diff --git a/flake.nix b/flake.nix
index 9eee756..c7c74cd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -101,7 +101,7 @@
                 {
                   deployment = {
                     inherit (v) tags;
-                    targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
+                    targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
                     targetUser = "greg";
                   };
                 }
diff --git a/hosts/unstable/genesis/networking.nix b/hosts/unstable/genesis/networking.nix
index bb63560..164fc8a 100644
--- a/hosts/unstable/genesis/networking.nix
+++ b/hosts/unstable/genesis/networking.nix
@@ -77,7 +77,7 @@ in
       };
     };
     firewall = {
-      enable = false;
+      enable = true;
       allowedUDPPorts = [
         dhcpPort
         dnsPort
@@ -88,7 +88,7 @@ in
         80
       ];
     };
-    nftables.enable = false;
+    nftables.enable = true;
   };
 
   environment.etc."hosts.d/local".text = extraHosts;
diff --git a/hosts/unstable/isaiah/default.nix b/hosts/unstable/isaiah/default.nix
index 357164b..8b91034 100644
--- a/hosts/unstable/isaiah/default.nix
+++ b/hosts/unstable/isaiah/default.nix
@@ -47,6 +47,10 @@
       enable = true;
       extraLabels = [ "bare-metal:host" ];
     };
+    vmdev = {
+      enable = true;
+      host = "libvirt";
+    };
   };
 
   networking = {
diff --git a/hosts/unstable/linode/default.nix b/hosts/unstable/linode/default.nix
index 4bde507..c1da1f0 100644
--- a/hosts/unstable/linode/default.nix
+++ b/hosts/unstable/linode/default.nix
@@ -1,8 +1,9 @@
 {
+  config,
+  lib,
+  metadata,
   pkgs,
   pkgs',
-  lib,
-  config,
   ...
 }:
 
@@ -70,6 +71,12 @@ in
     nebula = {
       enable = true;
       isLighthouse = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = metadata.hosts.genesis.nebulaIp;
+        }
+      ];
     };
     tailscale.enable = true;
   };
@@ -126,7 +133,7 @@ in
             COOKIE_DOMAIN = "thehellings.com";
             SERVE_ROBOTS_TXT = true;
             SLOG_LEVEL = "DEBUG";
-            TARGET = "http://git.k3s.nebula.thehellings.com";
+            TARGET = "http://git.k3s.thehellings.lan";
           };
         };
       };
@@ -149,9 +156,9 @@ in
           bind *:${toString sshPort}
           timeout client 1h
           mode tcp
-          server git-isaiah isaiah.nebula.thehellings.com:32222
-          server git-jeremiah jeremiah.nebula.thehellings.com:32222
-          server git-zeke zeke.nebula.thehellings.com:32222
+          server git-isaiah isaiah.thehellings.lan:32222
+          server git-jeremiah jeremiah.thehellings.lan:32222
+          server git-zeke zeke.thehellings.lan:32222
 
         frontend https
           bind *:80
@@ -184,10 +191,10 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
-          http-request set-header Host git.k3s.nebula.thehellings.com
-          server git-isaiah isaiah.nebula.thehellings.com:80
-          server git-jeremiah jeremiah.nebula.thehellings.com:80
-          server git-zeke zeke.nebula.thehellings.com:80
+          http-request set-header Host git.k3s.thehellings.lan
+          server git-isaiah isaiah.thehellings.lan:80
+          server git-jeremiah jeremiah.thehellings.lan:80
+          server git-zeke zeke.thehellings.lan:80
 
         backend matrix
           mode http
@@ -195,10 +202,10 @@ in
           option accept-unsafe-violations-in-http-response
           retries 3
           option forwardfor
-          http-request set-header Host matrix.k3s.nebula.thehellings.com
-          server git-isaiah isaiah.nebula.thehellings.com:80
-          server git-jeremiah jeremiah.nebula.thehellings.com:80
-          server git-zeke zeke.nebula.thehellings.com:80
+          http-request set-header Host matrix.k3s.thehellings.lan
+          server git-isaiah isaiah.thehellings.lan:80
+          server git-jeremiah jeremiah.thehellings.lan:80
+          server git-zeke zeke.thehellings.lan:80
 
         backend web
           mode http
diff --git a/hosts/unstable/zeke/default.nix b/hosts/unstable/zeke/default.nix
index 0b9e329..7620d6f 100644
--- a/hosts/unstable/zeke/default.nix
+++ b/hosts/unstable/zeke/default.nix
@@ -32,6 +32,10 @@
       enable = true;
       tags = [ "home" ];
     };
+    vmdev = {
+      enable = true;
+      host = "vbox";
+    };
   };
 
