NexusLink on Windows

Installing

Two installer formats are produced by the release pipeline:

Artifact	Use
`nexuslink-installer-<version>.exe` (NSIS)	Interactive install for end users; installs the daemon service and the desktop UI, adds a Start-menu entry
`nexuslink_<version>_windows_<arch>.msi` (WiX)	Deployment through Intune, SCCM, GPO or any MSI-based tool

Silent installs:

nexuslink-installer.exe /S
msiexec /i nexuslink_1.0.0_windows_amd64.msi /qn

Both register the Windows service nexuslink ("NexusLink") which runs the daemon, install nexuslink.exe and nexuslink-ui.exe into C:\Program Files\NexusLink, ship wintun.dll and keep state in C:\ProgramData\NexusLink.

After installation:

nexuslink up --management-url https://nexuslink.example.com --setup-key <KEY>
nexuslink status

The desktop UI lives in the system tray (NexusLink icon: green check = connected). Uninstall through "Apps & features" or nexuslink service uninstall.

MDM / Group Policy

ADMX/ADML templates: docs/nexuslink.admx, docs/nexuslink.adml
Registry policy example: docs/nexuslink-policy.reg (HKLM\Software\Policies\NexusLink)
PowerShell helper: docs/nexuslink-policy.reg.ps1

Keys include managementURL, preSharedKey, disableUpdateSettings, disableProfiles, disableNetworks, allowServerSSH, wireguardPort, and more. The daemon reloads policies every minute.

Building the installers

The GitHub release workflow builds everything; to build locally on Windows:

# daemon / CLI
go build -ldflags "-s -w" -o nexuslink.exe .\client
# desktop UI (needs wails3, pnpm, a C toolchain)
cd client\ui; wails3 task build; cd ..\..
# NSIS installer (needs NSIS in PATH)
$env:APPVER="1.0.0"; makensis -DARCH=amd64 client\installer.nsis
# MSI (needs the WiX toolset v4)
$env:NEXUSLINK_VERSION="1.0.0"; wix build client\nexuslink.wxs -d ArchSuffix=amd64_v1 -d ProcessorArchitecture=x64

Installer metadata (product name, company, icon, banner, upgrade GUIDs) is in client/installer.nsis, client/nexuslink.wxs, client/ui/build/windows/info.json and client/ui/build/windows/msix/. Sign the binaries and installers with your code-signing certificate before distribution (signtool sign /fd SHA256 /tr <timestamp-url> ...).