fix: move unsafeRoutes to module default, genesis overrides to []

Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new default
2026-04-01 16:45:59 -05:00
parent 559155d411
commit 84e4c68f0e
7 changed files with 20 additions and 44 deletions
@@ -37,6 +37,9 @@ in
    gnome.enable = false;
    nebula = {
      enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
      routesSubnet = "10.42.0.0/16";