Expand Nebula

* Add Nebula to Kubernetes node
* Update k3s nodes to support nebula keepalived
* Move external IPs to a separate structure

home/baseline/nushell/functions.nu

@@ -16,6 +16,38 @@ def nebulaIps [] {
     open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
 }
 
+def genNebulaCert [ --ips: string, --name: string ] {
+    let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
+    let private = $'~/SynologyDrive/nebula/($name).key' | path expand
+    let cert = $'/etc/nixos/secrets/nebula/($name).crt'
+    let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand
+    let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand
+
+    # Generate public key if there isn't one already
+    if ( not ($public | path exists) ) {
+        nebula-cert keygen -out-key $private -out-pub $public
+    }
+    # Clear old cert if there is one
+    if ( $cert | path exists) {
+        rm $cert
+    }
+
+    # Create and sign certs
+    (nebula-cert sign
+        -ca-crt $ca_cert
+        -ca-key $ca_key
+        -name $name
+        -networks $ips
+        -out-crt $cert
+        -in-pub $public
+    )
+
+    # Agenix update
+    cd /etc/nixos/secrets
+    cat $private | agenix -e $'nebula/($name).key.age'
+}
+
+
 def rebuild [ $target: string = "switch" ] {
     if (uname | get operating-system) == "Darwin" {
         sudo darwin-rebuild $target
@@ -39,7 +71,8 @@ def deploy [ $host: string, $build: string = "" ] {
     if $buildhost == "linode" or $buildhost == "genesis" {
         $buildhost = "isaiah"
     }
-    nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
+    colmena apply --on $host
+    #nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
 }
 
 def ff [ $file: string ] {

hosts/unstable/genesis/networking.nix

@@ -130,7 +130,7 @@ in
         lib.mapAttrs
           (domain: net: {
             master = true;
-            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
+            file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain;
           })
           {
             "shire-zebra.ts.net" = "tailscale";

modules/nixos/kubernetes.nix

@@ -15,6 +15,8 @@ let
     sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
   };
   keepaliveIp = "10.42.5.1";
+  nebulaName = "k3s.nebula.thehellings.com";
+  nebulaIp = "10.157.100.1";
 in
 {
   options.greg = {
@@ -44,6 +46,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.greg.nebula.enable;
+        message = "Configure Nebula for this host, first";
+      }
+    ];
+
     age.secrets = {
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
       dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -97,6 +106,8 @@ in
           "--tls-san ${config.networking.hostName}.thehellings.lan"
           "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
           "--tls-san ${keepaliveIp}"
+          "--tls-san ${nebulaName}"
+          "--tls-san ${nebulaIp}"
         ];
         manifests = {
           cert-manager.source = cert-manager;
@@ -112,20 +123,37 @@ in
       keepalived = {
         enable = true;
         openFirewall = true;
-        vrrpInstances.kubernetes = {
+        vrrpInstances = {
-          interface = cfg.vipInterface;
+          kubernetes = {
-          priority = cfg.priority;
+            interface = cfg.vipInterface;
-          state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            priority = cfg.priority;
-          virtualIps = [
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
-            {
+            virtualIps = [
-              addr = "${keepaliveIp}/16";
+              {
-              dev = cfg.vipInterface;
+                addr = "${keepaliveIp}/16";
-            }
+                dev = cfg.vipInterface;
-          ];
+              }
-          virtualRouterId = 77;
+            ];
-          extraConfig = ''
+            virtualRouterId = 77;
-            advert_int 1
+            extraConfig = ''
-          '';
+              advert_int 1
+            '';
+          };
+          k3s-nebula = {
+            interface = "nebula0";
+            priority = 1;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${nebulaIp}/16";
+                dev = "nebula0";
+              }
+            ];
+            virtualRouterId = 78;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
         };
       };
       openiscsi = {

