root
792217f640
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-exodus Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done.
buildbot/nix-build Build done.
Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).
Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
pointing to genesis to reach the home LAN
Changes:
- modules/nixos/nebula.nix: new greg.nebula module
- isLighthouse / isRelay options
- unsafeRoutes option (tun.unsafe_routes)
- routesSubnet option: enables IP forwarding + nftables masquerade NAT
on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
- agenix secret reference per-host (secrets/nebula/<name>.key.age)
- opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)
152 lines
3.5 KiB
JSON
152 lines
3.5 KiB
JSON
{
|
|
"infra": {
|
|
"dns": "10.42.1.5",
|
|
"gw": "10.42.1.1",
|
|
"netmask": "255.255.0.0",
|
|
"prefix": "16"
|
|
},
|
|
"hosts": {
|
|
"chronicles": {
|
|
"ip": "10.42.1.4",
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
|
|
"external": true,
|
|
"ts": "100.119.228.115"
|
|
},
|
|
"exodus": {
|
|
"ip": null,
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3",
|
|
"ts": "100.70.99.91",
|
|
"system": "x86_64-linux",
|
|
"nebulaIp": "10.157.0.7"
|
|
},
|
|
"genesis": {
|
|
"ip": "10.42.1.5",
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/CGE2rqlL2Qr0TJkwQMsHFSDkhGWlrUlvfcvcylO1n",
|
|
"ts": "100.96.198.104",
|
|
"system": "x86_64-linux",
|
|
"tags": [
|
|
"router",
|
|
"server"
|
|
],
|
|
"nebulaIp": "10.157.0.2"
|
|
},
|
|
"hosea": {
|
|
"ip": "10.42.1.7",
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
|
|
"ts": "100.68.203.1",
|
|
"system": "x86_64-linux",
|
|
"tags": [
|
|
"server"
|
|
],
|
|
"nebulaIp": "10.157.0.3"
|
|
},
|
|
"icdm-root": {
|
|
"external": true,
|
|
"system": "x86_64-linux"
|
|
},
|
|
"isaiah": {
|
|
"builder": true,
|
|
"ip": "10.42.1.6",
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf",
|
|
"ts": "100.84.183.79",
|
|
"system": "x86_64-linux",
|
|
"systems": [
|
|
"x86_64-linux",
|
|
"aarch64-linux"
|
|
],
|
|
"tags": [
|
|
"builder",
|
|
"kube",
|
|
"server"
|
|
],
|
|
"nebulaIp": "10.157.0.4"
|
|
},
|
|
"iso": {
|
|
"external": true,
|
|
"system": "x86_64-linux"
|
|
},
|
|
"ivr": {
|
|
"external": true,
|
|
"system": "aarch64-darwin"
|
|
},
|
|
"jeremiah": {
|
|
"builder": true,
|
|
"ip": "10.42.1.8",
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
|
|
"ts": "100.102.186.39",
|
|
"system": "x86_64-linux",
|
|
"systems": [
|
|
"x86_64-linux",
|
|
"aarch64-linux"
|
|
],
|
|
"tags": [
|
|
"builder",
|
|
"kube",
|
|
"server"
|
|
],
|
|
"nebulaIp": "10.157.0.5"
|
|
},
|
|
"joel": {
|
|
"external": true,
|
|
"ip": "10.42.0.4",
|
|
"ts": null
|
|
},
|
|
"linode": {
|
|
"ip": null,
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
|
|
"ts": "100.109.86.8",
|
|
"system": "x86_64-linux",
|
|
"tags": [
|
|
"public",
|
|
"server"
|
|
],
|
|
"nebulaIp": "10.157.0.1"
|
|
},
|
|
"MacBook-Pro.local": {
|
|
"external": true,
|
|
"system": "aarc64-darwin"
|
|
},
|
|
"MacBook-Prolocal.local": {
|
|
"external": true,
|
|
"system": "aarc64-darwin"
|
|
},
|
|
"nas1": {
|
|
"external": true,
|
|
"ip": "10.42.1.14",
|
|
"ts": "100.114.187.61"
|
|
},
|
|
"nixos": {
|
|
"external": true,
|
|
"system": "x86_64-linux"
|
|
},
|
|
"proxmoxtemplate": {
|
|
"external": true,
|
|
"system": "x86_64-linux"
|
|
},
|
|
"gitlab": {
|
|
"system": "x86_64-linux"
|
|
},
|
|
"wsl": {
|
|
"external": true,
|
|
"system": "aarch64-linux"
|
|
},
|
|
"zeke": {
|
|
"builder": true,
|
|
"ip": "10.42.1.13",
|
|
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0",
|
|
"ts": "100.90.74.19",
|
|
"system": "x86_64-linux",
|
|
"systems": [
|
|
"x86_64-linux",
|
|
"aarch64-linux"
|
|
],
|
|
"tags": [
|
|
"builder",
|
|
"kube",
|
|
"server"
|
|
],
|
|
"nebulaIp": "10.157.0.6"
|
|
}
|
|
}
|
|
}
|