# Obfuscate only on your build server (keep developer builds clean)


Obfuscation is great for what you *ship* and a nuisance for what you *debug*. The best-practice setup is: **developers build normally (unobfuscated, debuggable), and only the build server that produces your official packages applies protection** — same source, same `dotnet build`, no code changes. Here's how to set that up.

## The idea

Nebula obfuscates your compiled output, not your source, and it's driven by configuration — so whether protection runs comes down to a single switch that exists **only on the build agent**. Developer machines don't have that switch, so their builds are untouched.

## Option A — the MSBuild task, gated by an environment variable

Nebula's build target only runs when the `NebulaObfuscate` property is `true`, and MSBuild reads that from the environment. On the build agent, set:

```
NebulaObfuscate=true
NEBULA_LICENSE=<your build-server license key>
```

Every build on that agent is protected after compile; developer machines (variable absent) build exactly as before. Nothing changes in your `.csproj` behaviour on a dev box.

## Option B — zero package reference (fully dependency-free)

If you don't want any Nebula reference in your projects at all, invoke the CLI from a repo-level `Directory.Build.targets`, gated by your own variable:

```xml
<Project>
  <Target Name="NebulaObfuscate" AfterTargets="Build" Condition="'$(NEBULA_OBFUSCATE)' == '1'">
    <Exec Command="nebula --config &quot;$(MSBuildProjectDirectory)/nebula.config.json&quot; --output &quot;$(TargetDir)obf&quot;" />
  </Target>
</Project>
```

Set `NEBULA_OBFUSCATE=1` (and `NEBULA_LICENSE=…`) on the agent and install the CLI. Developer boxes skip the step entirely.

## Setting the variable on the agent

Set it once, as the account your builds run under:

```powershell
# Windows agent, machine-wide (run as Administrator):
[Environment]::SetEnvironmentVariable('NEBULA_OBFUSCATE', '1', 'Machine')
[Environment]::SetEnvironmentVariable('NEBULA_LICENSE', 'LIC-XXXX-XXXX-XXXX', 'Machine')
```

```bash
# Linux/macOS agent (service environment or profile):
export NEBULA_OBFUSCATE=1
export NEBULA_LICENSE=LIC-XXXX-XXXX-XXXX
```

Most CI systems also let you define these as pipeline/agent variables in their UI — set them on the agent, never in the repo. Full cmd/PowerShell/bash steps are in [MSBuild & CI](https://delta1labs.com/docs/nebula/msbuild/#setting-the-variables-on-the-build-agent).

## You only license the build machine

Because protection happens on the build server, only the **build machine(s)** need a license — not every developer. Activate on the agent and you're done.

## Verify

Build on a dev box: output is normal and debuggable. Build on the agent: the output is renamed, flattened and encrypted, and your pipeline archives the protected artifact. Same commit, two very different binaries — exactly what you want.

[Download Nebula.NET free](https://delta1labs.com/download?product=nebula) to try it, and see the full build guide in the [docs](https://delta1labs.com/docs/nebula/msbuild/).