chore: bring hermes into nebula

hosts/unstable/hermes/default.nix

@@ -9,9 +9,12 @@
     top.hermes.nixosModules.default
   ];
   greg = {
-    home = true;
-    tailscale.enable = true;
+    nebula = {
+      enable = true;
+      nebulaIp = "10.157.0.8";
     };
+  };
+  networking.hostName = "hermes";
   nix.settings = {
     sandbox = false;
   };

modules/nixos/home.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
@@ -18,35 +17,9 @@ with lib;
   };
 
   config = mkIf cfg {
-    age.secrets.attic.file = ../../secrets/attic.age;
     networking.domain = "thehellings.lan";
     time.timeZone = "America/Chicago";
 
-    systemd.services.attic-client = {
-      enable = true;
-      description = "Attic client watch-store service";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        Restart = "on-failure";
-        RestartSec = "5s";
-      };
-      preStart = ''
-        set -x
-        mkdir -p $XDG_CONFIG_HOME/attic
-        cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml
-      '';
-      script = "${pkgs.attic-client}/bin/attic watch-store --ignore-upstream-cache-filter default";
-      environment = {
-        XDG_CONFIG_HOME = "/var/lib/attic-client";
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      "d /var/lib/attic-client 0755 root root -"
-    ];
-
     # Open Prometheus exporter ports on LAN-connected hosts only.
     # NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode).
     networking.firewall.allowedTCPPorts = [

network.json

@@ -38,6 +38,7 @@
     "hermes": {
       "ip": "10.42.1.18",
       "mac": "BC:24:11:EF:3B:94",
+      "nebulaIp": "10.157.0.8",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
       "system": "x86_64-linux",
       "tags": ["server"]

secrets/nebula/hermes.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE V2-----
+MIGloD+ABmhlcm1lc6EHBAUKnQAIEIUEal/riYYEa668pYcgg4lMYGB2VakRFO6b
+K9vHSLzjZpuqhBVQ7MReOwUHQKyCIFCN4I/nO1jII+C/GwY6XVW89ddkng95yO4D
+awC9mMYng0DNzKvg2r/X1qyEBzEPu101iikgcSJeQ4X7xkA+UQo3dmXsAiZH6RSu
+ujn0TMZqZpwGP/7lUTcUEjqO7nh/o2kA
+-----END NEBULA CERTIFICATE V2-----

secrets/secrets.nix

@@ -121,6 +121,7 @@ in
   "nebula/linode.key.age".publicKeys = everyone;
   "nebula/zeke.key.age".publicKeys = everyone;
   "nebula/exodus.key.age".publicKeys = everyone;
+  "nebula/hermes.key.age".publicKeys = everyone;
 
   # Custom files
   "lithic/cargo-config.toml.age".publicKeys = everyone;