fix: enable netbird agent network on existing proxy

Agent Network needs NB_PROXY_PRIVATE=true on the single existing
reverse-proxy, not a separate container. The previous standalone
an-proxy had no TLS cert (removed certs volume + ACME) and crashed
with 'open certs/tls.crt: no such file', so its overlay peer IP
(100.91.226.149) never came up and drop.p.az-gruppe.com timed out.

The auto-generated endpoint under the existing *.p.az-gruppe.com
wildcard (drop.p.az-gruppe.com -> overlay peer IP via MagicDNS) is
the correct URL; the invented a.az-gruppe.com had no DNS.

- set NB_PROXY_PRIVATE=true on netbird-proxy (keeps ACME + certs)
- remove standalone netbird-an-proxy container, anProxyIp, anProxyDomain
- drop netbird-an-proxy-env secret (nix refs + age file)

hosts/AZ-CLD-1/secrets.nix

@@ -61,9 +61,6 @@
       netbird-proxy-env = {
         file = ../../secrets/netbird-proxy-env.age;
       };
-      netbird-an-proxy-env = {
-        file = ../../secrets/netbird-an-proxy-env.age;
-      };
       outline-env = {
         file = ../../secrets/outline-env.age;
         owner = "outline";

hosts/AZ-CLD-1/services/containers/netbird.nix

@@ -18,7 +18,6 @@
   dashboardIp = "${ipBase}.${toString ipOffset}";
   serverIp = "${ipBase}.${toString (ipOffset + 1)}";
   proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
-  anProxyIp = "${ipBase}.${toString (ipOffset + 3)}";
 
   # Database configuration
   dbName = "netbird";
@@ -95,7 +94,6 @@ in {
   age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
   age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
   age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
-  age.secrets."${serviceName}-an-proxy-env".file = ../../../../secrets/${serviceName}-an-proxy-env.age;
 
   # Systemd oneshot service to generate config with secrets
   systemd.services."${serviceName}-config" = {
@@ -154,6 +152,14 @@ in {
       volumes = [
         "${serviceName}_proxy_certs:/certs"
       ];
+      environment = {
+        # Enable private services (NetBird Agent Network). Reachable only
+        # over the WireGuard overlay; endpoints are auto-generated under the
+        # proxy domain (e.g. <name>.p.az-gruppe.com) with a MagicDNS record
+        # pointing at this proxy's overlay peer IP. TLS is still terminated
+        # here via the existing ACME wildcard cert.
+        NB_PROXY_PRIVATE = "true";
+      };
       environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
       cmd = [
         "--domain=${proxyDomain}"
@@ -169,22 +175,6 @@ in {
         "--network=web"
       ];
     };
-
-    "${serviceName}-an-proxy" = {
-      image = "netbirdio/reverse-proxy:latest";
-      autoStart = true;
-      environment = {
-        NB_PROXY_PRIVATE = "true";
-        NB_PROXY_MANAGEMENT_ADDRESS = "http://${serverIp}:80";
-        NB_PROXY_ALLOW_INSECURE = "true";
-      };
-      environmentFiles = [config.age.secrets."${serviceName}-an-proxy-env".path];
-      dependsOn = ["${serviceName}-server"];
-      extraOptions = [
-        "--ip=${anProxyIp}"
-        "--network=web"
-      ];
-    };
   };
 
   services.traefik.dynamicConfigOptions = {

secrets.nix

@@ -40,7 +40,6 @@ in {
   "secrets/netbird-dashboard-env.age".publicKeys = systems ++ users;
   "secrets/netbird-server-env.age".publicKeys = systems ++ users;
   "secrets/netbird-proxy-env.age".publicKeys = systems ++ users;
-  "secrets/netbird-an-proxy-env.age".publicKeys = systems ++ users;
   "secrets/outline-env.age".publicKeys = systems ++ users;
   "secrets/snipe-it-app-key.age".publicKeys = systems ++ users;
   "secrets/snipe-it-db-password.age".publicKeys = systems ++ users;

secrets/netbird-an-proxy-env.age

@@ -1,18 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpoVnNlZyBUSEt1
-dDRNMDNRUE9hblgyZ1lFTWw0VUUvTFkwNmNZY1JRUjhzbURHOWprClcwYWIvUzFO
-RHZkcUY3LzZUZ2JzNyszbmNlZmY2NXFDSkdRSW5DK3BrYU0KLT4gc3NoLWVkMjU1
-MTkgU3JIYXFBIEtOZ3JoOFVMTUVEWC8veHBtbjJkSVBacWNwNXNZUmlnTjF6dm55
-WUxmUWsKWlFOZUtvTzVBMnhLa1RQS2hvbVhrTVJrdXNhT1IzeGVWMnlzV0pxNnFn
-OAotPiBzc2gtZWQyNTUxOSBsR3FWWmcgM3cxOXl4cmpkSGVpbUoxbHR5R0lOZzZq
-QzNjZzdjR0h1czRUYlNsUWh4RQo4aEt5c1c3L0hpTWIxM2NSSkJCQTZDelY5QjNr
-N2o3ZENiVEVPVTR5dkNNCi0+IHNzaC1lZDI1NTE5IENTTXloZyB2V1ZXVEt1OFNh
-bjExdmwxaGViNGxhMEgyQ3doR3Y1WmJxNXZJZEJudjBFCjNxTm5kdjhJamNQZTZI
-d1Q4YTduWERvdi9GcHc0RnUrbDZzNnNiM2JaS2sKLT4gdiJ4MTNtQS1ncmVhc2Ug
-WEpqIExhCjVoaGloejNVdlFvZkNmTjQ5NWwvRUZUN3p0dnhBZnAzUjdsWm1sS1ov
-Mzl1VU9JTDd0VWxRUXRMVFdnVXhZbE0KcytsQk5XMTdLWnlrWkljcjYwVXpEd3Jr
-V3NQN0pxYy8KLS0tIGptR2lpaWFqREVHMFhLMVJDWEI1YnowbzN4YlcyeVBpbkRM
-SUdodFgxdEkKECUqJhsp+j5b+yAdeu7FWtu9BK77JWm/JuhZHdQe8ZfXk3yU55Ib
-bNdBpVgq3i1rmGhPjwiSVlU/eYO46DXIwBDTlJkO7yWL0joSx3Pn/L+gcQZjHsNR
-1g==
------END AGE ENCRYPTED FILE-----