feat: herdr + agent network over netbird

hosts/m3-atlas/services/containers/netbird.nix

@@ -1,5 +1,6 @@
 {
   config,
+  lib,
   pkgs,
   ...
 }: let
@@ -121,7 +122,7 @@ in {
 
   virtualisation.oci-containers.containers = {
     "${serviceName}-dashboard" = {
-      image = "netbirdio/dashboard:latest";
+      image = "docker.io/netbirdio/dashboard:latest";
       autoStart = true;
       environmentFiles = [config.age.secrets."${serviceName}-dashboard-env".path];
       extraOptions = [
@@ -131,7 +132,7 @@ in {
     };
 
     "${serviceName}-server" = {
-      image = "netbirdio/netbird-server:latest";
+      image = "docker.io/netbirdio/netbird-server:latest";
       autoStart = true;
       ports = ["${toString stunPort}:${toString stunPort}/udp"];
       environmentFiles = [config.age.secrets."${serviceName}-server-env".path];
@@ -147,12 +148,15 @@ in {
     };
 
     "${serviceName}-proxy" = {
-      image = "netbirdio/reverse-proxy:latest";
+      image = "docker.io/netbirdio/reverse-proxy:latest";
       autoStart = true;
       ports = ["${toString wireguardPort}:${toString wireguardPort}/udp"];
       volumes = [
         "${serviceName}_proxy_certs:/certs"
       ];
+      environment = {
+        NB_PROXY_PRIVATE = "true";
+      };
       environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
       cmd = [
         "--domain=${proxyDomain}"