diff --git a/modules/nixos/services/nebula-lighthouse/default.nix b/modules/nixos/services/nebula-lighthouse/default.nix index 12e0839..566e2a0 100644 --- a/modules/nixos/services/nebula-lighthouse/default.nix +++ b/modules/nixos/services/nebula-lighthouse/default.nix @@ -18,6 +18,7 @@ let description = "nebula"; options = { }; moduleConfig = { + environment.systemPackages = with pkgs; [ nebula ]; services.nebula.networks = { jallen-nebula = { enable = true; diff --git a/modules/nixos/services/nebula-lighthouse/sops.nix b/modules/nixos/services/nebula-lighthouse/sops.nix index a99ff6e..27e2200 100644 --- a/modules/nixos/services/nebula-lighthouse/sops.nix +++ b/modules/nixos/services/nebula-lighthouse/sops.nix @@ -14,30 +14,30 @@ in sops = { secrets = { "pi4/nebula/ca-cert" = { - sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); - owner = "nebula-nas-nebula"; - group = "nebula-nas-nebula"; - restartUnits = [ "nebula@nas-nebula.service" ]; + sopsFile = (lib.snowfall.fs.get-file "secrets/pi4-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@jallen-nebula.service" ]; }; "pi4/nebula/ca-key" = { - sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); - owner = "nebula-nas-nebula"; - group = "nebula-nas-nebula"; - restartUnits = [ "nebula@nas-nebula.service" ]; + sopsFile = (lib.snowfall.fs.get-file "secrets/pi4-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@jallen-nebula.service" ]; }; "pi4/nebula/lighthouse-cert" = { - sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); - owner = "nebula-nas-nebula"; - group = "nebula-nas-nebula"; - restartUnits = [ "nebula@nas-nebula.service" ]; + sopsFile = (lib.snowfall.fs.get-file "secrets/pi4-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@jallen-nebula.service" ]; }; "pi4/nebula/lighthouse-key" = { - sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); - owner = "nebula-nas-nebula"; - group = "nebula-nas-nebula"; - restartUnits = [ "nebula@nas-nebula.service" ]; + sopsFile = (lib.snowfall.fs.get-file "secrets/pi4-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@v-nebula.service" ]; }; }; }; diff --git a/modules/nixos/services/nebula/default.nix b/modules/nixos/services/nebula/default.nix new file mode 100644 index 0000000..783d534 --- /dev/null +++ b/modules/nixos/services/nebula/default.nix @@ -0,0 +1,44 @@ +{ + config, + lib, + namespace, + ... +}: +with lib; +let + name = "nebula-lighthouse"; + cfg = config.${namespace}.services.${name}; + rootUrl = "https://lighthouse.${namespace}.dev/"; + ca = config.sops.secrets."jallen-nas/nebula/ca-cert".path; + cert = config.sops.secrets."jallen-nas/nebula/nas-cert".path; + key = config.sops.secrets."jallen-nas/nebula/nas-key".path; + + nebulaConfig = lib.