From 84e4c68f0e96115ba9bc36999071d468d04c7d51 Mon Sep 17 00:00:00 2001
From: root <root@openclaw.thehellings.lan>
Date: Wed, 1 Apr 2026 16:45:59 -0500
Subject: [PATCH] fix: move unsafeRoutes to module default, genesis overrides
 to []

Per review feedback:
- nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}]
  so all regular nodes get home LAN routing automatically
- genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop)
- exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to
  nebula.enable = true only, relying on the new default
---
 hosts/unstable/exodus/default.nix   |  6 ------
 hosts/unstable/genesis/default.nix  |  3 +++
 hosts/unstable/hosea/default.nix    | 10 +---------
 hosts/unstable/isaiah/default.nix   | 10 +---------
 hosts/unstable/jeremiah/default.nix | 10 +---------
 hosts/unstable/zeke/default.nix     | 10 +---------
 modules/nixos/nebula.nix            | 15 +++++++++++++--
 7 files changed, 20 insertions(+), 44 deletions(-)

diff --git a/hosts/unstable/exodus/default.nix b/hosts/unstable/exodus/default.nix
index 900e6d4..84b6c00 100644
--- a/hosts/unstable/exodus/default.nix
+++ b/hosts/unstable/exodus/default.nix
@@ -32,12 +32,6 @@
     gnome.enable = true;
     nebula = {
       enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
     };
     podman.enable = true;
     print.enable = true;
diff --git a/hosts/unstable/genesis/default.nix b/hosts/unstable/genesis/default.nix
index dc3d9fb..767d156 100644
--- a/hosts/unstable/genesis/default.nix
+++ b/hosts/unstable/genesis/default.nix
@@ -37,6 +37,9 @@ in
     gnome.enable = false;
     nebula = {
       enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
       # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
       # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
       routesSubnet = "10.42.0.0/16";
diff --git a/hosts/unstable/hosea/default.nix b/hosts/unstable/hosea/default.nix
index 9cf088f..537be9c 100644
--- a/hosts/unstable/hosea/default.nix
+++ b/hosts/unstable/hosea/default.nix
@@ -49,15 +49,7 @@ in
 
   greg = {
     home = true;
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     proxies = {
       "jellyfin.home".target = "http://localhost:8096/";
       "jellyfin.thehellings.lan".target = "http://localhost:8096/";
diff --git a/hosts/unstable/isaiah/default.nix b/hosts/unstable/isaiah/default.nix
index 29ac835..c50e64d 100644
--- a/hosts/unstable/isaiah/default.nix
+++ b/hosts/unstable/isaiah/default.nix
@@ -42,15 +42,7 @@
       vip = metadata.hosts.${config.networking.hostName}.ip;
       priority = 255;
     };
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     podman.enable = true;
     tailscale = {
       enable = true;
diff --git a/hosts/unstable/jeremiah/default.nix b/hosts/unstable/jeremiah/default.nix
index a2380a3..48d79fe 100644
--- a/hosts/unstable/jeremiah/default.nix
+++ b/hosts/unstable/jeremiah/default.nix
@@ -85,15 +85,7 @@ in
       vip = ip;
       priority = 254;
     };
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     tailscale = {
       enable = true;
       tags = [ "home" ];
diff --git a/hosts/unstable/zeke/default.nix b/hosts/unstable/zeke/default.nix
index 5b94e3c..0ecfa6f 100644
--- a/hosts/unstable/zeke/default.nix
+++ b/hosts/unstable/zeke/default.nix
@@ -26,15 +26,7 @@
       vipInterface = "enp12s0";
       priority = 253;
     };
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     remote-builder.enable = true;
     runner = {
       enable = true;
diff --git a/modules/nixos/nebula.nix b/modules/nixos/nebula.nix
index 45fcd67..0c3e460 100644
--- a/modules/nixos/nebula.nix
+++ b/modules/nixos/nebula.nix
@@ -94,8 +94,19 @@ in
           };
         }
       );
-      default = [ ];
-      description = "List of unsafe_routes to configure on this host (for reaching non-Nebula subnets)";
+      # Default: route the home LAN through genesis (the home router node).
+      # Hosts that ARE genesis (or any other routing node) should override this to [].
+      default = [
+        {
+          route = "10.42.0.0/16";
+          via = "10.157.0.2"; # genesis's Nebula IP
+        }
+      ];
+      description = ''
+        List of unsafe_routes to configure on this host (for reaching non-Nebula subnets).
+        Defaults to routing the home LAN (10.42.0.0/16) through genesis (10.157.0.2).
+        Override to [] on hosts that are themselves a routing node (e.g. genesis).
+      '';
     };
 
     # Whether this host IS the router for an unsafe subnet