From 8c439f897547c8c367d9259cfe4f801d1a6374ae Mon Sep 17 00:00:00 2001 From: bloominstrong Date: Wed, 22 Oct 2025 11:12:29 +0000 Subject: [PATCH 1/5] maintainers: add bloominstrong --- maintainers/maintainer-list.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 116365311242..5dfec171c9cd 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -3498,6 +3498,12 @@ githubId = 37768199; name = "Christian Bergschneider"; }; + bloominstrong = { + email = "github@mail.bloominstrong.net"; + github = "bloominstrong"; + githubId = 114744388; + name = "bloominstrong"; + }; bloveless = { email = "brennon.loveless@gmail.com"; github = "bloveless"; From d263b03d7e6b5900bfce1bc41a2117190fb4bf2b Mon Sep 17 00:00:00 2001 From: bloominstrong Date: Sat, 11 Oct 2025 12:46:47 +0000 Subject: [PATCH 2/5] nebula-lighthouse-service: init at v2.0.0 --- .../ne/nebula-lighthouse-service/package.nix | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 pkgs/by-name/ne/nebula-lighthouse-service/package.nix diff --git a/pkgs/by-name/ne/nebula-lighthouse-service/package.nix b/pkgs/by-name/ne/nebula-lighthouse-service/package.nix new file mode 100644 index 000000000000..e08fd3b8e385 --- /dev/null +++ b/pkgs/by-name/ne/nebula-lighthouse-service/package.nix @@ -0,0 +1,58 @@ +{ + lib, + fetchFromGitHub, + python3Packages, + nebula, +}: + +python3Packages.buildPythonApplication rec { + pname = "nebula-lighthouse-service"; + version = "2.0.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "manuels"; + repo = "nebula-lighthouse-service"; + tag = "v${version}"; + hash = "sha256-cRwmOGuPEYlURVbaf9AwaSmhvUzzZvATv5RGPUztnbY="; + }; + + postPatch = '' + substituteInPlace nebula_lighthouse_service/webservice.py \ + --replace-fail 'from pydantic' 'from pydantic.v1' + substituteInPlace setup.py \ + --replace-fail 'pydantic==1.10.21' 'pydantic>=2' \ + --replace-fail 'fastapi==0.116.1' 'fastapi' \ + --replace-fail 'PyYAML==6.0.2' 'PyYAML' \ + --replace-fail 'uvicorn==0.35.0' 'uvicorn' \ + --replace-fail 'python-multipart==0.0.20' 'python-multipart' + ''; + build-system = with python3Packages; [ + setuptools + wheel + ]; + + dependencies = with python3Packages; [ + fastapi + pyyaml + uvicorn + pydantic + python-multipart + nebula + ]; + + pythonImportsCheck = [ + "nebula_lighthouse_service" + ]; + + meta = { + description = "Public Nebula VPN Lighthouse Service, you can use it in case you don’t have a publicly accessible server to run your own Nebula Lighthouse"; + homepage = "https://github.com/manuels/nebula-lighthouse-service"; + license = lib.licenses.agpl3Only; + platforms = lib.platforms.linux; + maintainers = with lib.maintainers; [ + bloominstrong + ]; + mainProgram = "nebula-lighthouse-service"; + }; +} From d43a6891884ca785ab9ddcf44d0705cf73a46a8e Mon Sep 17 00:00:00 2001 From: bloominstrong Date: Wed, 22 Oct 2025 13:20:19 +0000 Subject: [PATCH 3/5] nixos/nebula-lighthouse-service: init module --- .../manual/release-notes/rl-2511.section.md | 2 + nixos/modules/module-list.nix | 1 + .../networking/nebula-lighthouse-service.nix | 59 +++++++++++++++++++ nixos/tests/all-tests.nix | 1 + nixos/tests/nebula-lighthouse-service.nix | 33 +++++++++++ .../ne/nebula-lighthouse-service/package.nix | 5 ++ 6 files changed, 101 insertions(+) create mode 100644 nixos/modules/services/networking/nebula-lighthouse-service.nix create mode 100644 nixos/tests/nebula-lighthouse-service.nix diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 724c84fe3811..9bfbf1ea13b1 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -128,6 +128,8 @@ - [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable). +- [nebula-lighthouse-service](https://github.com/manuels/nebula-lighthouse-service), a public nebula lighthouse service. Avaliable as [services.nebula-lighthouse-service](#opt-services.nebula-lighthouse-service.enable). + - [angrr](https://github.com/linyinfeng/angrr), a service that automatically cleans up old auto GC roots. Available as [services.angrr](#opt-services.angrr.enable). - [Sharkey](https://joinsharkey.org), a Sharkish microblogging platform. Available as [services.sharkey](#opt-services.sharkey.