   hardware = {
@@ -71,10 +75,4 @@
   users.users.greg.extraGroups = [
     "podman"
   ];
-
-  # virtualisation.virtualbox.host = {
-  #   enableExtensionPack = true;
-  #   headless = true;
-  #   enableWebService = true;
-  # };
 }
diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix
index 3669fac..82a63fa 100644
--- a/modules/nixos/kubernetes.nix
+++ b/modules/nixos/kubernetes.nix
@@ -15,8 +15,6 @@ let
     sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
   };
   keepaliveIp = "10.42.5.1";
-  nebulaName = "k3s.nebula.thehellings.com";
-  nebulaIp = "10.157.100.1";
 in
 {
   options.greg = {
@@ -46,13 +44,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.greg.nebula.enable;
-        message = "Configure Nebula for this host, first";
-      }
-    ];
-
     age.secrets = {
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
       dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -106,8 +97,6 @@ in
           "--tls-san ${config.networking.hostName}.thehellings.lan"
           "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
           "--tls-san ${keepaliveIp}"
-          "--tls-san ${nebulaName}"
-          "--tls-san ${nebulaIp}"
         ];
         manifests = {
           cert-manager.source = cert-manager;
@@ -139,21 +128,6 @@ in
               advert_int 1
             '';
           };
-          k3s-nebula = {
-            interface = "nebula0";
-            priority = 1;
-            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
-            virtualIps = [
-              {
-                addr = "${nebulaIp}/16";
-                dev = "nebula0";
-              }
-            ];
-            virtualRouterId = 78;
-            extraConfig = ''
-              advert_int 1
-            '';
-          };
         };
       };
       openiscsi = {
diff --git a/modules/nixos/vmdev.nix b/modules/nixos/vmdev.nix
index ebfa229..35fb4c1 100644
--- a/modules/nixos/vmdev.nix
+++ b/modules/nixos/vmdev.nix
@@ -23,6 +23,13 @@ with lib;
         type = types.str;
         description = "Kernel module type to install - amd, intel, etc";
       };
+      host = mkOption {
+        type = types.enum [
+          "libvirt"
+          "vbox"
+        ];
+        description = "Which VM hosting type to configure";
+      };
     };
   };
 
@@ -35,7 +42,6 @@ with lib;
       nixos-generators
       packer
       swtpm
-      virt-manager
       virtio-win
       xorriso
     ];
@@ -44,7 +50,7 @@ with lib;
 
     # Enable the virtualisation services
     virtualisation = {
-      libvirtd = {
+      libvirtd = mkIf (cfg.host == "libvirt") {
         enable = true;
         onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
         qemu = {
@@ -54,6 +60,11 @@ with lib;
           };
         };
       };
+      virtualbox.host = mkIf (cfg.host == "vbox") {
+        enable = true;
+        enableExtensionPack = true;
+        headless = true;
+      };
     };
 
     boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
diff --git a/network.json b/network.json
index 0463104..fdc3478 100644
--- a/network.json
+++ b/network.json
@@ -86,6 +86,7 @@
       "system": "aarch64-darwin"
     },
     "linode": {
+      "connectAddr": "thehellings.com",
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
       "ts": "100.109.86.8",
diff --git a/secrets/nebula/isaiah.crt b/secrets/nebula/isaiah.crt
index 21f0602..aa07232 100644
--- a/secrets/nebula/isaiah.crt
+++ b/secrets/nebula/isaiah.crt
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
-dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
-2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
-71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
+MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEanOBO4YEa668pYcgg4lMYGB2VakRFO6b
+K9vHSLzjZpuqhBVQ7MReOwUHQKyCIOhUElXVoqzDIo+rUThkf0fbW3HYgHSkp8So
+1V04tV51g0AXR6vPKFhC1rfiDtslbhxwBNYgiUrRDxcNiAYAQFCyjTijj2+tqxyD
+pwL29i7NlcW+QgBxmtiSf8UW06MbzOkF
 -----END NEBULA CERTIFICATE V2-----
diff --git a/secrets/nebula/jeremiah.crt b/secrets/nebula/jeremiah.crt
index 7e82195..3b857ea 100644
--- a/secrets/nebula/jeremiah.crt
+++ b/secrets/nebula/jeremiah.crt
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
-YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
-8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
-IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
+MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRqc4EPhgRrrrylhyCDiUxgYHZVqREU
+7psr28dIvONmm6qEFVDsxF47BQdArIIgEcrTTRT0HRNWO6hNoyFBkWLxwrK3DyKz
+ZypRbhcAQ0GDQNX6euu+o8qczoXIHt7hfpbVc57YvtYQZ1v350iiyNhM0I0oZsV9
+oVEBR9rg39/lsXjFX6UtC/H3RKo+arlhDQ4=
 -----END NEBULA CERTIFICATE V2-----
diff --git a/secrets/nebula/zeke.crt b/secrets/nebula/zeke.crt
index 9a78250..8563339 100644
--- a/secrets/nebula/zeke.crt
+++ b/secrets/nebula/zeke.crt
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
-qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
-jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
-DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
+MIGjoD2ABHpla2WhBwQFCp0ABhCFBGpzgSyGBGuuvKWHIIOJTGBgdlWpERTumyvb
+x0i842abqoQVUOzEXjsFB0CsgiD4WYoZNy8i9RwV1yC4RNHJufeOHnyMkvpfkEdy
+avE5Y4NAVS1PQZIausgi1JekcdvwJ/+G64bLjzjznKD72u4XJfl7WKaO1O+RYOf7
+/2YdsUCODDzoGjdEtrQVftiz8RxRBg==
 -----END NEBULA CERTIFICATE V2-----