Hi! I've been evaluating nebula for a bit and am just starting to look at netmaker. (This is more or less a homelab setting, possibly connecting multiple homelabs.) I like the idea of netmaker -- it's something I wished for when setting up my first wireguard network. To me it seems like there is a big difference between the trust model of nebula and the trust model of netmaker. It seems to me that nebula lighthouses can operate as more or less untrusted orchestration nodes on the network, but a netmaker server must be fully trusted. This would mean that a compromised netmaker server could basically mitm all network traffic, but a compromised nebula lighthouse could not. This is a concern for me as I see these as the most vulnerable nodes on the network. It seems to me that this is a tradeoff for more or less "automagical" configuration granted by netmaker. I've only barely started to look at netmaker, so I wanted to ask: is this an accurate assessment?

Netmaker server is not involved in peer to peer communications.

But it distributes keys, right?

No. Keys are generated by client

But the server distributes the public keys? In nebula there can be an external, non-lighthouse, CA to sign public keys.

Public key only works with its corresponding private key.

My concern is that a compromised server can distribute whatever keys it likes, generate its own, and mitm

It would have to spoof the public IP of peers as well

Does it not manage those as well?

It distributes them, yes

Gotcha, thanks! I wonder if some sort of similar signing mechanism could be implemented in the future to allow for centralized trust that is shifted off of the server.