Obfuscate only on your build server (keep developer builds clean)

#guide #dotnet #ci #devops

Obfuscation is great for what you ship and a nuisance for what you debug. The best-practice setup is: developers build normally (unobfuscated, debuggable), and only the build server that produces your official packages applies protection — same source, same dotnet build, no code changes. Here's how to set that up.

The idea

Nebula obfuscates your compiled output, not your source, and it's driven by configuration — so whether protection runs comes down to a single switch that exists only on the build agent. Developer machines don't have that switch, so their builds are untouched.

Option A — the MSBuild task, gated by an environment variable

Nebula's build target only runs when the NebulaObfuscate property is true, and MSBuild reads that from the environment. On the build agent, set:

NebulaObfuscate=true
NEBULA_LICENSE=<your build-server license key>

Every build on that agent is protected after compile; developer machines (variable absent) build exactly as before. Nothing changes in your .csproj behaviour on a dev box.

Option B — zero package reference (fully dependency-free)

If you don't want any Nebula reference in your projects at all, invoke the CLI from a repo-level Directory.Build.targets, gated by your own variable:

<Project>
  <Target Name="NebulaObfuscate" AfterTargets="Build" Condition="'$(NEBULA_OBFUSCATE)' == '1'">
    <Exec Command="nebula --config &quot;$(MSBuildProjectDirectory)/nebula.config.json&quot; --output &quot;$(TargetDir)obf&quot;" />
  </Target>
</Project>

Set NEBULA_OBFUSCATE=1 (and NEBULA_LICENSE=…) on the agent and install the CLI. Developer boxes skip the step entirely.

Setting the variable on the agent

Set it once, as the account your builds run under:

# Windows agent, machine-wide (run as Administrator):
[Environment]::SetEnvironmentVariable('NEBULA_OBFUSCATE', '1', 'Machine')
[Environment]::SetEnvironmentVariable('NEBULA_LICENSE', 'LIC-XXXX-XXXX-XXXX', 'Machine')

# Linux/macOS agent (service environment or profile):
export NEBULA_OBFUSCATE=1
export NEBULA_LICENSE=LIC-XXXX-XXXX-XXXX

Most CI systems also let you define these as pipeline/agent variables in their UI — set them on the agent, never in the repo. Full cmd/PowerShell/bash steps are in MSBuild & CI.

You only license the build machine

Because protection happens on the build server, only the build machine(s) need a license — not every developer. Activate on the agent and you're done.

Verify

Build on a dev box: output is normal and debuggable. Build on the agent: the output is renamed, flattened and encrypted, and your pipeline archives the protected artifact. Same commit, two very different binaries — exactly what you want.

Download Nebula.NET free to try it, and see the full build guide in the docs.

DEV Community