What is this?
MeshLAN is a self-hosted virtual LAN built on SlackHQ Nebula that connects Windows devices across different networks and NATs, preferring direct P2P links and falling back to relays, with service sharing, name-based access via MeshDNS, and optional AI automation.
MeshLAN is a self-hosted virtual LAN built on SlackHQ Nebula that connects Windows devices across different networks and NATs, preferring direct P2P links and falling back to relays, with service sharing, name-based access via MeshDNS, and optional AI automation.Is this one app or several components?It is a three-part system: a native Windows client, a Linux main server that acts as the primary Lighthouse/Relay and issues certificates, and optional Linux child nodes that act as extra Lighthouse/Relay for failover.
It is a three-part system: a native Windows client, a Linux main server that acts as the primary Lighthouse/Relay and issues certificates, and optional Linux child nodes that act as extra Lighthouse/Relay for failover.How do I get it running?Build the client and server with Go 1.26+ on Windows PowerShell, initialize the main server on your own Linux host (which prints a one-time pairing hash and admin token you must save immediately), then run the Windows client and enter your device name, the server address, and the pairing hash.
Build the client and server with Go 1.26+ on Windows PowerShell, initialize the main server on your own Linux host (which prints a one-time pairing hash and admin token you must save immediately), then run the Windows client and enter your device name, the server address, and the pairing hash.What do I need before building and running it?You need Go 1.26+, a Windows 10/11 machine with the Microsoft Edge WebView2 Runtime to build and run the client, Nebula and nebula-cert 1.11.x, and a Linux host (amd64/arm64) you control for the main server and optional child nodes.
You need Go 1.26+, a Windows 10/11 machine with the Microsoft Edge WebView2 Runtime to build and run the client, Nebula and nebula-cert 1.11.x, and a Linux host (amd64/arm64) you control for the main server and optional child nodes.Does self-hosting this make me automatically secure?No — self-hosting does not equal automatic security; you're still responsible for public ports, firewalls, system updates, admin terminals, backups and code signing.
No — self-hosting does not equal automatic security; you're still responsible for public ports, firewalls, system updates, admin terminals, backups and code signing.Can I run the client on Linux, or only the server?The client is Windows 10/11 only, built as a native WebView2 app; Linux is used for the control plane and relay/child nodes, which you host yourself.
The client is Windows 10/11 only, built as a native WebView2 app; Linux is used for the control plane and relay/child nodes, which you host yourself.What can the optional AI assistant actually do?Admins can point it at any OpenAI-compatible API; the model key stays only on the server, requests are end-to-end encrypted, the AI can only call a whitelisted set of tools, and every change it proposes must be confirmed by the user before it is applied.
Admins can point it at any OpenAI-compatible API; the model key stays only on the server, requests are end-to-end encrypted, the AI can only call a whitelisted set of tools, and every change it proposes must be confirmed by the user before it is applied.How does MeshDNS let me reach devices by name instead of IP?Each user gets a customizable device prefix like alice.mesh, and each published service gets a stable name such as chat.alice.mesh or db.alice.mesh:5432, so you can reach devices and local services without editing hosts files.
Each user gets a customizable device prefix like alice.mesh, and each published service gets a stable name such as chat.alice.mesh or db.alice.mesh:5432, so you can reach devices and local services without editing hosts files.What happens if a direct P2P connection fails?MeshLAN automatically falls back to one of several relay nodes chosen by latency, jitter, packet loss and health; even when relayed, the relay only ever sees encrypted Nebula packets, not your actual traffic.
MeshLAN automatically falls back to one of several relay nodes chosen by latency, jitter, packet loss and health; even when relayed, the relay only ever sees encrypted Nebula packets, not your actual traffic.How are software updates kept safe?Update packages are signed with Ed25519, verified against SHA-256 (optionally Authenticode-signed), and the updater automatically rolls back if a post-update health check fails.
Update packages are signed with Ed25519, verified against SHA-256 (optionally Authenticode-signed), and the updater automatically rolls back if a post-update health check fails.Which topics is it in?nat-traversal, mesh-network, relay, file-sharing, p2p, vpn, windows-app, openai-compatible, authentication, encryption, golang, sqlite
nat-traversal, mesh-network, relay, file-sharing, p2p, vpn, windows-app, openai-compatible, authentication, encryption, golang, sqlite