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index ab964994d908..79fb9e5885b2 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1267,6 +1267,7 @@ ./services/networking/ncdns.nix ./services/networking/ncps.nix ./services/networking/ndppd.nix + ./services/networking/nebula-lighthouse-service.nix ./services/networking/nebula.nix ./services/networking/netbird.nix ./services/networking/netbird/server.nix diff --git a/nixos/modules/services/networking/nebula-lighthouse-service.nix b/nixos/modules/services/networking/nebula-lighthouse-service.nix new file mode 100644 index 000000000000..758c2112e6f1 --- /dev/null +++ b/nixos/modules/services/networking/nebula-lighthouse-service.nix @@ -0,0 +1,59 @@ +{ + config, + pkgs, + lib, + ... +}: + +let + cfg = config.services.nebula-lighthouse-service; + settingsFormat = pkgs.formats.yaml { }; +in +{ + + options.services.nebula-lighthouse-service = { + enable = lib.mkEnableOption ''If enabled, NixOS will enable a systemd unit for nebula-lighthouse-service''; + settings = lib.mkOption { + type = settingsFormat.type; + default = { }; + description = '' + Configuration for nebula-lighthouse-service. + ''; + example = '' + max-port = 65535; + min-port = 49152; + "webserver.ip" = "127.0.0.1"; + "webserver.port" = 8080; + ''; + }; + }; + + config = lib.mkIf cfg.enable { + services.nebula-lighthouse-service.settings = { + min-port = lib.mkDefault 49152; + max-port = lib.mkDefault 65535; + "webserver.port" = lib.mkDefault 8080; + "webserver.ip" = lib.mkDefault "127.0.0.1"; + }; + environment.etc."nebula-lighthouse-service/config.yaml".source = + settingsFormat.generate "nebula-lighthouse-service-config.yaml" cfg.settings; + systemd.services.nebula-lighthouse-service = { + description = "Run nebula-lighthouse-service"; + wants = [ "basic.target" ]; + after = [ + "basic.target" + "network.target" + ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "exec"; + Restart = "always"; + ExecStart = "${pkgs.nebula-lighthouse-service}/bin/nebula-lighthouse-service"; + StateDirectory = "nebula-lighthouse-service"; + }; + }; + }; + meta.maintainers = with lib.maintainers; [ + bloominstrong + ]; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index f37373c70cee..0c5f6b9fbc16 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1013,6 +1013,7 @@ in ndppd = runTest ./ndppd.nix; nebula.connectivity = runTest ./nebula/connectivity.nix; nebula.reload = runTest ./nebula/reload.nix; + nebula-lighthouse-service = runTest ./nebula-lighthouse-service.nix; neo4j = runTest ./neo4j.nix; netbird = runTest ./netbird.nix; netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix; diff --git a/nixos/tests/nebula-lighthouse-service.nix b/nixos/tests/nebula-lighthouse-service.nix new file mode 100644 index 000000000000..c88f73d6c070 --- /dev/null +++ b/nixos/tests/nebula-lighthouse-service.nix @@ -0,0 +1,33 @@ +{ pkgs, lib, ... }: +{ + name = "nebula-lighthouse-service"; + + meta.maintainers = with lib.maintainers; [ + bloominstrong + ]; + + nodes.machine = + { ... }: + { + environment.systemPackages = with pkgs; [ + nebula + ]; + services.nebula-lighthouse-service.enable = true; + + }; + + testScript = '' + start_all() + machine.succeed( + 'nebula-cert ca -duration $((10*365*24*60))m -name "NLS Test" -out-crt ca.crt -out-key ca.key', + 'nebula-cert sign -duration $((365*24*60))m -ca-crt ca.crt -ca-key ca.key -name "lighthouse" -groups "lighthouse" -ip "10.0.100.1/24" -out-crt lighthouse.crt -out-key lighthouse.key' + ) + machine.wait_for_unit("nebula-lighthouse-service.service") + machine.wait_for_open_port(8080) + machine.succeed( + 'curl -X POST "http://127.0.0.1:8080/lighthouse/" -F ca_crt=@./ca.crt -F host_crt=@./lighthouse.crt -F host_key=@./lighthouse.key', + 'curl -X GET "http://127.0.0.1:8080/lighthouse/" -F ca_crt=@./ca.crt -F host_crt=@./lighthouse.crt -F host_key=@./lighthouse.key', + 'pgrep -x nebula' + ) + ''; +} diff --git a/pkgs/by-name/ne/nebula-lighthouse-service/package.nix b/pkgs/by-name/ne/nebula-lighthouse-service/package.nix index e08fd3b8e385..c1a2bfc49a7b 100644 --- a/pkgs/by-name/ne/nebula-lighthouse-service/package.nix +++ b/pkgs/by-name/ne/nebula-lighthouse-service/package.nix @@ -3,6 +3,7 @@ fetchFromGitHub, python3Packages, nebula, + nixosTests, }: python3Packages.buildPythonApplication rec { @@ -45,6 +46,10 @@ python3Packages.buildPythonApplication rec { "nebula_lighthouse_service" ]; + passthru.tests = { + nebula-lighthouse-service = nixosTests.nebula-lighthouse-service; + }; + meta = { description = "Public Nebula VPN Lighthouse Service, you can use it in case you don’t have a publicly accessible server to run your own Nebula Lighthouse"; homepage = "https://github.com/manuels/nebula-lighthouse-service"; From 8f7faf939af05bc9a2587e4881bf0d7cf1972830 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Tue, 11 Nov 2025 21:04:31 -0800 Subject: [PATCH 4/5] nebula-lighthouse-service: review feedback --- nixos/doc/manual/release-notes/rl-2511.section.md | 2 +- .../services/networking/nebula-lighthouse-service.nix | 6 +++--- nixos/tests/all-tests.nix | 2 +- pkgs/by-name/ne/nebula-lighthouse-service/package.nix | 10 +++++++++- 4 files changed, 14 insertions(+), 6 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 9bfbf1ea13b1..a1877303f482 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -128,7 +128,7 @@ - [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable). -- [nebula-lighthouse-service](https://github.com/manuels/nebula-lighthouse-service), a public nebula lighthouse service. Avaliable as [services.nebula-lighthouse-service](#opt-services.nebula-lighthouse-service.enable). +- [nebula-lighthouse-service](https://github.com/manuels/nebula-lighthouse-service), a public Nebula VPN lighthouse service. Available as [services.nebula-lighthouse-service](#opt-services.nebula-lighthouse-service.enable). - [angrr](https://github.com/linyinfeng/angrr), a service that automatically cleans up old auto GC roots. Available as [services.angrr](#opt-services.angrr.enable). diff --git a/nixos/modules/services/networking/nebula-lighthouse-service.nix b/nixos/modules/services/networking/nebula-lighthouse-service.nix index 758c2112e6f1..0c747129d447 100644 --- a/nixos/modules/services/networking/nebula-lighthouse-service.nix +++ b/nixos/modules/services/networking/nebula-lighthouse-service.nix @@ -12,19 +12,19 @@ in { options.services.nebula-lighthouse-service = { - enable = lib.mkEnableOption ''If enabled, NixOS will enable a systemd unit for nebula-lighthouse-service''; + enable = lib.mkEnableOption "nebula-lighthouse-service"; settings = lib.mkOption { type = settingsFormat.type; default = { }; description = '' Configuration for nebula-lighthouse-service. ''; - example = '' + example = { max-port = 65535; min-port = 