Give every laptop, server, and cloud VM you own one private address that works from anywhere, and that is exactly the overlay network Nebula builds. Each machine runs a single small binary, presents a certificate signed by your own certificate authority, and joins a peer-to-peer layer-3 mesh where tunnels form on demand between hosts that need to talk. Lighthouse nodes, the piece you park on a VPS, keep track of where every peer can be reached and introduce hosts to each other, so machines find each other without any central VPN concentrator carrying their traffic. UDP hole punching and keepalive packets open direct tunnels through home routers and office NAT, and when two hard NATs refuse to cooperate, a relay host forwards the encrypted traffic until a better path appears. Every host enforces its own firewall, default deny on all overlay traffic, with rules keyed to certificate groups, so laptops in the user-endpoint group can reach a server's web port while other groups cannot. Ordinary hosts need no inbound ports at all, and the same binary runs on Linux, macOS, Windows, phones, and FreeBSD, making the mesh feel identical at home, in a datacenter, or across three clouds. Unsafe routes can even pull an existing office subnet into the overlay, giving legacy hardware that will never run Nebula an address on the private network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.