From 066a8e624f96a1dd7221b9324b205aee5a720f44 Mon Sep 17 00:00:00 2001
From: SebastianStork <git@sstork.dev>
Date: Thu, 5 Feb 2026 23:50:06 +0100
Subject: [PATCH] nebula: Fix malformed groups in the certificates

---
 hosts/desktop/keys/nebula.crt      |  8 ++++----
 hosts/laptop/keys/nebula.crt       |  8 ++++----
 hosts/vps-monitor/keys/nebula.crt  |  8 ++++----
 hosts/vps-private/keys/nebula.crt  | 10 +++++-----
 hosts/vps-public/keys/nebula.crt   |  8 ++++----
 scripts/nebula-regen-host-cert.nix |  2 +-
 6 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/hosts/desktop/keys/nebula.crt b/hosts/desktop/keys/nebula.crt
index 06a8387..862f271 100644
--- a/hosts/desktop/keys/nebula.crt
+++ b/hosts/desktop/keys/nebula.crt
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIG9oFeAB2Rlc2t0b3ChBwQFCv76ARijFQwHImNsaWVudAwKc3luY3RoaW5nIoUE
-aYUZ9YYEayh99IcgFUP+GVuq3tcsxWoMTgOEhDMlEFpe1AjCbmBFMjtzRWiCIBa4
-JtpDLPbLUD46tPX6YjZTYR1Ddfcc/MBKSNlD7MAbg0BGe2eiIAFhf0s/Gn54OfAV
-O1Pb2pvUUgg40MJS4+jTyltESru3sku3/obntXS46R8uSb17yAvSGbAtHkm6gfoM
+MIG7oFWAB2Rlc2t0b3ChBwQFCv76ARijEwwGY2xpZW50DAlzeW5jdGhpbmeFBGmF
+Hk6GBGsoffSHIBVD/hlbqt7XLMVqDE4DhIQzJRBaXtQIwm5gRTI7c0VogiAWuCba
+Qyz2y1A+OrT1+mI2U2EdQ3X3HPzASkjZQ+zAG4NAT5t62Hk0O6IlwmVM0e99G/s2
+GwO6Y2TXbl+g1T8eat4upiIftMkNdBJVgiDz7XbE4zgpfUuTv1LCzrNwipc6Cg==
 -----END NEBULA CERTIFICATE V2-----
diff --git a/hosts/laptop/keys/nebula.crt b/hosts/laptop/keys/nebula.crt
index 49bd696..31dfc61 100644
--- a/hosts/laptop/keys/nebula.crt
+++ b/hosts/laptop/keys/nebula.crt
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIG8oFaABmxhcHRvcKEHBAUK/voDGKMVDAciY2xpZW50DApzeW5jdGhpbmcihQRp
-hRn5hgRrKH30hyAVQ/4ZW6re1yzFagxOA4SEMyUQWl7UCMJuYEUyO3NFaIIgNCyM
-gP4M5eBJeQCSQjJJmql7yoPBz9FJ73+tSqgavTuDQNNN/BJUnq2BC7t8SwdZT3nE
-a2N9Ie2JK2TSCJbAaTv5mDQC/ObqSOsJfIX49oRtFmu1apVUcyYzAKq0W8sl3gE=
+MIG6oFSABmxhcHRvcKEHBAUK/voDGKMTDAZjbGllbnQMCXN5bmN0aGluZ4UEaYUe
+UoYEayh99IcgFUP+GVuq3tcsxWoMTgOEhDMlEFpe1AjCbmBFMjtzRWiCIDQsjID+
+DOXgSXkAkkIySZqpe8qDwc/RSe9/rUqoGr07g0DhbaORjxVBfwI9Un1woUJPv2lA
+7/0O5G29fhEGsyR7N4e4ZFeHPTbCXQYKVJIo0B6nM12kriUCTymrtjMJjjQB
 -----END NEBULA CERTIFICATE V2-----
diff --git a/hosts/vps-monitor/keys/nebula.crt b/hosts/vps-monitor/keys/nebula.crt
index de8ae11..f128706 100644
--- a/hosts/vps-monitor/keys/nebula.crt
+++ b/hosts/vps-monitor/keys/nebula.crt
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIG2oFCAC3Zwcy1tb25pdG9yoQcEBQr++gUYowoMCCJzZXJ2ZXIihQRphRn9hgRr
-KH30hyAVQ/4ZW6re1yzFagxOA4SEMyUQWl7UCMJuYEUyO3NFaIIgEsH4GM7MoMHR
-A9Ua4racnsVImNb40fhIMdlx2Y8Gx3iDQHJU+DbIPKSh5Uc9/SzKsM3LtUZ+Yt7a
-7gfQQJj3BgY0S5Ae3qa7Uo+zFTo6RtyJpefz4fJI4kS4kw2oUeB/1wo=
+MIG0oE6AC3Zwcy1tb25pdG9yoQcEBQr++gUYowgMBnNlcnZlcoUEaYUeVoYEayh9
