Creating a Fast, Secure, Location Agnostic Mesh Network with Nebula
summary
Shows a working, scalable overlay (Nebula) used on 20,000+ servers at Slack and runnable on Linux, OSX, Windows, iOS and Android. Explains concrete choices: written in Go, certificates as protobufs, Noise protocol with a single-round-trip handshake, AES/ChaCha ciphers, hole‑punching, lighthouses for discovery, ansible + AWS for deployment. Demos a live mesh, mobile app join and roam, per-node firewall rules, and a throughput jump to multi‑Gbps when a better path appears—practical details, not just slides.
AI-written summary · about
chapters (21)
- 0:00Start
- 0:05Creating a Fast, Secure, Location Agnostic Mesh Network with Nebula
- 2:15A Bit of History Writing Nebula Architecture
- 4:18Open Source Release
- 9:04A Bit of History...
- 18:08iPad IPSec
- 20:11Bonus Question: What about IPSec in transport mode?
- 25:55What about insert whatever ?
- 29:02Started in 2016-ish
- 29:32Golang?
- 31:46The Firewall code came first.
- 32:16Massive Scale
- 32:47Chef and vault integration (not oss, yet)
- 34:04Technical Deep Dive
- 35:16Certificates (not X.509, protobuf)
- 37:05Lighthouse Architecture
- 37:49Why deal with eventual consistency, when you can have...?
- 38:31LH are explicitly NOT trusted
- 39:07AES vs ChaCha
- 40:50Hole Punching
- 44:20Workshop
related talks
34mZero to Secure: Using Open Service Mesh to Easily...
45mMulti-Runtime Service Mesh With Consul
53mDo you need a Service Mesh?
07mKeynote Demo: Service Mesh Networking Features
35mChaos Mesh: Overview, Practice and Future
32mService Networking Within Air-Gapped Environments: Deployment Strategies and Operat...
15mIntroduction to the Agent eXchange Layer (AXL)
33mBuilding a Secure, Multi-Protocol and Multi-Tenant Cluster for Internet-Facing Services [A]