prialo for Windows
==================

This archive contains the prialo CLI and daemon, plus the scripts that
install it as a Windows service (Windows 10 / Server 2016 or later, x64).

1. Extract the archive and open PowerShell as administrator in that folder.
   If the scripts are blocked ("not digitally signed"), run
   `Unblock-File .\install.ps1, .\uninstall.ps1` first, or start them with
   `powershell -ExecutionPolicy Bypass -File .\install.ps1 ...`.

2. Obtain a one-time enrolment key and the current control-plane SPKI pin
   from the owner of your Prialo network. The pin is deliberately not in
   this archive: an identity rotation would make a bundled pin stale.

3. Install and join (replace the values in angle brackets):

   $env:PRIALO_AUTH_KEY = '<ONE_TIME_KEY>'
   .\install.ps1 -Server control.example.com:50051 `
                 -Relay relay.example.com:4430 `
                 -TlsPin sha256:<CURRENT_64_HEX_SPKI_PIN> `
                 -Hostname <HOSTNAME>

   The script copies prialo.exe to "C:\Program Files\prialo", downloads and
   verifies the signed Wintun driver (pass -WintunZip <file> on a machine
   without Internet access), registers the "prialo" service with automatic
   start and restart on failure, opens UDP 41641 for prialo.exe in Windows
   Firewall (-NoFirewallRule to skip; -Port to change it) and starts the
   service. The enrolment key is stored under C:\ProgramData\prialo,
   readable by administrators only.

4. Check the connection (no elevation needed for the account that ran the
   install; administrators are always allowed):

   & 'C:\Program Files\prialo\prialo.exe' status
   & 'C:\Program Files\prialo\prialo.exe' peers

   Logs: C:\ProgramData\prialo\logs\prialo.log and the Application event
   log, source "prialo". Service state: Get-Service prialo.

5. Remove it with .\uninstall.ps1 (add -Purge to forget the node identity).

The binaries in this archive are not code-signed yet: SmartScreen shows an
"unrecognised app" warning and Defender may inspect prialo.exe on first run.
Check the SHA-256 in checksums.txt against the release page before running.

Never omit or disable TLS pin verification. If the daemon reports a pin
mismatch, the control server's identity changed: find out why before
re-pinning.
