Per review feedback:
- nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}]
so all regular nodes get home LAN routing automatically
- genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop)
- exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to
nebula.enable = true only, relying on the new default
exodus/default.nix — Removed the explicit unsafeRoutes block. The module now defaults to [{ route = "10.42.0.0/16"; via = "10.157.0.2"; }] so all regular nodes get home LAN routing automatically.
genesis/default.nix — Added unsafeRoutes = []; override. Since genesis IS the routing node it should not try to route through itself.
Also cleaned up the identical explicit unsafeRoutes blocks from hosea, isaiah, jeremiah, and zeke — they all now rely on the module default.
Note: kept the via hardcoded to 10.157.0.2 in the default rather than referencing cfg.lighthouseNebulaIp, since cross-option references in NixOS module defaults can cause evaluation issues.
Addressed both review comments in commit 84e4c68:
**exodus/default.nix** — Removed the explicit `unsafeRoutes` block. The module now defaults to `[{ route = "10.42.0.0/16"; via = "10.157.0.2"; }]` so all regular nodes get home LAN routing automatically.
**genesis/default.nix** — Added `unsafeRoutes = [];` override. Since genesis IS the routing node it should not try to route through itself.
Also cleaned up the identical explicit `unsafeRoutes` blocks from hosea, isaiah, jeremiah, and zeke — they all now rely on the module default.
Note: kept the `via` hardcoded to `10.157.0.2` in the default rather than referencing `cfg.lighthouseNebulaIp`, since cross-option references in NixOS module defaults can cause evaluation issues.
exodus: Removed the explicit unsafeRoutes block — module now defaults to [{ route = "10.42.0.0/16"; via = "10.157.0.2"; }] so all regular nodes get home LAN routing automatically.
genesis: Added unsafeRoutes = []; override — since genesis IS the routing node it must not try to route through itself.
Also cleaned up hosea, isaiah, jeremiah, and zeke — they all had the identical explicit block and now just use nebula.enable = true;.
Addressed both review comments in commit 84e4c68:
- **exodus**: Removed the explicit `unsafeRoutes` block — module now defaults to `[{ route = "10.42.0.0/16"; via = "10.157.0.2"; }]` so all regular nodes get home LAN routing automatically.
- **genesis**: Added `unsafeRoutes = [];` override — since genesis IS the routing node it must not try to route through itself.
Also cleaned up hosea, isaiah, jeremiah, and zeke — they all had the identical explicit block and now just use `nebula.enable = true;`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
greg
Summary
Adds a
greg.nebulaNixOS module and enables Nebula on all managed hosts for anebula.thehellings.comoverlay network.CIDR:
10.157.0.0/16Architecture
unsafe_routes (home LAN access)
Genesis has
routesSubnet = "10.42.0.0/16"which:net.ipv4.ip_forward10.42.0.0/16-subnets 10.42.0.0/16(see README)All other hosts get
unsafeRoutespointing at genesis (10.157.0.2) for the same subnet.Files Changed
modules/nixos/nebula.nix— new shared modulemodules/nixos/default.nix— import nebula.nixhosts/unstable/*/default.nix— enable greg.nebula on all hostsnetwork.json— addnebulaIpfield per hostsecrets/secrets.nix— declarenebula/*.key.ageentriessecrets/nebula/README.md— PKI bootstrap guideBefore Deploying
secrets/nebula/README.mdlinode.nebula.thehellings.com→ linodes public IPcolmena apply --on linodefirst, then fleet-wideIntroduces a greg.nebula NixOS module and enables it across all managed hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16). Architecture: - linode: lighthouse + relay (public internet, UDP 4242) - genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN) - hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes pointing to genesis to reach the home LAN Changes: - modules/nixos/nebula.nix: new greg.nebula module - isLighthouse / isRelay options - unsafeRoutes option (tun.unsafe_routes) - routesSubnet option: enables IP forwarding + nftables masquerade NAT on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16 - agenix secret reference per-host (secrets/nebula/<name>.key.age) - opens UDP/4242 in the firewall - modules/nixos/default.nix: import nebula.nix - hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true - hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16" - hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix: greg.nebula.enable = true with unsafeRoutes via genesis - network.json: add nebulaIp field for each managed host - secrets/secrets.nix: declare nebula/<host>.key.age entries - secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)Update your local copy of the branch, because I have pushed the secrets into the repository. Then follow the instructions in this review.
@@ -32,1 +32,4 @@gnome.enable = true;nebula = {enable = true;unsafeRoutes = [Move this to be a default value in the module.
@@ -38,0 +39,4 @@enable = true;# genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.# Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).routesSubnet = "10.42.0.0/16";Override the default value of unsafeRoutes here, because this node is the routing node.
Nope
Per review feedback: - nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}] so all regular nodes get home LAN routing automatically - genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop) - exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to nebula.enable = true only, relying on the new defaultAddressed both review comments in commit
84e4c68:exodus/default.nix — Removed the explicit
unsafeRoutesblock. The module now defaults to[{ route = "10.42.0.0/16"; via = "10.157.0.2"; }]so all regular nodes get home LAN routing automatically.genesis/default.nix — Added
unsafeRoutes = [];override. Since genesis IS the routing node it should not try to route through itself.Also cleaned up the identical explicit
unsafeRoutesblocks from hosea, isaiah, jeremiah, and zeke — they all now rely on the module default.Note: kept the
viahardcoded to10.157.0.2in the default rather than referencingcfg.lighthouseNebulaIp, since cross-option references in NixOS module defaults can cause evaluation issues.Addressed both review comments in commit
84e4c68:unsafeRoutesblock — module now defaults to[{ route = "10.42.0.0/16"; via = "10.157.0.2"; }]so all regular nodes get home LAN routing automatically.unsafeRoutes = [];override — since genesis IS the routing node it must not try to route through itself.Also cleaned up hosea, isaiah, jeremiah, and zeke — they all had the identical explicit block and now just use
nebula.enable = true;.