From ef6cdd8e2243a0e9c18bd15f37242b887837347d Mon Sep 17 00:00:00 2001 From: SebastianStork Date: Tue, 6 Jan 2026 21:33:46 +0100 Subject: [PATCH 1/2] nebula: Roll out to all hosts --- hosts/vps-monitor/default.nix | 16 +++++++++++++--- hosts/vps-monitor/keys/nebula.crt | 6 ++++++ hosts/vps-monitor/keys/nebula.pub | 3 +++ hosts/vps-monitor/secrets.json | 7 +++++-- hosts/vps-public/default.nix | 7 +++++++ hosts/vps-public/keys/nebula.crt | 6 ++++++ hosts/vps-public/keys/nebula.pub | 3 +++ hosts/vps-public/secrets.json | 7 +++++-- 8 files changed, 48 insertions(+), 7 deletions(-) create mode 100644 hosts/vps-monitor/keys/nebula.crt create mode 100644 hosts/vps-monitor/keys/nebula.pub create mode 100644 hosts/vps-public/keys/nebula.crt create mode 100644 hosts/vps-public/keys/nebula.pub diff --git a/hosts/vps-monitor/default.nix b/hosts/vps-monitor/default.nix index 0ffdcb4..edf2c85 100644 --- a/hosts/vps-monitor/default.nix +++ b/hosts/vps-monitor/default.nix @@ -20,9 +20,19 @@ boot.loader.grub.enable = true; - services.tailscale = { - enable = true; - ssh.enable = true; + services = { + tailscale = { + enable = true; + ssh.enable = true; + }; + + nebula.node = { + enable = true; + address = "10.254.250.5"; + routableAddress = "188.245.223.145"; + isLighthouse = true; + isServer = true; + }; }; web-services = diff --git a/hosts/vps-monitor/keys/nebula.crt b/hosts/vps-monitor/keys/nebula.crt new file mode 100644 index 0000000..e57c730 --- /dev/null +++ b/hosts/vps-monitor/keys/nebula.crt @@ -0,0 +1,6 @@ +-----BEGIN NEBULA CERTIFICATE V2----- +MIGqoESAC3Zwcy1tb25pdG9yoQcEBQr++gUYhQRpWTmKhgRrKH30hyAVQ/4ZW6re +1yzFagxOA4SEMyUQWl7UCMJuYEUyO3NFaIIgEsH4GM7MoMHRA9Ua4racnsVImNb4 +0fhIMdlx2Y8Gx3iDQJo2nQl5Atwka8UCU3FteaMSrgSxQW6HhBE7pwYMhlWdrusn +KUloRoe8tDpEWEO3qc+iQsgpr5Tuo27QUD77igs= +-----END NEBULA CERTIFICATE V2----- diff --git a/hosts/vps-monitor/keys/nebula.pub b/hosts/vps-monitor/keys/nebula.pub new file mode 100644 index 0000000..2dd60a6 --- /dev/null +++ b/hosts/vps-monitor/keys/nebula.pub @@ -0,0 +1,3 @@ +-----BEGIN NEBULA X25519 PUBLIC KEY----- +EsH4GM7MoMHRA9Ua4racnsVImNb40fhIMdlx2Y8Gx3g= +-----END NEBULA X25519 PUBLIC KEY----- diff --git a/hosts/vps-monitor/secrets.json b/hosts/vps-monitor/secrets.json index eca0fd8..1d0ce79 100644 --- a/hosts/vps-monitor/secrets.json +++ b/hosts/vps-monitor/secrets.json @@ -10,6 +10,9 @@ "grafana": { "admin-password": "ENC[AES256_GCM,data:2YRh4DT+1w5W/X3ELIe3Uu2EnMIHG4gUhV5ri6E=,iv:owHyuoupNQO09aRBgU2phIwxg22U1rUqKyYbw2193m4=,tag:dopVQwf4Ewf+lsFterfDOA==,type:str]" }, + "nebula": { + "host-key": "ENC[AES256_GCM,data:usSLqYOvDAAs7z1xo+gccDqgUE78upK+k522ldKcPoFKKBH87Us7gi6+XAOMDQ79U6i8j4l1lAE8kRdqDuvasodESHVSW9gSnnv5E73MVr0d1Snh7tAewVzneac+2R2R8tUzKzwzWM5SyyvJSoKGBg8WmGzdGT8UqC623utlYQ==,iv:NoZ2u8IK4g1Kwb6uZZ1jXJH4eFO9Jj5Phi5hPM4K72o=,tag:9mOv6oSESH+8r2ZC4yUE+w==,type:str]" + }, "sops": { "age": [ { @@ -21,8 +24,8 @@ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTVmV4dkZEaWVDNHMxUFdr\nYnhuVWpReXBNSEhhZkltQTE4bEpzSlBzL0VJCk15UFlwa0haWTZNaE1DVzVZVFBI\nd0QzcUptYmQ3dmhhdjhFV0xDSWdmMGMKLS0tIFhWamx6SXJleFFSVUFkRmw2VFZy\nOVVhNm9NSE0yRGFMQjNrM1B6cDVxSXMKrhAkDcWqutgSmQI5O+5i8fcwuTh2/XKr\nljK/Vn8EvGr8qEUeHzOBI1b5VtgngJkVJyfM9G/Q0lZvQF7ZZ5YCgQ==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2025-12-09T12:25:24Z", - "mac": "ENC[AES256_GCM,data:RlXJ6lSCzVKpmcSWuCCFKZLG5O6ltPq4yA7nZeWiFYJBJ9gIhVM/fLfqOk2a+msWDg5WDYXCyfARPhKzH6AnS0kK+yqdkytGklQUKLlBuWvswuiWycvShc+04hClpyn/76nTK6yQeXeYK+b807uc5PJHGnBweEteBLShFbSTfIY=,iv:FtYfeckV45KtgYp+V1ZSupV26gYEm3T3Vi/RovDWlAo=,tag:k1clC/bsLC1FCLuaB6ypMg==,type:str]", + "lastmodified": "2026-01-03T15:47:25Z", + "mac": "ENC[AES256_GCM,data:fEtJdI0I7Tiv21n30ZcxMdOsf4emevkouRmMW+100GEY19rL/VtAIXkvaaygdz/sGXXzLeANReLjo5Ryp93x8854eravT4nQ8IXpNlCgdBXmq7QgUD/nc5kaOj0//3neAxE+ht5MPWm+AbfO4kYDKTmF9GFoLRZMfyvrWXTVv4M=,iv:h4RUkWkr6PABpj0yp+YRhgJ/0X6kwpMyB30qVMbO2to=,tag:8a+w96TwPXk15GZdryWneQ==,type:str]", "unencrypted_suffix": "_unencrypted", "version": "3.11.0" } diff --git a/hosts/vps-public/default.nix b/hosts/vps-public/default.nix index 8270e46..ceb6364 100644 --- a/hosts/vps-public/default.nix +++ b/hosts/vps-public/default.nix @@ -26,6 +26,13 @@ ssh.enable = true; }; + nebula.node = { + enable = true; + address = "10.254.250.4"; + routableAddress = "167.235.73.246"; + isServer = true; + }; + crowdsec = { enable = true; bouncers.firewall = true; diff --git a/hosts/vps-public/keys/nebula.crt b/hosts/vps-public/keys/nebula.crt new file mode 100644 index 0000000..4ab0405 --- /dev/null +++ b/hosts/vps-public/keys/nebula.crt @@ -0,0 +1,6 @@ +-----BEGIN NEBULA CERTIFICATE V2----- +MIGpoEOACnZwcy1wdWJsaWOhBwQFCv76BBiFBGlZOWqGBGsoffSHIBVD/hlbqt7X +LMVqDE4DhIQzJRBaXtQIwm5gRTI7c0VogiB2ciqx2b7d1mUPRnrtM5sN+X4Pohtb +kBNPPFUDxwX7SoNAWUNPjR8iSib9C52wEmTzolYIvwbAUnOjMytH01xHUgPhiiTv +Cm4CTtS9vWllCCH682evxo+0I3+PKDRp8DKxCQ== +-----END NEBULA CERTIFICATE V2----- diff --git a/hosts/vps-public/keys/nebula.pub b/hosts/vps-public/keys/nebula.pub new file mode 100644 index 0000000..fd64141 --- /dev/null +++ b/hosts/vps-public/keys/nebula.pub @@ -0,0 +1,3 @@ +-----BEGIN NEBULA X25519 PUBLIC KEY----- +dnIqsdm+3dZlD0Z67TObDfl+D6IbW5ATTzxVA8cF+0o= +-----END NEBULA X25519 PUBLIC KEY----- diff --git