+9IcgFUP+GVuq3tcsxWoMTgOEhDMlEFpe1AjCbmBFMjtzRWiCIBLB+BjOzKDB0QPV
+GuK2nJ7FSJjW+NH4SDHZcdmPBsd4g0Ctqv9hgMdJuXpKgy0HIU7eRhjMYDr22AUb
+e5nHcocsCe3mqPvHeTOPpluPeQcVXBnalFXwUHbpYmV/8pZFiNkI
 -----END NEBULA CERTIFICATE V2-----
diff --git a/hosts/vps-private/keys/nebula.crt b/hosts/vps-private/keys/nebula.crt
index 0fa05bb..84ee04a 100644
--- a/hosts/vps-private/keys/nebula.crt
+++ b/hosts/vps-private/keys/nebula.crt
@@ -1,7 +1,7 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIHBoFuAC3Zwcy1wcml2YXRloQcEBQr++gIYoxUMByJzZXJ2ZXIMCnN5bmN0aGlu
-ZyKFBGmFGgKGBGsoffSHIBVD/hlbqt7XLMVqDE4DhIQzJRBaXtQIwm5gRTI7c0Vo
-giDHF3BB7cImQSOE3qUHR1YI2qM26Dmgg30pBNNMKnR2C4NAs88H9BxfXXBirWag
-bF3+NXvxSKYrR1xR9Z4yBzl7JHXBRbkG4GJ29k4bL3dXrng1+yRnhZox3txUu2uR
-+46ABA==
+MIG/oFmAC3Zwcy1wcml2YXRloQcEBQr++gIYoxMMBnNlcnZlcgwJc3luY3RoaW5n
+hQRphR5bhgRrKH30hyAVQ/4ZW6re1yzFagxOA4SEMyUQWl7UCMJuYEUyO3NFaIIg
+xxdwQe3CJkEjhN6lB0dWCNqjNug5oIN9KQTTTCp0dguDQIfEL9VOzRXRvfIYqQIE
+N17rITJJXUIV0zV1JY/GF2xuxGYnwqRbdpbzjwWiZn3kBvj3j/q2jC9ciA3+nnoc
+iwE=
 -----END NEBULA CERTIFICATE V2-----
diff --git a/hosts/vps-public/keys/nebula.crt b/hosts/vps-public/keys/nebula.crt
index 483979b..4938c49 100644
--- a/hosts/vps-public/keys/nebula.crt
+++ b/hosts/vps-public/keys/nebula.crt
@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIG1oE+ACnZwcy1wdWJsaWOhBwQFCv76BBijCgwIInNlcnZlciKFBGmFGgaGBGso
-ffSHIBVD/hlbqt7XLMVqDE4DhIQzJRBaXtQIwm5gRTI7c0VogiB2ciqx2b7d1mUP
-RnrtM5sN+X4PohtbkBNPPFUDxwX7SoNAIM5yXTNoekP81KhalEV4A50WmAFINP0a
-EP5Xz4ajYTHuFy/ZOnaKLCCyyRW77mJunUkWdFas6W0GFJwTkbchDA==
+MIGzoE2ACnZwcy1wdWJsaWOhBwQFCv76BBijCAwGc2VydmVyhQRphR5fhgRrKH30
+hyAVQ/4ZW6re1yzFagxOA4SEMyUQWl7UCMJuYEUyO3NFaIIgdnIqsdm+3dZlD0Z6
+7TObDfl+D6IbW5ATTzxVA8cF+0qDQBE3+pZ54sbLravpoUt01ukqAsHAZ2kuQcrY
+DaZgtdjp1z0U7FkdqWAYlNeMVzjyXf4MQQJZH5ANu5tsofRtGw4=
 -----END NEBULA CERTIFICATE V2-----
diff --git a/scripts/nebula-regen-host-cert.nix b/scripts/nebula-regen-host-cert.nix
index 4510fd0..1dd03f4 100644
--- a/scripts/nebula-regen-host-cert.nix
+++ b/scripts/nebula-regen-host-cert.nix
@@ -15,7 +15,7 @@ pkgs.writeShellApplication {
 
     host="$1"
     address="$(nix eval --raw ".#nixosConfigurations.$host.config.custom.networking.overlay.cidr")"
-    groups="$(nix eval ".#nixosConfigurations.$host.config.custom.services.nebula.groups" --apply 'builtins.concatStringsSep ","')"
+    groups="$(nix eval --raw ".#nixosConfigurations.$host.config.custom.services.nebula.groups" --apply 'builtins.concatStringsSep ","')"
     ca_cert='modules/system/services/nebula/ca.crt'
     host_pub="$(nix eval --raw ".#nixosConfigurations.$host.config.custom.services.nebula.publicKeyPath")"
     host_cert="$(nix eval --raw ".#nixosConfigurations.$host.config.custom.services.nebula.certificatePath")"