TechPrufer
Get started
Slack
Slack logoSlack · Feature trail

Nebula overlay network

2 posts · Nov 2019 – Mar 2026

What this trail covers

This thread tracks the evolution of Slack's networking infrastructure, focusing on secure and scalable inter-computer connectivity. Initial posts detailed the challenges of managing complex networks across multiple cloud providers and regions, leading to the development of Nebula, an open-source overlay network. Nebula provides encrypted, performant, and secure connections between hosts, abstracting away IP address complexities and enabling fine-grained traffic filtering based on host identity. This post details the integration of HTTP/3 support into Prometheus Blackbox Exporter, enabling network probing of HTTP/3 endpoints and providing client-side observability for QUIC-based protocols. This was achieved through an open-source contribution and an in-house system, leading to operational improvements like a unified view of HTTP metrics and more reliable alerts.

All Slack trails
  1. From Custom to Open: Scalable Network Probing and HTTP/3 Readiness with PrometheusThis post details the integration of HTTP/3 support into Prometheus Blackbox Exporter (BBE) by choosing quic-go as the HTTP client and integrating it into BBE's existing architecture. It also describes an in-house system built to utilize these upstream features for probing HTTP/3 endpoints. Operational improvements include a unified view of HTTP/1.1, HTTP/2, and HTTP/3 metrics, better alerts, and easier correlation of HTTP/3 performance with other metrics. Future work includes SNI routing tests and end-to-end path visualization.
  2. Introducing Nebula, the open source global overlay network from SlackThis post introduces Nebula, an open-source global overlay network developed by Slack. It details the problem Nebula solves: securely connecting tens of thousands of computers across multiple cloud providers and locations. The post outlines Nebula's goals: encrypted connections, service provider agnosticism, high-level traffic filtering, strong identity via certificates, performance, and testability. It explains the motivation for building Nebula, stemming from the operational burden and performance impact of IPSec and the limitations of region-siloed security groups. The post highlights the use of the Noise Protocol Framework for encryption and draws inspiration from Tinc for mesh networking concepts. Nebula has been in use at Slack for over two years and has undergone security assessments and is being added to Slack's bug bounty program.