Packaging Nebula for Debian ================= > **Created:** 2021-07-18 **Last Updated:** 2021-07-19 I am close to concluding a multi-week endevor to package [Nebula](https://github.com/slackhq/nebula), a VPN-style network mesh networking overlay. If all goes well, it will be uploaded to `debian/experimental` within the next few days. This would also mean the package would be pulled into Ubuntu during the next merge window. ### Timeline Unfortunately, Debian does not adhere to a constant release cycle. This means the timeline is uncertain. It will likely be uploaded to `experimental` within a few days. [See the new queue.](https://ftp-master.debian.org/new.html) It will stay in experimental for the next three months or so until the next release occurs. (It is incompatible with the version of protobuf in unstable. This prevents it from moving into unstable until the next version release.) ``` {upload queue} -> [experimental] -> [unstable (sid)] -> [testing] -> [next release] ``` Preemptively, I'm going to write up a set of install instructions specific to debian derivatives and briefly a few of the decisions made during the packaging process. Installation ------------ **Step one will currently fail. See [installing from experimental](#installing-from-experimental)** For the sake of simplicity, I'm going to assume that you're setting up a network with two nodes -- one lighthouse node and a node on your laptop. Once you understand the process, it easily scales to as many nodes as you wish. Pick your favorite virtualization provider in order to set up the lighthouse. The lighthouse requires minimal resources because it functions as a mutually-reachable node which synchronizes the address mappings. You could use a home server provided that you have a static ip (unlikely) or setup dynamic DNS. The latter may introduce some instability. I'm also assuming both clients are debian derivatives and have access to `apt`. If this is not the case, please consult the [upstream instructions](https://github.com/slackhq/nebula#user-content-getting-started-quickly) which will guide you through the processing of installing the binaries directly. #### 1. Install Nebula through Aptitude You'll need to install Nebula on both endpoints. ```bash sudo apt install nebula ``` #### 2. Creating a certificate authority The certificate authority is to "root of trust" for a Nebula network. Compromising the certificate authority's key file would compromise the integrity and security of the entire network. The upstream instructions recommend that you store the key file in a location with strong encryption [^1]. You can generate a `ca.key` and `ca.cert` file with the following command: ```bash nebula-cert ca -name "Myorganization, Inc" ``` You will copy the `ca.crt` file to all the hosts. The `ca.key` file should remain secret. #### 4. Nebula host keys and certificates generated from that certificate authority With your `ca.key` file in hand, generate keys for each node. ```bash nebula-cert sign -name "lighthouse" -ip "192.168.100.1/24" nebula-cert sign -name "laptop" -ip "192.168.100.2/24" ``` Repeate this process for each node. It is important that each is issued a unique internal ip. The IPs are specified in CIDR notation [^2]. This internal ip will be used to configure Nebula later. #### 4. Copy the configuration files to each host Each host requires the `host.key`, `host.crt`, and `ca.crt` files to be present on the system. By convention, these are located in the `/etc/nebula` directory. Make sure to copy them into this directory. For example, to copy the credentials to a lighthouse with ip `203.0.113.11` as `user` you may use sftp and ssh as follows: ```bash sftp user@203.0.113.11 </etc/apt/sources.list.d/99-tmp-nebula-overrides.list </etc/apt/preferences.d/99-tmp-nebula-prefer-stable <