${namespace}.mkModule { + inherit config name; + description = "nebula"; + options = { }; + moduleConfig = { + environment.systemPackages = with pkgs; [ nebula ]; + services.nebula.networks = { + jallen-nebula = { + enable = true; + enableReload = true; + isLighthouse = false; + isRelay = false; + ca = ca; + cert = cert; + key = key; + lighthouses = [ + "10.1.1.1" + ]; + }; + }; + }; + }; +in +{ + imports = [ + nebulaConfig + ./sops.nix + ]; +} diff --git a/modules/nixos/services/nebula/sops.nix b/modules/nixos/services/nebula/sops.nix new file mode 100644 index 0000000..71708c0 --- /dev/null +++ b/modules/nixos/services/nebula/sops.nix @@ -0,0 +1,45 @@ +{ + config, + lib, + namespace, + ... +}: +with lib; +let + cfg = config.${namespace}.services.nebula-lighthouse; +in +{ + + config = mkIf cfg.enable { + sops = { + secrets = { + "jallen-nas/nebula/ca-cert" = { + sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@jallen-nebula.service" ]; + }; + + "jallen-nas/nebula/ca-key" = { + sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@jallen-nebula.service" ]; + }; + + "jallen-nas/nebula/lighthouse-cert" = { + sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@jallen-nebula.service" ]; + }; + "jallen-nas/nebula/lighthouse-key" = { + sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); + owner = "nebula-jallen-nebula"; + group = "nebula-jallen-nebula"; + restartUnits = [ "nebula@jallen-nebula.service" ]; + }; + }; + }; + }; +} \ No newline at end of file diff --git a/secrets/nas-secrets.yaml b/secrets/nas-secrets.yaml index 5a208a9..88ad274 100644 --- a/secrets/nas-secrets.yaml +++ b/secrets/nas-secrets.yaml @@ -80,6 +80,9 @@ jallen-nas: ca-key: ENC[AES256_GCM,data:AldM5QTLWo7B4kC2wE4ShWUWiytVu/quPJHNSUGH21tfMrfXICPxlAx0nmyWXP42p6w3ZI54p+SiqAw2YhN1mZL4sZe5d7XYUB90nt9lTsmCZVe9u5s1mdbdlQTWhiSsolN8tG6CDCEj5dCC74Gi4K4U0XAB8w1KANGrMZ7s9GpEqtlUDdj2kbhLo6ZYTh28PAZiuMPf+DxiVyH84F8BtO930PBmx1eq19nli1lK,iv:xxNgIv5s0dRU/MQBeha45SwPz/lUbfI/sZat+32kLKY=,tag:alAm0f0Xcbz0HEuF8bcE8A==,type:str] lighthouse-cert: ENC[AES256_GCM,data:zo3kUEDxEJN42fit7GmdSRC6BOQUQBkd+bf7pC1hxdVyJ9Ws6+ZeJAiRTYxrSVIef49kUioXRhE7jYcX61pl0mpMO0HgVwjGSu0yAkED1AjBDI8btISIti2zeAU0jF3N2/IDdIZF/fLo5fw5dAplAv0kgtTyTr7IaNCeJivQgHfyc8IM57xmV/vqmJJ2COTIuwbQ/qClDG0k/0DvqY5Vlxq9aNiigryw68iLxVUWnPp+JmJczzFefkxUsVSyKW3goeOBTeo75ztcVEkapHMycEjabqlNTa011rb+dr8X1sonBomRc2b0e/mY3Ni6EDw0TEOKrXA7uQCIUrav0nog8YnB2O4kQ39wsjIDzuZzBmURKzz8jy3Jk28Qkk6zDn6tyPTDXAgEMPXpcxMa65Qhd5XiN8sBzc3vk+U=,iv:cTmQPMe3HBZ4WPakrblddKZAh4u4VYjgPF0X6tYDvmo=,tag:YFp9RSL9WjadWzOH4aMD1w==,type:str] lighthouse-key: