fix: move unsafeRoutes to module default, genesis overrides to []

Per review feedback:
- nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}]
  so all regular nodes get home LAN routing automatically
- genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop)
- exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to
  nebula.enable = true only, relying on the new default

hosts/unstable/exodus/default.nix

@@ -32,12 +32,6 @@
     gnome.enable = true;
     nebula = {
       enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
     };
     podman.enable = true;
     print.enable = true;

hosts/unstable/genesis/default.nix

@@ -37,6 +37,9 @@ in
     gnome.enable = false;
     nebula = {
       enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
       # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
       # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
       routesSubnet = "10.42.0.0/16";

hosts/unstable/hosea/default.nix

@@ -49,15 +49,7 @@ in
 
   greg = {
     home = true;
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     proxies = {
       "jellyfin.home".target = "http://localhost:8096/";
       "jellyfin.thehellings.lan".target = "http://localhost:8096/";

hosts/unstable/isaiah/default.nix

@@ -42,15 +42,7 @@
       vip = metadata.hosts.${config.networking.hostName}.ip;
       priority = 255;
     };
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     podman.enable = true;
     tailscale = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -85,15 +85,7 @@ in
       vip = ip;
       priority = 254;
     };
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     tailscale = {
       enable = true;
       tags = [ "home" ];

hosts/unstable/zeke/default.nix

@@ -26,15 +26,7 @@
       vipInterface = "enp12s0";
       priority = 253;
     };
-    nebula = {
-      enable = true;
-      unsafeRoutes = [
-        {
-          route = "10.42.0.0/16";
-          via = "10.157.0.2"; # genesis
-        }
-      ];
-    };
+    nebula.enable = true;
     remote-builder.enable = true;
     runner = {
       enable = true;