network.json

@@ -13,13 +13,6 @@
       "ip": "10.42.1.17",
       "system": "x86_64-linux"
     },
-    "chronicles": {
-      "ip": "10.42.1.4",
-      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
-      "external": true,
-      "ts": "100.119.228.115",
-      "aliases": ["s3"]
-    },
     "exodus": {
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3",
@@ -35,15 +28,6 @@
       "tags": ["router", "server"],
       "nebulaIp": "10.157.0.2"
     },
-    "hermes": {
-      "external": true,
-      "ip": "10.42.1.18",
-      "mac": "BC:24:11:E4:72:AB",
-      "nebulaIp": "10.157.0.8",
-      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
-      "system": "x86_64-linux",
-      "tags": ["server"]
-    },
     "hosea": {
       "ip": "10.42.1.7",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
@@ -52,10 +36,6 @@
       "tags": ["server"],
       "nebulaIp": "10.157.0.3"
     },
-    "icdm-root": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
     "isaiah": {
       "builder": true,
       "ip": "10.42.1.6",
@@ -85,11 +65,6 @@
       "tags": ["builder", "kube", "server"],
       "nebulaIp": "10.157.0.5"
     },
-    "joel": {
-      "external": true,
-      "ip": "10.42.0.4",
-      "ts": null
-    },
     "gregs-MacBook-Pro-16-inch-Nov-2024": {
       "external": true,
       "system": "aarch64-darwin"
@@ -118,58 +93,10 @@
       "external": true,
       "system": "aarch64-darwin"
     },
-    "nas1": {
-      "aliases": [ "*.nas1" ],
-      "external": true,
-      "ip": "10.42.1.14",
-      "ts": "100.114.187.61"
-    },
     "nixos": {
       "external": true,
       "system": "x86_64-linux"
     },
-    "printer": {
-      "external": true,
-      "ip": "10.42.1.3"
-    },
-    "proxmoxtemplate": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
-    "pve2": {
-      "external": true,
-      "ip": "10.42.1.15",
-      "system": "x86_64-linux"
-    },
-    "pve2bmc": {
-      "derp": "10.42.2.129",
-      "external": true,
-      "mac": "00:25:90:4b:34:e8",
-      "ip": "10.42.6.2",
-      "system": "ipmi"
-    },
-    "pve3": {
-      "external": true,
-      "ip": "10.42.1.16",
-      "system": "x86_64-linux"
-    },
-    "pve3bmc": {
-      "derp": "10.42.2.181",
-      "external": true,
-      "ip": "10.42.6.3",
-      "mac": "00:25:90:4a:dc:2e",
-      "system": "ipmi"
-    },
-    "pve4": {
-      "external": true,
-      "ip": "10.42.1.17",
-      "system": "x86_64-linux"
-    },
-    "pve4bmc": {
-      "external": true,
-      "ip": "10.42.6.4",
-      "system": "ipmi"
-    },
     "wsl": {
       "external": true,
       "system": "aarch64-linux"
@@ -184,5 +111,55 @@
       "tags": ["builder", "kube", "server"],
       "nebulaIp": "10.157.0.6"
     }
+  },
+  "external": {
+    "chronicles": {
+      "ip": "10.42.1.4",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
+      "ts": "100.119.228.115",
+      "aliases": ["s3"]
+    },
+    "hermes": {
+      "ip": "10.42.1.18",
+      "mac": "BC:24:11:E4:72:AB",
+      "nebulaIp": "10.157.0.8",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
+      "tags": ["server"]
+    },
+    "joel": {
+      "ip": "10.42.0.4"
+    },
+    "k3s": {
+      "ip": "10.42.5.1",
+      "nebulaIp": "10.157.100.1"
+    },
+    "nas1": {
+      "aliases": [ "*.nas1" ],
+      "ip": "10.42.1.14",
+      "ts": "100.114.187.61"
+    },
+    "printer": {
+      "ip": "10.42.1.3"
+    },
+    "pve2": {
+      "ip": "10.42.1.15"
+    },
+    "pve2bmc": {
+      "ip": "10.42.6.2",
+      "mac": "00:25:90:4b:34:e8"
+    },
+    "pve3": {
+      "ip": "10.42.1.16"
+    },
+    "pve3bmc": {
+      "ip": "10.42.6.3",
+      "mac": "00:25:90:4a:dc:2e"
+    },
+    "pve4": {
+      "ip": "10.42.1.17"
+    },
+    "pve4bmc": {
+      "ip": "10.42.6.4"
+    }
   }
 }

