# VeloraMesh Windows Client Install

Run these commands from an elevated PowerShell session inside this extracted package.

## Easiest Interactive Install

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\install-windows-client.ps1
```

In an interactive terminal, source, location, and endpoint overrides keep this menu available. Explicit operation or enrollment options select the direct flow:

```text
1) Guided install/update
2) Network operations
3) Service operations
4) Fresh install/reset client
5) Uninstall service, keep files/config
6) Purge client installation and local data
0) Exit
```

`Guided install/update` asks for API host/domain, API HTTPS port, network name, device name, network join secret, edge discovery host/domain, edge UDP port, and whether the background tunnel service should be installed.

Join secrets must be 24-256 UTF-8 bytes. The shared native validator rejects invalid, short, or overlong values without truncation. The accepted value remains client-local and derives the request-proof v2 signing key; only the signed enrollment proof is sent.

`Network operations` can join, leave, connect/disconnect, list peers, rename the device, and run doctor without remembering client CLI commands.

`Service operations` can show service status, start, stop, restart, and run service doctor.

`Fresh install/reset client` removes the Windows service, firewall rule, installed files, config, and service logs before running the guided install flow.

Service installation and update restrict `%ProgramData%\VeloraMesh` to `SYSTEM`, local administrators, and the installer identity. Do not relax this ACL for standard users; it protects session state, the machine-scope DPAPI payload, and service logs.

Optional hardening: set `VELORAMESH_CONTROL_PLANE_SPKI_PIN` to `sha256/<base64-SHA256-SPKI>` before install to pin the HTTPS control-plane certificate/public-key path.

## Install And Start Tunnel Service

```powershell
$SecretFile = Join-Path $env:TEMP "veloramesh-join.secret"
Set-Content -LiteralPath $SecretFile -Value "<network-join-secret>" -NoNewline
$NetworkName = "home"
$Discovery = "edge.veloramesh.com:3478"
powershell -NoProfile -ExecutionPolicy Bypass -File .\install-windows-client.ps1 `
  -Background `
  -ReplaceService `
  -Status `
  -NetworkName $NetworkName `
  -DeviceName $env:COMPUTERNAME `
  -JoinSecretFile $SecretFile `
  -Discovery $Discovery
Remove-Item -LiteralPath $SecretFile -Force
```

## LAN Discovery Broadcasts

Direct IP access uses the peer's VeloraMesh virtual IP and does not need LAN browser discovery support.

For LAN server-browser tests, enable discovery from the Ubuntu server manager or admin CLI:

```bash
sudo /opt/veloramesh/veloramesh-server admin networks broadcast -network home -mode all
```

Return to the safer default after testing:

```bash
sudo /opt/veloramesh/veloramesh-server admin networks broadcast -network home -mode filtered
```

Custom local UDP ports/ranges can still be supplied for diagnostics with `-ForwardBroadcastUDP`, for example `2300-2400,6073`.

When the server administrator sets the network to `broadcast_mode=all`, local custom UDP port allowlists are not required for that network's UDP discovery broadcasts.

## Status

```powershell
& "$env:ProgramFiles\VeloraMesh\veloramesh-client.exe" service status
Get-Content "$env:ProgramData\VeloraMesh\logs\service.log" -Tail 80
```

## Doctor

Run this after install to verify local identity, server auth, joined networks, peer visibility, MTU, and Windows tunnel prerequisites:

```powershell
& "$env:ProgramFiles\VeloraMesh\veloramesh-client.exe" doctor `
  -config "$env:ProgramData\VeloraMesh\client.json" `
  -network "home"
```

For a sanitized support bundle:

```powershell
& "$env:ProgramFiles\VeloraMesh\veloramesh-client.exe" doctor `
  -config "$env:ProgramData\VeloraMesh\client.json" `
  -network "home" `
  -bundle "$env:ProgramData\VeloraMesh\veloramesh-doctor.zip"
```

The guided installer also runs a non-blocking doctor self-test after setup. The Windows service log rotates at 5 MiB with five backups.

## Network Administration

Network creation, join-secret rotation, member removal, and device block/unblock are intentionally server-local operations. Use the Ubuntu server package's `manage-veloramesh-server.sh` menu or `/opt/veloramesh/veloramesh-server admin ...` on the server.

## Uninstall

Keep config and installed files:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\install-windows-client.ps1 -Uninstall
```

Remove service, firewall rule, installed files, config, and service logs:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\install-windows-client.ps1 -Uninstall -Purge
```

Fresh reset and guided reinstall:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\install-windows-client.ps1 -Fresh
```