From 165ac75ba9e75fe1cc81d27575875576fb6b70c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sascha=20K=C3=B6nig?= <sascha.koenig@azintec.com>
Date: Tue, 4 Aug 2026 12:47:23 +0200
Subject: [PATCH] fix: enable netbird agent network on existing proxy

Agent Network needs NB_PROXY_PRIVATE=true on the single existing
reverse-proxy, not a separate container. The previous standalone
an-proxy had no TLS cert (removed certs volume + ACME) and crashed
with 'open certs/tls.crt: no such file', so its overlay peer IP
(100.91.226.149) never came up and drop.p.az-gruppe.com timed out.

The auto-generated endpoint under the existing *.p.az-gruppe.com
wildcard (drop.p.az-gruppe.com -> overlay peer IP via MagicDNS) is
the correct URL; the invented a.az-gruppe.com had no DNS.

- set NB_PROXY_PRIVATE=true on netbird-proxy (keeps ACME + certs)
- remove standalone netbird-an-proxy container, anProxyIp, anProxyDomain
- drop netbird-an-proxy-env secret (nix refs + age file)
---
 hosts/AZ-CLD-1/secrets.nix                    |  3 ---
 .../AZ-CLD-1/services/containers/netbird.nix  | 26 ++++++-------------
 secrets.nix                                   |  1 -
 secrets/netbird-an-proxy-env.age              | 18 -------------
 4 files changed, 8 insertions(+), 40 deletions(-)
 delete mode 100644 secrets/netbird-an-proxy-env.age

diff --git a/hosts/AZ-CLD-1/secrets.nix b/hosts/AZ-CLD-1/secrets.nix
index 72d6ce1..d8d9a7f 100644
--- a/hosts/AZ-CLD-1/secrets.nix
+++ b/hosts/AZ-CLD-1/secrets.nix
@@ -61,9 +61,6 @@
       netbird-proxy-env = {
         file = ../../secrets/netbird-proxy-env.age;
       };
-      netbird-an-proxy-env = {
-        file = ../../secrets/netbird-an-proxy-env.age;
-      };
       outline-env = {
         file = ../../secrets/outline-env.age;
         owner = "outline";
diff --git a/hosts/AZ-CLD-1/services/containers/netbird.nix b/hosts/AZ-CLD-1/services/containers/netbird.nix
index 7fde73b..685b317 100644
--- a/hosts/AZ-CLD-1/services/containers/netbird.nix
+++ b/hosts/AZ-CLD-1/services/containers/netbird.nix
@@ -18,7 +18,6 @@
   dashboardIp = "${ipBase}.${toString ipOffset}";
   serverIp = "${ipBase}.${toString (ipOffset + 1)}";
   proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
-  anProxyIp = "${ipBase}.${toString (ipOffset + 3)}";
 
   # Database configuration
   dbName = "netbird";
@@ -95,7 +94,6 @@ in {
   age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
   age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
   age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
-  age.secrets."${serviceName}-an-proxy-env".file = ../../../../secrets/${serviceName}-an-proxy-env.age;
 
   # Systemd oneshot service to generate config with secrets
   systemd.services."${serviceName}-config" = {
@@ -154,6 +152,14 @@ in {
       volumes = [
         "${serviceName}_proxy_certs:/certs"
       ];
+      environment = {
+        # Enable private services (NetBird Agent Network). Reachable only
+        # over the WireGuard overlay; endpoints are auto-generated under the
+        # proxy domain (e.g. <name>.p.az-gruppe.com) with a MagicDNS record
+        # pointing at this proxy's overlay peer IP. TLS is still terminated
+        # here via the existing ACME wildcard cert.
+        NB_PROXY_PRIVATE = "true";
+      };
       environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
       cmd = [
         "--domain=${proxyDomain}"
@@ -169,22 +175,6 @@ in {
         "--network=web"
       ];
     };
-
-    "${serviceName}-an-proxy" = {
-      image = "netbirdio/reverse-proxy:latest";
-      autoStart = true;
-      environment = {
-        NB_PROXY_PRIVATE = "true";
-        NB_PROXY_MANAGEMENT_ADDRESS = "http://${serverIp}:80";
-        NB_PROXY_ALLOW_INSECURE = "true";
-      };
-      environmentFiles = [config.age.secrets."${serviceName}-an-proxy-env".path];
-      dependsOn = ["${serviceName}-server"];
-      extraOptions = [
-        "--ip=${anProxyIp}"
-        "--network=web"
-      ];
-    };
   };
 