secrets/nebula/isaiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEac2MaYYEa668pYcgg4lMYGB2VakRFO6b
+MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
-K9vHSLzjZpuqhBVQ7MReOwUHQKyCIBv+1Lr/E3Q6d99laLGdXRTss2SIL4OGBp8z
+dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
-qqfEsAMpg0CyDSEYuL8GaHQq708GbCxhxFifCZaRTB+ReGBScmhT9XhIwSLHRRZJ
+2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
-1TmoY4QvrdPOS3NAWvlawk/JUqN7SWQL
+71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/jeremiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRpzYxphgRrrrylhyCDiUxgYHZVqREU
+MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
-7psr28dIvONmm6qEFVDsxF47BQdArIIgHXr6BLGmqfF92GXiN6MBj3ac0p/EtNYf
+YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
-xR3/EdI5GnGDQIFxfV5fVwi26+IRk9QIFxyyFBtmsZyPbdxL8ca1WUPm3lCNA4BT
+8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
-Knd9Y3Zlp6L35L4/dzSqAVoXu2nlHF6SOAA=
+IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/zeke.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGjoD2ABHpla2WhBwQFCp0ABhCFBGnNjGmGBGuuvKWHIIOJTGBgdlWpERTumyvb
+MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
-x0i842abqoQVUOzEXjsFB0CsgiCirKKbej7yAALn41C+MYmertD9LOv09gZ61ODF
+qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
-wEcnB4NAfix/r3q+XLYe3egKUoqJUW2i11x0ST0hxqhJUd8LjHKirRyHsvUraMbG
+jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
-c8x+CXsCPLgheGt548PpmrObQWtrBA==
+DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/zeke.key.age

