the licence.

Per-user or per-machine

Per-user — "Install just for me". MeshHold runs as a tray application under your account, with its data in %USERPROFILE%\.meshhold. It starts when you sign in and stops when you sign out. No administrator rights are needed. This is the right answer for a laptop or a desktop you sit at.

Per-machine — "Install for all users". The daemon is registered with the Windows Service Control Manager as a LocalSystem auto-start service, with its data in %ProgramData%\MeshHold. It runs whether or not anybody is signed in, which is the point: a node that is only up while you are logged in is not a node the rest of your mesh can rely on. This one needs administrator rights, and it is the right answer for a machine that is meant to stay reachable.

Going from one to the other is supported and does not mean starting over. A per-machine install adopts the node from %USERPROFILE%\.meshhold if there is one and the machine-wide directory is empty, so the node ID, the vaults and the paired peers all survive the move. It never overwrites a live node — if the target already has one, the import is skipped. IMPORTNODE=0 on the command line opts out.

What gets installed

There is no component picker, and that is deliberate: every node is the same and fully capable. The pieces below are a few megabytes between them, so choosing among them would save nothing and would turn "does this node have the VPN helper" into a question somebody has to ask.

  • The daemon and the tray app. The same binary; the tray is the desktop shell around it.
  • meshhold.exe, the command-line client, on the PATH.
  • The VPN helper service, so mesh-LAN and the exit-VPN work without a UAC prompt every time.
  • The meshhold:// protocol handler, which is what makes an invite link clickable.
  • A "Send with MeshHold" entry on the right-click menu.
  • Start with Windows — per-user installs only. A service does not need it, and a machine that ran both would be running two nodes.

Mounting a vault as a drive

That needs WinFsp, a filesystem driver MeshHold does not bundle: most installs never mount anything, and a kernel driver is not something to hand out unasked. The installer's last page says so if you do not already have it.

It is the one program MeshHold will fetch for you — the vendor's own signed package, checked against a checksum fixed at build time:

meshhold tools install winfsp --yes

Or from the installer itself, if you would rather not open a command prompt:

msiexec /i MeshHoldSetup.msi INSTALLWINFSP=1

Everything else on the tools list is yours to install. See below.

Everything a node can do with a file

Converting a document, transcoding a film, transcribing a recording, reading one aloud, indexing for search and answering questions all need programs MeshHold does not install — ffmpeg, LibreOffice and the model runtimes. A fresh Windows install has none of them, and the node works perfectly well without them for storage, sync, chat and VPN.

To see where you stand:

meshhold tools

or Settings → Tools in the app, which shows the same list with the model store underneath it and a button to look again after you install something. The programs a node needs has the command for each one.

Two things worth knowing

A service install cannot ask about the firewall. For a per-user tray install, Windows prompts on the first inbound connection and you click Allow. A LocalSystem service has no interactive session, so there is no prompt — and inbound peer-to-peer traffic is silently blocked, which shows up as a node that finds nobody. Add the rule by hand from an elevated prompt:

netsh advfirewall firewall add rule name="MeshHold P2P" dir=in action=allow protocol=TCP localport=7777

Use whatever port your config.yaml actually listens on if you changed it.

The data directory is not selectable at install time. A per-user install takes %USERPROFILE%\.meshhold and a service install takes %ProgramData%\MeshHold. Putting a node on a second drive means installing, stopping the daemon, moving the directory and pointing config.yaml at the new location.

Managing the service

meshhold service status --json
meshhold service start
meshhold service stop

meshhold status is the daemon's own health summary — version, network, listen addresses, TLS, and what tools are missing — and needs the node to be running. See the CLI reference.

Uninstalling

Through Apps & features, as usual. It removes the services and the program files; it does not remove your data directory, because that holds the node's identity and the only copy of anything not yet replicated elsewhere. Delete %ProgramData%\MeshHold or %USERPROFILE%\.meshhold by hand once you are sure.