ENC[AES256_GCM,data:YP7AkkPxDj1jctEziASe6D7gm/xscpPTwUJ/cOUfxXYq0euBmHP2twaZePOwohGbbEU4mzNYRAuQuF+5KzzbXfU89QixZ4XpMhACHgB02q71vDOFeX+gPQlzx+biL3TfbhVnZRRParyLJg9uqToa3P9csygacWCnH1A8FdY83g==,iv:PONNwnjIC+UNkZ1bCjJBeA7ic7IkkN96YJVYmao1SJ0=,tag:rO2Hnl/zizSliQVd8t6kNA==,type:str] + nas-pub: ENC[AES256_GCM,data:lZF4LJPDb2EmtDrKsOIrNENBCoEDAYzL8tF5mORGxCKEJXhXB5tnsn0DpzNSaxo+aTlW4AhrH6DdgdlhgAyMqlZRnTLcqc7yUT1zFWEerWvpm0IJJRvyjL4LK6HFuSczQNSwbCylPByvmLm1Tw++wp9RUmZpCxesSH1lgKA=,iv:CAVBEC/byHTpdkgoHzHMFgzCZLoBog2H826/L3Vq4Y0=,tag:s9wp5CjlyYHEKzy3m8+FJA==,type:str] + nas-key: ENC[AES256_GCM,data:QGW6jaXZKwFByIoWa0lJXUkIlHZaZEr58hkd+QpUkUUr8g2TEJkb0bAaNNEhhDS8YmQ7HejtgG+YFneji9C9BDPhIFIlM/GPiGzHggHMx3UfJU3ai78UL6sFlito21MhLKox758FIUNnVIa/8zGfLCymy0/eoe+rodX9J/h6cQ==,iv:HBXKoWLTo4usF6L4B1yA9EzM+qZTYfsHOus8nXwQO6w=,tag:BLfLrZKgD/gADwVngMZoqw==,type:str] + nas-cert: ENC[AES256_GCM,data:m/eLQPEGWfc8ajF6rHJyyZzuj0UqfnkD/+quDVsY9h55nTFVlky7GbQ2raohs31D8mH7O6AMFsgmkg1vnow7TAuCj06OGhnFHo+oqeqUFIYImfr8cGA+geJJ3dgthSStEzi+gxIKralmWGPVAzcW9DhJm4Y1Ot4mCJ3DRdAALXKjQkO8W7wVfDDSHKKFwwn/Sq4/fdoCanJlxFpLDTuKS4E/CrXC0ojYZJ7ePdx0B/idR4Xm5qxyaE1rysQ45zd9N1HVJlgXi2hHXUCzCxJ5jjx2dht52tkBa+OGWQTQiyXh1gXDhwW2xUkadaKYZ+vPo/VMgZxu44F95/AmuiLGmDumW9hhqlQ7teK897n+R/1HasrUA8Sjshs9Ok9JN/XiZvvO/TJVnEsxdnm5d6xTJ1XI8tHu1A==,iv:dWJIdRj1zWT4Xx0LIZfRENDZWVvDf2XrEizr9+sUr4Q=,tag:uIoLAcpZg1rVP7NYgEgi2A==,type:str] sops: shamir_threshold: 1 age: @@ -227,8 +230,8 @@ sops: L0gwQm5takNjMkVGNzVlSStJYlUwWDAKP8QA3rRUHYbyyhPC/k0Eq2EIKfjyc7Co 7BkHH3msC6h9g42BB5iIYe6KQ+UGxMQBFvp+qSB27jaIfajN5MP0BA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-13T18:10:02Z" - mac: ENC[AES256_GCM,data:jlpS9HHfFqZPUZGr+2pgun/zw5Yr6HRYO1VepqvZzQC1DUK3dBTFvkfJlmsUME52bPFZac/0zRRo85C6FGM0prm+G+aROQxJ1OdWgzK8CbULs7UpMdWxUJLlJT1N5ov7S0NB612D0a0SgI6kQQDIvQs5JaWMEjDlhLy/pTz5/zw=,iv:ZwultH7UxHzV7NosnqdFV1JMUd+e2ajBuOaBgxJdEms=,tag:4d7FPC/ba8A3L2vzYyGwRQ==,type:str] + lastmodified: "2026-02-13T19:37:06Z" + mac: ENC[AES256_GCM,data:kQKGHsXwGD/bswj5ZShjoKCmrjINjcDigxYe+DOwbI2xED6NTtYP5on+D40APlqDGE8VFSQekePpsy5KZxpqcdJjR1hY5c8Gin8OGysYnjM5repMhhbIkkL5hnTcwaobh4JN6eFFNJZvl2U6cuu3UR8bENdvAtsODq9X2GNVpfU=,iv:Q6lWs0aP9ktGqpcZi1G5QIW1w696zZsNKgLtDxKv19A=,tag:NTZthEXLOAA/KVeFswlKEA==,type:str] pgp: - created_at: "2026-02-06T15:34:30Z" enc: |- diff --git a/systems/x86_64-linux/jallen-nas/apps.nix b/systems/x86_64-linux/jallen-nas/apps.nix index 4fa3d30..0b68659 100755 --- a/systems/x86_64-linux/jallen-nas/apps.nix +++ b/systems/x86_64-linux/jallen-nas/apps.nix @@ -142,10 +142,10 @@ in }; minecraft = disabled; mongodb = disabled; - # nebula = { - # enable = true; - # port = 4242; - # }; + nebula = { + enable = true; + port = 4242; + }; netbootxyz = { enable = false; port = 4000;