   services.traefik.dynamicConfigOptions = {
diff --git a/secrets.nix b/secrets.nix
index ddf8c18..dcc4441 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -40,7 +40,6 @@ in {
   "secrets/netbird-dashboard-env.age".publicKeys = systems ++ users;
   "secrets/netbird-server-env.age".publicKeys = systems ++ users;
   "secrets/netbird-proxy-env.age".publicKeys = systems ++ users;
-  "secrets/netbird-an-proxy-env.age".publicKeys = systems ++ users;
   "secrets/outline-env.age".publicKeys = systems ++ users;
   "secrets/snipe-it-app-key.age".publicKeys = systems ++ users;
   "secrets/snipe-it-db-password.age".publicKeys = systems ++ users;
diff --git a/secrets/netbird-an-proxy-env.age b/secrets/netbird-an-proxy-env.age
deleted file mode 100644
index 6d38464..0000000
--- a/secrets/netbird-an-proxy-env.age
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpoVnNlZyBUSEt1
-dDRNMDNRUE9hblgyZ1lFTWw0VUUvTFkwNmNZY1JRUjhzbURHOWprClcwYWIvUzFO
-RHZkcUY3LzZUZ2JzNyszbmNlZmY2NXFDSkdRSW5DK3BrYU0KLT4gc3NoLWVkMjU1
-MTkgU3JIYXFBIEtOZ3JoOFVMTUVEWC8veHBtbjJkSVBacWNwNXNZUmlnTjF6dm55
-WUxmUWsKWlFOZUtvTzVBMnhLa1RQS2hvbVhrTVJrdXNhT1IzeGVWMnlzV0pxNnFn
-OAotPiBzc2gtZWQyNTUxOSBsR3FWWmcgM3cxOXl4cmpkSGVpbUoxbHR5R0lOZzZq
-QzNjZzdjR0h1czRUYlNsUWh4RQo4aEt5c1c3L0hpTWIxM2NSSkJCQTZDelY5QjNr
-N2o3ZENiVEVPVTR5dkNNCi0+IHNzaC1lZDI1NTE5IENTTXloZyB2V1ZXVEt1OFNh
-bjExdmwxaGViNGxhMEgyQ3doR3Y1WmJxNXZJZEJudjBFCjNxTm5kdjhJamNQZTZI
-d1Q4YTduWERvdi9GcHc0RnUrbDZzNnNiM2JaS2sKLT4gdiJ4MTNtQS1ncmVhc2Ug
-WEpqIExhCjVoaGloejNVdlFvZkNmTjQ5NWwvRUZUN3p0dnhBZnAzUjdsWm1sS1ov
-Mzl1VU9JTDd0VWxRUXRMVFdnVXhZbE0KcytsQk5XMTdLWnlrWkljcjYwVXpEd3Jr
-V3NQN0pxYy8KLS0tIGptR2lpaWFqREVHMFhLMVJDWEI1YnowbzN4YlcyeVBpbkRM
-SUdodFgxdEkKECUqJhsp+j5b+yAdeu7FWtu9BK77JWm/JuhZHdQe8ZfXk3yU55Ib
-bNdBpVgq3i1rmGhPjwiSVlU/eYO46DXIwBDTlJkO7yWL0joSx3Pn/L+gcQZjHsNR
-1g==
------END AGE ENCRYPTED FILE-----