nimmo/nixos-config

Watch

Fork 0

Add Nebula exit-node support to cert issuance and client bundle generation #47

New issue

Closed

opened 2026-07-04 20:52:14 +01:00 by nimmo · 1 comment

nimmo commented

2026-07-04 20:52:14 +01:00

Owner

Goal

Extend the Nebula tooling so selected hosts can be issued as route-serving gateways and selected clients can receive full-tunnel-ready configs without changing ordinary host behavior.

Context

The current host issuance flow signs only overlay networks, and the bundle generator always emits empty unsafe routes. To support a phone using Vega as a full-tunnel exit node, the tooling must support routed subnets on the gateway certificate and optional client unsafe-route generation.

Acceptance Checklist

Extend the host issuance/reissue flow so a host can be issued with routed subnets in addition to its overlay network.
Reissue Vega’s certificate with the routed subnet(s) needed for IPv4 exit-node use.
Extend the bundle generation flow so a client bundle can optionally include IPv4 full-tunnel unsafe routes via 10.10.0.2.
Include 10.10.0.2 as the DNS resolver in the full-tunnel client variant.
Preserve the current default behavior for ordinary hosts and ordinary client bundles.

Notes

Scope is IPv4 only.
If the mobile client does not accept a literal 0.0.0.0/0 entry, use the equivalent split default route pair.
Do not require changes on unrelated non-NixOS hosts.

Verification

Generate one normal client bundle and one full-tunnel client bundle and confirm the only intentional differences are the exit-node-related route and DNS settings.

## Goal Extend the Nebula tooling so selected hosts can be issued as route-serving gateways and selected clients can receive full-tunnel-ready configs without changing ordinary host behavior. ## Context The current host issuance flow signs only overlay networks, and the bundle generator always emits empty unsafe routes. To support a phone using Vega as a full-tunnel exit node, the tooling must support routed subnets on the gateway certificate and optional client unsafe-route generation. ## Acceptance Checklist - Extend the host issuance/reissue flow so a host can be issued with routed subnets in addition to its overlay network. - Reissue Vega’s certificate with the routed subnet(s) needed for IPv4 exit-node use. - Extend the bundle generation flow so a client bundle can optionally include IPv4 full-tunnel unsafe routes via 10.10.0.2. - Include 10.10.0.2 as the DNS resolver in the full-tunnel client variant. - Preserve the current default behavior for ordinary hosts and ordinary client bundles. ## Notes - Scope is IPv4 only. - If the mobile client does not accept a literal 0.0.0.0/0 entry, use the equivalent split default route pair. - Do not require changes on unrelated non-NixOS hosts. ## Verification Generate one normal client bundle and one full-tunnel client bundle and confirm the only intentional differences are the exit-node-related route and DNS settings.

nimmo added this to the Nebula Mesh Network milestone

2026-07-04 20:52:14 +01:00

nimmo added the

host:fleet

phase:module

project:nebula-mesh-network

labels

2026-07-04 20:52:14 +01:00

nimmo commented

2026-07-05 10:37:08 +01:00

Author

Owner

Completed and validated.

Cert issuance/reissue supports unsafe networks; Vega was issued for 0.0.0.0/1 and 128.0.0.0/1.
mobile-full-tunnel bundles emit the split default routes via 10.10.0.2 while standard bundles remain unchanged.
Mobile DNS is documented/configured as 10.10.0.2 (the Mobile Nebula app requires setting this resolver manually).
Client bundles now statically map only the public lighthouse so Vega is dynamically discovered off-LAN.

Relevant commits: 0b40f4e, 0c1bf45.

Completed and validated. - Cert issuance/reissue supports unsafe networks; Vega was issued for `0.0.0.0/1` and `128.0.0.0/1`. - `mobile-full-tunnel` bundles emit the split default routes via `10.10.0.2` while standard bundles remain unchanged. - Mobile DNS is documented/configured as `10.10.0.2` (the Mobile Nebula app requires setting this resolver manually). - Client bundles now statically map only the public lighthouse so Vega is dynamically discovered off-LAN. Relevant commits: `0b40f4e`, `0c1bf45`.

nimmo closed this issue

2026-07-05 10:37:13 +01:00

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

nimmo/nixos-config#47

No description provided.

Rows
Columns