feat: netbird agent network private proxy

Add dedicated NB_PROXY_PRIVATE=true reverse-proxy (netbird-an-proxy)
serving agent-network synth endpoints over the WireGuard overlay only.
Configured via NB_PROXY_* env vars, no domain/ACME/Traefik/host port.
Register netbird-an-proxy-env secret.

hosts/AZ-CLD-1/secrets.nix

@@ -61,6 +61,9 @@
       netbird-proxy-env = {
         file = ../../secrets/netbird-proxy-env.age;
       };
+      netbird-an-proxy-env = {
+        file = ../../secrets/netbird-an-proxy-env.age;
+      };
       outline-env = {
         file = ../../secrets/outline-env.age;
         owner = "outline";

hosts/AZ-CLD-1/services/containers/netbird.nix

@@ -18,6 +18,7 @@
   dashboardIp = "${ipBase}.${toString ipOffset}";
   serverIp = "${ipBase}.${toString (ipOffset + 1)}";
   proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
+  anProxyIp = "${ipBase}.${toString (ipOffset + 3)}";
 
   # Database configuration
   dbName = "netbird";
@@ -94,6 +95,7 @@ in {
   age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
   age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
   age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
+  age.secrets."${serviceName}-an-proxy-env".file = ../../../../secrets/${serviceName}-an-proxy-env.age;
 
   # Systemd oneshot service to generate config with secrets
   systemd.services."${serviceName}-config" = {
@@ -167,6 +169,22 @@ in {
         "--network=web"
       ];
     };
+
+    "${serviceName}-an-proxy" = {
+      image = "netbirdio/reverse-proxy:latest";
+      autoStart = true;
+      environment = {
+        NB_PROXY_PRIVATE = "true";
+        NB_PROXY_MANAGEMENT_ADDRESS = "http://${serverIp}:80";
+        NB_PROXY_ALLOW_INSECURE = "true";
+      };
+      environmentFiles = [config.age.secrets."${serviceName}-an-proxy-env".path];
+      dependsOn = ["${serviceName}-server"];
+      extraOptions = [
+        "--ip=${anProxyIp}"
+        "--network=web"
+      ];
+    };
   };
 
   services.traefik.dynamicConfigOptions = {
@@ -238,6 +256,6 @@ in {
 
   networking.firewall.allowedUDPPorts = [
     3478 # STUN
-    51820 # WireGuard for proxy
+    51820 # WireGuard for public proxy
   ];
 }