> And also Nebula's interface is absolutely shit. Instead of a normal CLI, you need to configure an internal sshd and connect via SSH to localhost. Maybe it's m

> And also Nebula's interface is absolutely shit. Instead of a normal CLI, you need to configure an internal sshd and connect via SSH to localhost. Maybe it's more secure, but it's utterly disgusting. This seems to be a strong misunderstanding? The ssh interface is for debugging only. You can disable it and configuration is solely handled by the daemon configuration file. I operate a small (few dozen hosts) network on Nebula with mostly NixOS hosts, so I have some applicable experience. Nebula was primarily chosen because it allows me to, among other things, assign fixed prefixes to hosts and have a full declarative config. You don't configure a host via a CLI, instead you provide it a signed cert for the privkey + CA cert + private key + lighthouses and that's it. The daemon listens on the IPs from the cert and the lighthouses offer a public exchange where peers advertise their IPs (and associated endpoints for p2p). The CA approach is also an important part here as all your peers effectively have the CA cert in their config file and use it to verify other peers. The CA signs a cert for each host that contains the IP prefixes that a peer may handle packets for. The only CLI you actually regularly use is here, for creating keys and signing certs.