@@ -1,41 +1,35 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg 59/Hfejnlp8Qk6VTcVpsaB2su+p/LjxnXCI3+uoxeXs
+-> ssh-ed25519 8UnW5Q E8Ki3oFCl3dLp9gxZ7/Ene8NMM26OVJ4PMJQQYQnBm0
-DW3LJMJ7nK3ySrDVrZTUhOCiDBujWh2ycGjpfMkddJw
+3rC3LMfdPCvSsiwaVnAb7VHwyw7KjZKcASdWm0lDg5E
--> ssh-ed25519 8UnW5Q 2ESBP1XYX71s9tlf1YC9lL+UmJPYjf5qiNNGUsEtnWU
+-> ssh-ed25519 UFfTmg 6q8nJbCIQe2IV/W/31OpuI6sZI833IbU+weSTU05Mng
-jWRnunZ2ub0QAvQaRznVGTIPIxHrzw8B620zFeZUx3Y
+EgiGZwIN0oRjw9pAaHjypWtswBA1c5PCkNeN9K4YlT8
--> ssh-ed25519 UFfTmg Vs0zDRmw2scS8exINo2lBO1x2UqVXEElWFtCnGwrzWI
+-> ssh-ed25519 xNtnoA cyxa8uxevJ9VEaYLg2g9rewcAMhsZRAPEkzqd9k6ngE
-SQM1l0GhHyDqzvykuyvR62XCeQPl/JaEttZJXFdvSFo
+SedkkmBd4foxqB1MlCAkfIqO6ft5xnmLBa2cShzw/GI
--> ssh-ed25519 KbVVUw WVNEfBAAEGP0O7vtL04/IaM9nCR57UJkTcT+96ZtaHQ
+-> ssh-ed25519 aY2AXA biY7lFtfvr6vBv/XBhZ6Uh7Hpj+Du0NuEjo2RMp6USI
-3m/lb1USu6Vng2+4IEfXsdNwF4NMuVjZ5H/1+QUX4Q8
+5DgzmbEw5f6h4lHm7FlRZHXn4C9vCJ6IguXk7jZXxqM
--> ssh-ed25519 xNtnoA cWYQoTMQmxpFPDCsj8AGOqxx4ErhHnsMiOgJJvhjBCI
+-> ssh-ed25519 AQhf1g e3g+IdnzmuJZj3H4LWdbZ8yaj5GM21zz3HCgkzFG5Cg
-6GU/IeVZB1ECMAGYiL8tLPqgCuC2ujNcdSgzhOof7hI
+oyzAIsqnL9ypSOCHINMu/+VM9TJeqgY9jLumhmAFIu8
--> ssh-ed25519 aY2AXA n1f3kFHxIvt5CbiBq6Vs32zoZEeYC5aBAZz5lCUEuxI
+-> ssh-ed25519 mOmPfg o4pCs9ferfC6+OawWXsM5Wa/5q+4EN+lEg/diMrjVhQ
-OuFwQTJAdv2oMxzFbce6iqUa7SAu3aHMYU+D3L0gNbo
+H1gSB90UuJaivo2MhinPQGCV+rmSX1ZWazfhOxIDcaM
--> ssh-ed25519 AQhf1g hjjixHEYRom6XjHsIf2pMZvcMNxfeBw79+ApOheQezc
+-> ssh-ed25519 YJiRbw o33TjJkI7rc1DxXRMdgwoHfCqzU3sGd7BZo7Uw0I8iA
-/HvBy+L5eaz9NAShIeNfagE8LzamzxolD5ZIdapiyPA
+/PiNDHyAl54HYszKkRzsjuoAZ53Ly1Oizf6NUIDB+I4
--> ssh-ed25519 mOmPfg JJQYaT1ch0i4xeMrCVCgzq25dy7GhqNCHGXTd3syHCI
+-> ssh-ed25519 Nl/5yA FUycbaA303kvgINg9eNM53lN6aUXQPBxWz9liuhZ6Vo
-4F+EQY7WbDJ8DwukaMelfYi9Q3LjYBpfhgCJVyXUtWI
+nNMPiq0w06WWfe73fpj/9ixunwgzZUCEi6pIKWuNWvQ
--> ssh-ed25519 YJiRbw eFi1X3pmVVmkCDl8Jr+lIv2LeuSbMg6WqrpezABmOR8
+-> ssh-ed25519 GdLgCQ sD2xKKzEyD7GsnFJCrDi40sJX0yBIXLr3pLx1R6RT1g
-2arsXH0pdYxINujCFonHrqwEDVr4qR5ugXix8uu+cOk
+ThDfA6T5/9cgAFKZPQtxGhKHdYOZx4sSQnoxzJMsLwc
--> ssh-ed25519 Nl/5yA ScYVPC1pyYkgweGi+hxQaXJ8UEnKta2VqbyHgSPTKCY