a/hosts/vps-public/secrets.json b/hosts/vps-public/secrets.json index 93cf928..b5ceba2 100644 --- a/hosts/vps-public/secrets.json +++ b/hosts/vps-public/secrets.json @@ -20,6 +20,9 @@ "outline": { "gitlab-auth-secret": "ENC[AES256_GCM,data:fNxlI0sJdoY9hFxiJz4OdGLv1NyZbMchW/df5VuLBHqeQG19Seul0R1J0Fl+NBFfAAiyHA6oGzXerYLt6KsNDwFmK2ODuw==,iv:TfFyC+JUvb2GaeE8rh9Knj4fPkmoyWvymG9YAN/dpNA=,tag:PXn6uYXtFfV0N5+2fYyCZQ==,type:str]" }, + "nebula": { + "host-key": "ENC[AES256_GCM,data:oi5uWtflxt+LB9ft6DuH+h3owTF8bj9lNKVAVyyZH4Ww5F4tN+GhQDNXHSt4SK4M/9K/M7/VfRjcL0uDJq0SJmI1oy0g/pTF+JcBAV/Z6PAhPWBXxMBkIdL+xYLR5lXmBKnTTkHoIqvBZH7wDHq2kOKrBFU96yFfrMLK1TVv5Q==,iv:eau9vYEVwUjGTgESR2d2QNiBlTZIq5Do97/xZqmrz2c=,tag:aTdQ2vRxI/BByG02VvpPMw==,type:str]" + }, "sops": { "age": [ { @@ -31,8 +34,8 @@ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvVnphWlNaTUU0QytIdnEv\nQnNzelN4MUMreXZrME5KZStFMDg2V1VFd21rCkk2Uy9ITEF3SjlRVEdMMXlPdHhG\nam1PNnp3emtnMnczeFFSSStJaHF6TkkKLS0tIEJKbFRzbmNqMjk5NXVHZnhlWWZ3\nYng5L1F5YUJGOTg3TTJCK281SG9Id3MKsmH2yj19ig2g+KzBGLD9dWkdvr6TLdSd\nuuDC+frhj7wWrEomOOjIoYtWHXkUtTSAnCEZhrhfyupYhEvlFfWRlw==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2025-12-09T12:24:32Z", - "mac": "ENC[AES256_GCM,data:96b2vkoRYVIYR7kL8yOjZTG2tpjJyWBFBZ+qIwMsDHxSa3tUULQs+xKbW1gbc06LJMe97ZfKZYAFt2ExJ19Ftw/xJumbuDgX0f7tk7dkx5QrlsUyAGM8T5bOtZDAUAnkAgcJsIepdtTTSW8GsEmiAClynX08c00/jv3PEaF3IPs=,iv:9QAeA05iSP1NKVDa/Mu/hFJ07gDjZdNoVzvrYGT7rhc=,tag:0x/CI8c0F7RW7IANY8DdwA==,type:str]", + "lastmodified": "2026-01-03T15:48:23Z", + "mac": "ENC[AES256_GCM,data:p+WJViYWL4HFi7Us7RXJHVDFk8Q0HQ7I+dtV8XrIgBHELp19QTu6BmJ/7G/36Fe1H6h78SmwU3gOdSThDa77CmPlKlGG8aS6edLChJnCWeM0FBl61bvrCgZQwjVq/LZNMwJJIHiktDIPiIgNOwVvTzRCErrH6/UYjH0aGeyRI4g=,iv:6JE/7GAfIrLhRXUMVvFu4roON5zNgmQZY4vJJdgwcS8=,tag:xlDMg/vtqO5VFkbdbSBKxQ==,type:str]", "unencrypted_suffix": "_unencrypted", "version": "3.11.0" } From 9a101eeeac378ac9106a8b66c96bc5b82164cf78 Mon Sep 17 00:00:00 2001 From: SebastianStork Date: Tue, 6 Jan 2026 21:36:43 +0100 Subject: [PATCH 2/2] nebula: Reset logging level to info --- modules/system/services/nebula/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/system/services/nebula/default.nix b/modules/system/services/nebula/default.nix index 37aa9db..f8532e9 100644 --- a/modules/system/services/nebula/default.nix +++ b/modules/system/services/nebula/default.nix @@ -112,8 +112,7 @@ in settings = { pki.disconnect_invalid = true; cipher = "aes"; - logging.level = "warning"; - lighthouse.local_allow_list.interfaces.tailscale0 = false; + lighthouse.local_allow_list.interfaces.${config.services.tailscale.interfaceName} = false; }; };