nimmo/nixos-config

Watch

Fork 0

feat(lena): Add Nebula mesh and SSH over overlay #75

Merged

nimmo merged 2 commits from lena-nebula into main

2026-07-19 20:16:37 +01:00

nimmo commented

2026-07-19 17:47:26 +01:00

Owner

Goal

Add Lena (Claire's Lenovo Ideapad 2-in-1) to the Nebula mesh and enable SSH over the overlay, matching how Electra is configured.

Changes

hosts/lena/default.nix: import modules/networking/nebula.nix, set nixosConfig.nebula = { enable = true; overlayIp = "10.10.0.21"; }, enable SSH (key-only, no root login) and allow port 22 on the nebula.mesh firewall interface
modules/networking/nebula.nix: add lena = "10.10.0.21" to the hostMap

Prerequisites (done out of band)

just nebula-add-host lena 10.10.0.21 has been run to issue the cert and store the key in SOPS — this is not part of this MR.

Deployment

On Lena: sudo nixos-rebuild switch --flake .#lena, then verify nebula@mesh is up and ssh nimmo@lena.mesh works from another mesh node.

Closes #73

## Goal Add Lena (Claire's Lenovo Ideapad 2-in-1) to the Nebula mesh and enable SSH over the overlay, matching how Electra is configured. ## Changes - `hosts/lena/default.nix`: import `modules/networking/nebula.nix`, set `nixosConfig.nebula = { enable = true; overlayIp = "10.10.0.21"; }`, enable SSH (key-only, no root login) and allow port 22 on the `nebula.mesh` firewall interface - `modules/networking/nebula.nix`: add `lena = "10.10.0.21"` to the hostMap ## Prerequisites (done out of band) `just nebula-add-host lena 10.10.0.21` has been run to issue the cert and store the key in SOPS — this is not part of this MR. ## Deployment On Lena: `sudo nixos-rebuild switch --flake .#lena`, then verify `nebula@mesh` is up and `ssh nimmo@lena.mesh` works from another mesh node. Closes #73

nimmo commented

2026-07-19 19:40:01 +01:00

Author

Owner

Review — changes requested

services.openssh.openFirewall = true opens TCP/22 in the global firewall, so SSH will be reachable on Lena’s LAN interfaces as well as nebula.mesh. The interface-specific rule does not limit that global rule.

Please remove openFirewall = true (it defaults to false) and keep networking.firewall.interfaces."nebula.mesh".allowedTCPPorts = [ 22 ];. I evaluated the proposed config: networking.firewall.allowedTCPPorts is currently [22], while the Nebula interface also permits [22]; after the change, only the latter should remain.

The Forgejo CI test check is otherwise green.

## Review — changes requested `services.openssh.openFirewall = true` opens TCP/22 in the global firewall, so SSH will be reachable on Lena’s LAN interfaces as well as `nebula.mesh`. The interface-specific rule does not limit that global rule. Please remove `openFirewall = true` (it defaults to false) and keep `networking.firewall.interfaces."nebula.mesh".allowedTCPPorts = [ 22 ];`. I evaluated the proposed config: `networking.firewall.allowedTCPPorts` is currently `[22]`, while the Nebula interface also permits `[22]`; after the change, only the latter should remain. The Forgejo CI test check is otherwise green.

nimmo commented

2026-07-19 19:42:38 +01:00

Author

Owner

Resolved in e0592b0: removed services.openssh.openFirewall, leaving TCP/22 allowed only on nebula.mesh. Local nix flake check passed.

Resolved in e0592b0: removed `services.openssh.openFirewall`, leaving TCP/22 allowed only on `nebula.mesh`. Local `nix flake check` passed.

nimmo force-pushed lena-nebula from e0592b0681

Build and Push Attic Cache / test (pull_request) Successful in 34s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

to af1cd5285d

Build and Push Attic Cache / test (pull_request) Successful in 34s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

2026-07-19 19:54:03 +01:00

Compare

nimmo force-pushed lena-nebula from af1cd5285d

Build and Push Attic Cache / test (pull_request) Successful in 34s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

to 5513e13471

Build and Push Attic Cache / test (pull_request) Successful in 34s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

2026-07-19 19:59:59 +01:00

Compare

nimmo referenced this pull request

2026-07-19 20:01:59 +01:00

fix(electra): restrict SSH to Nebula interface #76

nimmo added this to the Nebula Mesh Network milestone

2026-07-19 20:03:43 +01:00

nimmo commented

2026-07-19 20:06:52 +01:00

Author

Owner

Follow-up review — changes requested

The replacement nebula/certs/lena.crt changes Lena’s signed Nebula group from laptops to servers. hosts/lena/default.nix identifies Lena as a laptop, and the prior certificate carried laptops; this group change is therefore an unintended identity escalation/misclassification, even though the current Nebula rules are permissive.

The cause is consistent with the documented command: just nebula-add-host lena 10.10.0.21 uses the recipe’s default group, servers. Reissue it as just nebula-add-host lena 10.10.0.21 laptops (or an equivalent reissue preserving laptops) and update the encrypted key together with the certificate.

The earlier firewall fix remains correct: SSH is only opened on nebula.mesh. CI is green.

## Follow-up review — changes requested The replacement `nebula/certs/lena.crt` changes Lena’s signed Nebula group from `laptops` to `servers`. `hosts/lena/default.nix` identifies Lena as a laptop, and the prior certificate carried `laptops`; this group change is therefore an unintended identity escalation/misclassification, even though the current Nebula rules are permissive. The cause is consistent with the documented command: `just nebula-add-host lena 10.10.0.21` uses the recipe’s default group, `servers`. Reissue it as `just nebula-add-host lena 10.10.0.21 laptops` (or an equivalent reissue preserving `laptops`) and update the encrypted key together with the certificate. The earlier firewall fix remains correct: SSH is only opened on `nebula.mesh`. CI is green.

nimmo added 1 commit

2026-07-19 20:15:48 +01:00

Merge branch 'main' into lena-nebula

Build and Push Attic Cache / test (pull_request) Successful in 33s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

bdbe756054

nimmo merged commit ea958dd764 into main

2026-07-19 20:16:37 +01:00

nimmo referenced this pull request from a commit

2026-07-19 20:16:37 +01:00