fix: merge conflict — keep both nebula.enable and buildbot proxies

hosts/unstable/exodus/default.nix

@@ -30,6 +30,9 @@
   greg = {
     home = true;
     gnome.enable = true;
+    nebula = {
+      enable = true;
+    };
     podman.enable = true;
     print.enable = true;
     tailscale = {

hosts/unstable/genesis/default.nix

@@ -35,6 +35,15 @@ in
   greg = {
     home = true;
     gnome.enable = false;
+    nebula = {
+      enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
+      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
+      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
+      routesSubnet = "10.42.0.0/16";
+    };
     proxies = {
     };
   };

hosts/unstable/hosea/default.nix

@@ -49,6 +49,7 @@ in
 
   greg = {
     home = true;
+    nebula.enable = true;
     proxies = {
       "jellyfin.home".target = "http://localhost:8096/";
       "jellyfin.thehellings.lan".target = "http://localhost:8096/";

hosts/unstable/isaiah/default.nix

@@ -42,6 +42,7 @@
       vip = metadata.hosts.${config.networking.hostName}.ip;
       priority = 255;
     };
+    nebula.enable = true;
     podman.enable = true;
     tailscale = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -85,6 +85,7 @@ in
       vip = ip;
       priority = 254;
     };
+    nebula.enable = true;
     proxies = {
       # Expose Buildbot over HTTP on the LAN so Klaatu (and other internal
       # tools) can reach it without Tailscale.  Buildbot's own Gitea OAuth

hosts/unstable/linode/default.nix

@@ -26,6 +26,10 @@
   greg = {
     home = false;
     linode.enable = true;
+    nebula = {
+      enable = true;
+      isLighthouse = true;
+    };
     proxies."immich.thehellings.com" = {
       genAliases = false;
       target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";

hosts/unstable/zeke/default.nix

@@ -26,6 +26,7 @@
       vipInterface = "enp12s0";
       priority = 253;
     };
+    nebula.enable = true;
     remote-builder.enable = true;
     runner = {
       enable = true;