feat: netbird agent network private proxy

Add dedicated NB_PROXY_PRIVATE=true reverse-proxy (netbird-an-proxy)
serving agent-network synth endpoints over the WireGuard overlay only.
Configured via NB_PROXY_* env vars, no domain/ACME/Traefik/host port.
Register netbird-an-proxy-env secret.

hosts/AZ-CLD-1/secrets.nix

@@ -61,6 +61,9 @@
       netbird-proxy-env = {
         file = ../../secrets/netbird-proxy-env.age;
       };
+      netbird-an-proxy-env = {
+        file = ../../secrets/netbird-an-proxy-env.age;
+      };
       outline-env = {
         file = ../../secrets/outline-env.age;
         owner = "outline";

hosts/AZ-CLD-1/services/containers/netbird.nix

@@ -18,6 +18,7 @@
   dashboardIp = "${ipBase}.${toString ipOffset}";
   serverIp = "${ipBase}.${toString (ipOffset + 1)}";
   proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
+  anProxyIp = "${ipBase}.${toString (ipOffset + 3)}";
 
   # Database configuration
   dbName = "netbird";
@@ -94,6 +95,7 @@ in {
   age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
   age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
   age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
+  age.secrets."${serviceName}-an-proxy-env".file = ../../../../secrets/${serviceName}-an-proxy-env.age;
 
   # Systemd oneshot service to generate config with secrets
   systemd.services."${serviceName}-config" = {
@@ -167,6 +169,22 @@ in {
         "--network=web"
       ];
     };
+
+    "${serviceName}-an-proxy" = {
+      image = "netbirdio/reverse-proxy:latest";
+      autoStart = true;
+      environment = {
+        NB_PROXY_PRIVATE = "true";
+        NB_PROXY_MANAGEMENT_ADDRESS = "http://${serverIp}:80";
+        NB_PROXY_ALLOW_INSECURE = "true";
+      };
+      environmentFiles = [config.age.secrets."${serviceName}-an-proxy-env".path];
+      dependsOn = ["${serviceName}-server"];
+      extraOptions = [
+        "--ip=${anProxyIp}"
+        "--network=web"
+      ];
+    };
   };
 
   services.traefik.dynamicConfigOptions = {
@@ -238,6 +256,6 @@ in {
 
   networking.firewall.allowedUDPPorts = [
     3478 # STUN
-    51820 # WireGuard for proxy
+    51820 # WireGuard for public proxy
   ];
 }

secrets.nix

@@ -40,6 +40,7 @@ in {
   "secrets/netbird-dashboard-env.age".publicKeys = systems ++ users;
   "secrets/netbird-server-env.age".publicKeys = systems ++ users;
   "secrets/netbird-proxy-env.age".publicKeys = systems ++ users;
+  "secrets/netbird-an-proxy-env.age".publicKeys = systems ++ users;
   "secrets/outline-env.age".publicKeys = systems ++ users;
   "secrets/snipe-it-app-key.age".publicKeys = systems ++ users;
   "secrets/snipe-it-db-password.age".publicKeys = systems ++ users;

secrets/netbird-an-proxy-env.age

@@ -0,0 +1,18 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpoVnNlZyBUSEt1
+dDRNMDNRUE9hblgyZ1lFTWw0VUUvTFkwNmNZY1JRUjhzbURHOWprClcwYWIvUzFO
+RHZkcUY3LzZUZ2JzNyszbmNlZmY2NXFDSkdRSW5DK3BrYU0KLT4gc3NoLWVkMjU1
+MTkgU3JIYXFBIEtOZ3JoOFVMTUVEWC8veHBtbjJkSVBacWNwNXNZUmlnTjF6dm55
+WUxmUWsKWlFOZUtvTzVBMnhLa1RQS2hvbVhrTVJrdXNhT1IzeGVWMnlzV0pxNnFn
+OAotPiBzc2gtZWQyNTUxOSBsR3FWWmcgM3cxOXl4cmpkSGVpbUoxbHR5R0lOZzZq
+QzNjZzdjR0h1czRUYlNsUWh4RQo4aEt5c1c3L0hpTWIxM2NSSkJCQTZDelY5QjNr
+N2o3ZENiVEVPVTR5dkNNCi0+IHNzaC1lZDI1NTE5IENTTXloZyB2V1ZXVEt1OFNh
+bjExdmwxaGViNGxhMEgyQ3doR3Y1WmJxNXZJZEJudjBFCjNxTm5kdjhJamNQZTZI
+d1Q4YTduWERvdi9GcHc0RnUrbDZzNnNiM2JaS2sKLT4gdiJ4MTNtQS1ncmVhc2Ug
+WEpqIExhCjVoaGloejNVdlFvZkNmTjQ5NWwvRUZUN3p0dnhBZnAzUjdsWm1sS1ov
+Mzl1VU9JTDd0VWxRUXRMVFdnVXhZbE0KcytsQk5XMTdLWnlrWkljcjYwVXpEd3Jr
+V3NQN0pxYy8KLS0tIGptR2lpaWFqREVHMFhLMVJDWEI1YnowbzN4YlcyeVBpbkRM
+SUdodFgxdEkKECUqJhsp+j5b+yAdeu7FWtu9BK77JWm/JuhZHdQe8ZfXk3yU55Ib
+bNdBpVgq3i1rmGhPjwiSVlU/eYO46DXIwBDTlJkO7yWL0joSx3Pn/L+gcQZjHsNR
+1g==
+-----END AGE ENCRYPTED FILE-----