feat: add Nebula mesh network overlay

Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).

Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
  pointing to genesis to reach the home LAN

Changes:
- modules/nixos/nebula.nix: new greg.nebula module
  - isLighthouse / isRelay options
  - unsafeRoutes option (tun.unsafe_routes)
  - routesSubnet option: enables IP forwarding + nftables masquerade NAT
    on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
  - agenix secret reference per-host (secrets/nebula/<name>.key.age)
  - opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
  greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)

hosts/unstable/exodus/default.nix

@@ -30,6 +30,15 @@
   greg = {
     home = true;
     gnome.enable = true;
+    nebula = {
+      enable = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = "10.157.0.2"; # genesis
+        }
+      ];
+    };
     podman.enable = true;
     print.enable = true;
     tailscale = {

hosts/unstable/genesis/default.nix

@@ -35,6 +35,12 @@ in
   greg = {
     home = true;
     gnome.enable = false;
+    nebula = {
+      enable = true;
+      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
+      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
+      routesSubnet = "10.42.0.0/16";
+    };
     proxies = {
     };
   };

hosts/unstable/hosea/default.nix

@@ -49,6 +49,15 @@ in
 
   greg = {
     home = true;
+    nebula = {
+      enable = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = "10.157.0.2"; # genesis
+        }
+      ];
+    };
     proxies = {
       "jellyfin.home".target = "http://localhost:8096/";
       "jellyfin.thehellings.lan".target = "http://localhost:8096/";

hosts/unstable/isaiah/default.nix

@@ -42,6 +42,15 @@
       vip = metadata.hosts.${config.networking.hostName}.ip;
       priority = 255;
     };
+    nebula = {
+      enable = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = "10.157.0.2"; # genesis
+        }
+      ];
+    };
     podman.enable = true;
     tailscale = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -85,6 +85,15 @@ in
       vip = ip;
       priority = 254;
     };
+    nebula = {
+      enable = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = "10.157.0.2"; # genesis
+        }
+      ];
+    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

hosts/unstable/linode/default.nix

@@ -26,6 +26,10 @@
   greg = {
     home = false;
     linode.enable = true;
+    nebula = {
+      enable = true;
+      isLighthouse = true;
+    };
     proxies."immich.thehellings.com" = {
       genAliases = false;
       target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";

hosts/unstable/zeke/default.nix

@@ -26,6 +26,15 @@
       vipInterface = "enp12s0";
       priority = 253;
     };
+    nebula = {
+      enable = true;
+      unsafeRoutes = [
+        {
+          route = "10.42.0.0/16";
+          via = "10.157.0.2"; # genesis
+        }
+      ];
+    };
     remote-builder.enable = true;
     runner = {
       enable = true;