49152; "webserver.ip" = "127.0.0.1"; "webserver.port" = 8080; - ''; + }; }; }; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 0c5f6b9fbc16..506a47002552 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1011,9 +1011,9 @@ in defaults.services.ncps.cache.dataPath = "/path/to/ncps"; }; ndppd = runTest ./ndppd.nix; + nebula-lighthouse-service = runTest ./nebula-lighthouse-service.nix; nebula.connectivity = runTest ./nebula/connectivity.nix; nebula.reload = runTest ./nebula/reload.nix; - nebula-lighthouse-service = runTest ./nebula-lighthouse-service.nix; neo4j = runTest ./neo4j.nix; netbird = runTest ./netbird.nix; netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix; diff --git a/pkgs/by-name/ne/nebula-lighthouse-service/package.nix b/pkgs/by-name/ne/nebula-lighthouse-service/package.nix index c1a2bfc49a7b..47c431ec67af 100644 --- a/pkgs/by-name/ne/nebula-lighthouse-service/package.nix +++ b/pkgs/by-name/ne/nebula-lighthouse-service/package.nix @@ -4,6 +4,7 @@ python3Packages, nebula, nixosTests, + nix-update-script, }: python3Packages.buildPythonApplication rec { @@ -28,6 +29,7 @@ python3Packages.buildPythonApplication rec { --replace-fail 'uvicorn==0.35.0' 'uvicorn' \ --replace-fail 'python-multipart==0.0.20' 'python-multipart' ''; + build-system = with python3Packages; [ setuptools wheel @@ -50,8 +52,14 @@ python3Packages.buildPythonApplication rec { nebula-lighthouse-service = nixosTests.nebula-lighthouse-service; }; + passthru.updateScript = nix-update-script { }; + meta = { - description = "Public Nebula VPN Lighthouse Service, you can use it in case you don’t have a publicly accessible server to run your own Nebula Lighthouse"; + description = "Public Nebula VPN Lighthouse Service"; + longDescription = '' + In case you don't have a publicly accessible server to run your own Nebula VPN lighthouse, + you can use a public nebula-lighthouse-service instance without passing traffic through it. + ''; homepage = "https://github.com/manuels/nebula-lighthouse-service"; license = lib.licenses.agpl3Only; platforms = lib.platforms.linux; From 9f316d886cdfb82abdb8eefb8e40773c8a4ca033 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Tue, 11 Nov 2025 21:29:31 -0800 Subject: [PATCH 5/5] nixos/nebula-lighthouse-service: run as lower privilege user --- .../networking/nebula-lighthouse-service.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/nixos/modules/services/networking/nebula-lighthouse-service.nix b/nixos/modules/services/networking/nebula-lighthouse-service.nix index 0c747129d447..cd9371cba2ae 100644 --- a/nixos/modules/services/networking/nebula-lighthouse-service.nix +++ b/nixos/modules/services/networking/nebula-lighthouse-service.nix @@ -6,6 +6,8 @@ }: let + inherit (lib) types; + cfg = config.services.nebula-lighthouse-service; settingsFormat = pkgs.formats.yaml { }; in @@ -13,6 +15,14 @@ in options.services.nebula-lighthouse-service = { enable = lib.mkEnableOption "nebula-lighthouse-service"; + user = lib.mkOption { + type = types.str; + default = "nebula-lighthouse"; + description = '' + The user and group to run nebula-lighthouse-service as. + ''; + example = "nebula-lighthouse"; + }; settings = lib.mkOption { type = settingsFormat.type; default = { }; @@ -50,8 +60,16 @@ in Restart = "always"; ExecStart = "${pkgs.nebula-lighthouse-service}/bin/nebula-lighthouse-service"; StateDirectory = "nebula-lighthouse-service"; + User = cfg.user; + Group = cfg.user; }; }; + users.users.${cfg.user} = { + group = cfg.user; + description = "nebula-lighthouse-service user"; + isSystemUser = true; + }; + users.groups.${cfg.user} = { }; }; meta.maintainers = with lib.maintainers; [ bloominstrong