fix: move unsafeRoutes to module default, genesis overrides to []

Per review feedback:
- nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}]
  so all regular nodes get home LAN routing automatically
- genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop)
- exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to
  nebula.enable = true only, relying on the new default

hosts/unstable/exodus/default.nix

@@ -32,12 +32,6 @@
     gnome.enable = true;
     nebula = {
       enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
     };
     podman.enable = true;
     print.enable = true;

hosts/unstable/genesis/default.nix

@@ -37,6 +37,9 @@ in
     gnome.enable = false;
     nebula = {
       enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
       # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
       # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
       routesSubnet = "10.42.0.0/16";

hosts/unstable/hosea/default.nix

@@ -49,15 +49,7 @@ in
 
   greg = {
     home = true;
-    nebula = {
+    nebula.enable = true;
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
     proxies = {
       "jellyfin.home".target = "http://localhost:8096/";
       "jellyfin.thehellings.lan".target = "http://localhost:8096/";

hosts/unstable/isaiah/default.nix

@@ -42,15 +42,7 @@
       vip = metadata.hosts.${config.networking.hostName}.ip;
       priority = 255;
     };
-    nebula = {
+    nebula.enable = true;
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
     podman.enable = true;
     tailscale = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -85,15 +85,7 @@ in
       vip = ip;
       priority = 254;
     };
-    nebula = {
+    nebula.enable = true;
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

hosts/unstable/zeke/default.nix

@@ -26,15 +26,7 @@
       vipInterface = "enp12s0";
       priority = 253;
     };
-    nebula = {
+    nebula.enable = true;
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
     remote-builder.enable = true;
     runner = {
       enable = true;

modules/nixos/nebula.nix

@@ -94,8 +94,19 @@ in
           };
         }
       );
-      default = [ ];
+      # Default: route the home LAN through genesis (the home router node).
-      description = "List of unsafe_routes to configure on this host (for reaching non-Nebula subnets)";
+      # Hosts that ARE genesis (or any other routing node) should override this to [].
+      default = [
+        {
+          route = "10.42.0.0/16";
+          via = "10.157.0.2"; # genesis's Nebula IP
+        }
+      ];
+      description = ''
+        List of unsafe_routes to configure on this host (for reaching non-Nebula subnets).
+        Defaults to routing the home LAN (10.42.0.0/16) through genesis (10.157.0.2).
+        Override to [] on hosts that are themselves a routing node (e.g. genesis).
+      '';
     };
 
     # Whether this host IS the router for an unsafe subnet