Clients
TZX Mesh ships its own desktop apps, free and open source under the BSD 3-Clause licence: a background service with a command line (tzxmesh) and a tray app for settings and status. Downloads live at tzxmesh.com/dl; every file is listed in SHA256SUMS.
| Platform | Install | Connect |
|---|---|---|
| Linux (Debian, Ubuntu, Fedora, RHEL, openSUSE, any distro) | curl -fsSL https://tzxmesh.com/client.sh | shor the .deb / .rpm / tarball for your CPU (x86_64, arm64, armv7) | sudo tzxmesh up --management-url https://mesh.example.com |
| Linux desktop app (x86_64) | tzxmesh-desktop-linux-amd64.deb or .rpm (GTK 3, WebKitGTK 4.1: Ubuntu 22.04+, Debian 12+, Fedora, openSUSE) | tray app → Settings → Server → your URL |
| macOS 11+ (Apple silicon and Intel) | tzxmesh-desktop-darwin-universal.pkg, or the same client.sh line | menu-bar app → Settings → Server → your URL; or sudo tzxmesh up … |
| Windows 10/11 (x64) | tzxmesh-desktop-windows-amd64.exe (service + tray app + WireGuard driver) | tray app → Settings → Server → your URL; or tzxmesh up … in an elevated prompt |
| Windows on ARM | tzxmesh-windows-arm64.zip (command line only) | tzxmesh service install, tzxmesh service start, then tzxmesh up … |
| iOS / Android | in development (Warden approvals from the phone come first) | until then, the upstream mobile client with your URL under Self-hosted works against a TZX Mesh server |
| Containers | the upstream netbirdio/netbird image works against a TZX Mesh server (no enrolment note) | see Setup keys for the run command |
The console's Install page fills in your server address for every platform and links the same downloads.
Verify what you downloaded
The apps are not code-signed yet, so macOS and Windows will warn about an unidentified developer. Check the file against the published sums before you allow it:
curl -fsSLO https://tzxmesh.com/dl/latest/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS # Linux
shasum -a 256 -c --ignore-missing SHA256SUMS # macOSOn macOS, if the package is refused, open System Settings → Privacy & Security and allow it there. On Windows, SmartScreen shows More info → Run anyway. client.sh performs the same check for you.
Where things live
| What | Linux / macOS | Windows |
|---|---|---|
| Service | tzxmesh (systemd / launchd) | TZXMesh in Services |
| Configuration and state | /var/lib/tzxmesh/ | C:\ProgramData\TZX Mesh\ |
| Logs | /var/log/tzxmesh/client.log | C:\ProgramData\TZX Mesh\client.log |
| Daemon socket | /var/run/tzxmesh.sock | named pipe tzxmesh |
A TZX Mesh app and an upstream NetBird client can be installed side by side; they use different names, paths and services.
Useful commands
tzxmesh status # management, signal, relay, peers, connection types
tzxmesh status -d # per-peer detail: direct or relayed, last handshake
tzxmesh routes list # subnets and exit nodes offered to this device
tzxmesh down / tzxmesh up # reconnect after changing the management URL
tzxmesh up --enrol-note "…" # tell the administrator who you are (shown in Warden)Every option also reads an environment variable with the NB_ prefix, for example NB_MANAGEMENT_URL or NB_ENROL_NOTE, which is how scripts and images pass settings.
Headless machines
Servers and containers use a setup key. Give them a fixed hostname; it becomes the peer name. The one-line installer enrols in the same step:
curl -fsSL https://tzxmesh.com/client.sh | TZX_SETUP_KEY=<key> TZX_MANAGEMENT_URL=https://mesh.example.com shUpdates
The apps check tzxmesh.com/dl/version and tell you when a newer release exists. Every release is signed, and a signed manifest binds the version, the filename and the hash together, so an app refuses an update whose signature does not verify and refuses an older release served in place of a new one. On Windows and macOS the app can install the update itself: turn that on under Settings → Clients in the console and choose whether devices update on their own or wait for someone to press Install. On Linux, update through your package manager or run client.sh again. Your server shows the same notice in the console.
Sign-in and expiry
Devices enrolled by a user re-authenticate when the session expires (24 hours by default, adjustable in Settings → Authentication). Devices enrolled with a setup key do not expire unless you switch that on for them.