+-> ssh-ed25519 tOH/HQ YeQfSV5UxsYAMEIOq1FNpkNcM4LEA8zvcbOceZ/26ws
-CLiTEjJ6ylD3SlzrFHaz8yHaqc5KbCs3x3ij8Mgdnks
+KMeeyObeOBmqxS6hqhVbDgvoB5jUJr8k21igT3rqoww
--> ssh-ed25519 GdLgCQ TQHucvsozqInbmCsh1GHZ2JF5pbUteT/W3XieSIfmj4
+-> ssh-ed25519 FpzvfQ GbT7exaVbqJNP7LdV/wyye89yXuN6FI20j7ckx5r5nI
-Owq1wb9MdMD9pVJj24QCTvmkyh57Q2cKqfMRxj3ZFq4
+bNMqf7oY6NWVTPvVLOy+UpJKT0C9m6WunfdvMXCUZzk
--> ssh-ed25519 tOH/HQ KVKjt9GYmfcNOO7LTA1bypmtoYTYHgKWgD2dpD4zxUA
+-> ssh-ed25519 2UotMw Zpco9IYJXyl9wIZo22g/kp/OjfClOtUP2in+N0hYX3o
-VjlWDbSZp0NHC9VfRONz8UH2JtvIQWzqc7V/gJef/5A
+e68dEYPiNdlrSFaMTzvrhCz9/5V5zFAvrTnPtNSyI4c
--> ssh-ed25519 FpzvfQ gAlbAOE0Zz2A0391SyUKfLQDBt0+9HYPn54rG5HY/hM
+-> ssh-ed25519 kdPvzQ 2j64L6rV5b5+sbKbNAGf9+7uKLgdBpKNv9umHtSW4wY
-4t/wJ7L7yJvnFkdonsKTBFza+C7gXr8AI1PMEH58sO8
+3y74VGUzKb9uhh3DvlkvZ5Jxtgfku7s1kDKrGDWUUvk
--> ssh-ed25519 2UotMw rrb5P6bPLUibtQ8Pkz533mQe65XA4DZOyw7B3GV6oHg
+-> ssh-ed25519 onmXpg 8GDMsteOopCnaaVkXAoRMbGuXeKoSqpyZhLvbnEWBQU
-Xs9cK2GZ3k2FgrHjIeB4DTe3gdahFFvS892siiAyEvI
+X0HsZbpT4Wc/KO0TBwVSyjK6Zcbz1A34VCozNrMH4Lw
--> ssh-ed25519 kdPvzQ JTPJpaE97otqsADN017u6dw2h9DWlD2NkwIyT5+b8yo
+-> ssh-ed25519 CnhD0g uHIeQtUwcDRXdJpFglJ12ptOPP64yMP6WKPz00sAQ0c
-QroD7owHZ4ThrVDBTJO3/wn6PK8wfrOwypjbjTxGkSM
+yIKZNODIQSkNr4UilEHZzOBxeRA4G/sAbkppyOdUjkQ
--> ssh-ed25519 onmXpg QuQjNKosTocZ4y2KRvqMISezBbSll9ERKBTtKEVMIRs
+-> ssh-ed25519 4ep2UA k+cteVM7cMWQk7xDcCZgWlZxgA4ZBmUlbZHQFmMoi0Q
-R0mgBtM2iZ6lcBzGC5hDz5G06G5O8FM2C1Vll2NW/Ag
+YC2fptyb258arEdeOcPhCc3+z/vIgEElbqn2Ik3r2Lo
--> ssh-ed25519 CnhD0g tSMysXdWjfmoBkVXD/wCIUEikjH7jiuEFlmrbfjIkmE
+--- NJ2uO0A/UbPrw+IgObiiXTwV75xgsWTjYvLpTwznDXM
-xrkP8nl1nE+LvHA0vb1rOnQKNR/SB+KaqYBvJHDa3fs
+³B Ð-ø�`8nß=m5/s”zǼmÚÝØ
ˆ‚Sþ”ÖÍÆ œ¿Âõ&_¤WÛRpõß²“�=iG’FyÃEíІ¹¥èIñq:ö|-~$ò>ûÄbv~l­eè/ñd•V Ùˆq”ªÐ¾±¶
˜Â€ƒ•‰5¯ÝýŠÏ‚é|¸‘JÅí␍´£_£°l¯¬ñZ2°rìPÞ—p½‚.
--> ssh-ed25519 4ep2UA o1Vut8uttNV4+3DuZ67gURlGdnRittoON/xPE05i838
-03mFKfz89r0EKnY4tRL1zd9jKarZFW9TdX9nvvgAOTU
---- At7cFNjOg5E5WlaySJtqRZoK2/Gu+sXMI/cITd1SOKA
-〹Ýäöß6v’z³ªâ0{ŸÝšj& �úöw®ÂmÝeªEþ�ÒæÔ,|
-_ŽaÍDóº#qó]Lõã"íW ê(Ѷʹw¾µ¦˜ÕmÂÖ]O#
-T ô†•kÉ—gÜòrá]Þf¡T©_·‚Æö'¿•wÜ;Àƒ!N\¹¤¿g!TcØbê…7ëæïXmãLxã®þ‘ð