From 71ae25a58cb12cb28d8a41ea9972b03d617dbce7 Mon Sep 17 00:00:00 2001
From: root <root@openclaw.thehellings.lan>
Date: Wed, 1 Apr 2026 17:13:37 -0500
Subject: [PATCH] fix: move unsafe_routes to settings.tun.unsafe_routes
 (correct NixOS nebula option path)

---
 modules/nixos/nebula.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/nebula.nix b/modules/nixos/nebula.nix
index 5b398d2..135c517 100644
--- a/modules/nixos/nebula.nix
+++ b/modules/nixos/nebula.nix
@@ -162,10 +162,10 @@ in
       tun = {
         # Interface name
         device = "nebula0";
-        # unsafe_routes for hosts that need access to a non-Nebula subnet
-        unsafeRoutes = cfg.unsafeRoutes;
       };
 
+      settings.tun.unsafe_routes = map (r: { route = r.route; via = r.via; }) cfg.unsafeRoutes;
+
       # Firewall: permissive defaults — tighten per-host as desired
       firewall = {
         outbound = [