Ubuntu Manpage: nebula.yml - nebula configuration files

NAME

       nebula.yml - nebula configuration files

DESCRIPTION

Configuration file for nebula(1) are written in YAML. Each section is described below:

pki
The PKI section defines the location of credentials

ca
Path to the CA certificate

cert
Path to this node's certificate file

key
Path to this node's key file

static_host_map
The static host map defines a set of hosts with fixed IP addresses on the internet. Multiple addresses
may be defined and Nebula will try each when establishing a tunnel.

lighthouse
The lighthouse section allows the entablement and configuration of lighthouse behavior. In Nebula,
lighthouses are nodes with ip fixed addresses which other nodes can use to located each other.

am_lighthouse
Enables lighthouse behavior on this node. Should ONLY be true on nodes you have configured to be
lighthouses on your network.

interval
Number of seconds between updates from this node to a lighthouse. When a lighthouse receives an
update, it sends information about its current IP address to each node.

hosts A list of lighthouse nodes this node should report to and query from. Should be empty on
lighthouse nodes.

serve_dns
Starts a DNS listener which responds to various queries (VAGUE) and be delegated for resolution.

listen
Control the port and interface on which nebula listens.

host Set the ip to which nebula binds

port Set the port to which nebula binds

punchy
punch Continue to punch inbound/outbound at a regular interval to avoid expiration of firewall NAT
mapping

respond
Configure the node to reach out and connect to you if your hole punching fails. This is extremely
useful if one node is behind a difficult NAT, such as a symmetric NAT.

delay Delay a punch response for misbehaving NATs, default is 1 second, respond must be true to take
effect

cipher
Choose between the available ciphers for your network. Options are "chachapoly" or "aes." Must be
identical across all nodes on a network.

sshd
SSHD can expose information and administrative function via ssh

enabled
If true, this enables SSHD administration

listen Host and port to listen on. (Port 22 is not allowed.)

host_key
A file containing a list of authorized public keys

authorized_users
A list of users each with an array of keys

tun
disabled
When tun is disabled, a lighthouse can be started without a local run interface (and therefore
without root)

dev The name of the device

drop_local_broadcast
Toggles forwarding of local broadcast packets, the address of which depends on the ip/mask encoded
in the pki.cert

drop_multicast
Drop the forwarding of multicast packets

tx_queue
Sets the transmit queue length. (If you notice lots of transmit drops on the tun it may help to
raise this number. Defaults to 500.

mtu Default MTU for every packet, safe setting is (and the default) 1300 for internet based traffic.

unsafe_routes
Unsafe routes allows you to route traffic over nebula to non-nebula nodes. Unsafe routes should be
avoided unless you have hosts/services that cannot run nebula.

logging
Configure logging

level Configure the logging level. Must be one of panic, fatal, error, warning, info, or debug.

format Either json or text

disable_timestamp
Disables timestamp logging. Useful when redirected into to a logging system which appends a time
stamp. Defaults to false.

stats
Enable a statistics exporter.

type Type of statistics exporter. Either "prometheus" or "graphite"

interval
Interval to provide updates for either graphite or prometheus.

prefix Prefix for graphite

protocol
Protocol for graphite

host Listener for graphite

listen IP and port to bind the prometheus listener

path Path on which metrics are supplied in prometheus

namespace
Prometheus namespace

subsystem
Prometheus subsystem

message_metrics
Enables counter metrics for meta packets. (e.g. message.tx.handshake)

lighthouse_metrics
Enables detailed counter metrics for lighthouse packets (e.g. lighthouse.rx.HostQuery)

handshakes
Handshakes are sent to all known addresses at each interval with a linear back off.

try_interval
Nebula waits try_interval after the first attempt, 2 * try_interval on the second attempt, until
the handshake is older than timeout. This allows you to control this interval.

retries
Number of retries before timing out

trigger_buffer
Size of the buffer channel for quickly sending handshakes after receiving the response for
lighthouse queries

firewall
The firewall is default deny. There is no way to write a deny rule. Rules are comprised of a protocol,
port, and one or more of host, group, or CIDR. Logical evaluation is roughly: port AND proto AND (ca_sha
OR ca_name) AND (host OR group OR groups OR CIDR)

outbound
Section containing rules which apply to traffic send from this node. See the rules section.

inbound
Section containing rules which apply to traffic send to this node from other hosts. See the rules
section.

rules
Rules are written in the outbound and inbound sections described above.

proto
Protocol. One of "any", "tcp", "udp", or "icmp"

host
"any" or literal hostname

group
"any" or literal group name

groups
Same as group but accepts a list of values. Certificate has to contain all groups to pass.

cidr
a CIDR, "0.0.0.0/0" is any

ca_name
An issuing CA name

ca_sum
An issuing CA shasum

EXAMPLES

       There is a example configuration file in the FILES section below.

       Configuration files placed in /etc/nebula can take advantage  of  the  built-in  systemd  templates.  For
       example, if you have a nebula configuration /etc/nebula/office.yml

         [#] systemctl enable nebula@office.service

FILES

       /etc/nebula
              Contains   configuration   files  for  nebula(1).  This  provides  a  designated  place  to  store
              configuration data and  credentials.  Configuration  files  placed  in  this  directory  can  take
              advantage of the provided systemd template unit.

       /usr/share/doc/nebula/examples/config.yml
              See this example configuration file.

NAME

DESCRIPTION

EXAMPLES

FILES

SEE ALSO