[management,proxy] Add per-provider skip_tls_verification for agent-network (#6630)

* [management,proxy] Add per-provider skip_tls_verification for agent-network

Let agent-network providers opt into skipping upstream TLS verification for
self-hosted / internal gateways behind a private or self-signed cert.

- provider: add SkipTLSVerification (persisted via AutoMigrate) with
  request/response mapping (nil on update preserves, explicit false clears).
- openapi: skip_tls_verification on the provider request + response; types
  regenerated.
- synthesizer: carry the flag into the llm_router route config so it reaches
  the proxy.
- proxy: llm_router sets it on the UpstreamRewrite mutation, and the reverse
  proxy applies roundtrip.WithSkipTLSVerify per selected route when forwarding
  upstream (the router dials per provider, so a per-target flag alone wouldn't
  cover it).
- tests: synthesizer route config carries the flag, router rewrite propagates
  it, and the request/response round-trip incl. update semantics.

* [e2e] Validate per-provider skip_tls_verification end to end

Add a self-signed HTTPS upstream (nginx) to the harness and a test that
provisions two providers on that same upstream — one with
skip_tls_verification=true, one false — behind one proxy + client. The
skip=true provider's chat reaches the upstream (200); the skip=false
provider's fails the TLS handshake (5xx). Same upstream, opposite outcome,
which proves the flag is honoured per provider (a single target-level flag
could not, since all of an account's providers share one synthesised
target).

* [e2e] WaitProxyPeer: require >=1 connected peer, not exact 1/1

Each proxy container registers a fresh WireGuard key and its peer is not
removed on teardown, so proxy peers from earlier tests linger in the
account as disconnected. WaitProxyPeer matched the exact string
"1/1 Connected", which failed once a second proxy-using test ran in the
same package (status "1/2"). Parse the "Peers count: X/Y Connected" line
and wait for X>=1 instead: only the live proxy can be connected, and the
caller's subsequent chat is the real end-to-end assertion. Fixes the CI
failure of TestProviderSkipTLSVerification (runs after TestProvidersMatrix).

management/internals/modules/agentnetwork/synthesizer.go

@@ -366,6 +366,10 @@ type routerProviderRoute struct {
 	// + refreshes the OAuth token at request time instead of injecting a static
 	// AuthHeaderValue.
 	GCPServiceAccountKeyB64 string `json:"gcp_sa_key_b64,omitempty"`
+	// SkipTLSVerify disables upstream TLS certificate verification when the
+	// proxy dials this provider's upstream. For self-hosted / internal gateways
+	// behind a private or self-signed certificate.
+	SkipTLSVerify bool `json:"skip_tls_verify,omitempty"`
 }
 
 // indexProviderGroups walks the enabled policies and returns, per
@@ -450,6 +454,7 @@ func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]
 			Vertex:                  catalog.IsVertexPathStyle(p.ProviderID),
 			Bedrock:                 catalog.IsBedrockPathStyle(p.ProviderID),
 			GCPServiceAccountKeyB64: gcpSAKeyB64,
+			SkipTLSVerify:           p.SkipTLSVerification,
 		})
 	}
 	out, err := json.Marshal(cfg)

management/internals/modules/agentnetwork/synthesizer_test.go

@@ -1057,6 +1057,41 @@ func TestSynthesizeServices_UpstreamURLPath_FlowsToRouter(t *testing.T) {
 		"upstream path must be carried so the router can disambiguate same-model providers; trailing slash trimmed for stable string-prefix matching")
 }
 
+func TestSynthesizeServices_SkipTLSVerification_FlowsToRouter(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	// A provider fronting a self-hosted / internal gateway opts into skipping
+	// upstream TLS verification; the synthesiser must carry it into the router
+	// route so the proxy dials that upstream insecurely.
+	provider := newSynthTestProvider()
+	provider.SkipTLSVerification = true
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var routerCfg routerConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMRouter {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &routerCfg))
+			break
+		}
+	}
+	require.Len(t, routerCfg.Providers, 1)
+	assert.True(t, routerCfg.Providers[0].SkipTLSVerify,
+		"provider skip_tls_verification must flow into the router route")
+}
+
 func TestSynthesizeServices_UnknownProviderID_FailsClosed(t *testing.T) {
 	ctx := context.Background()
 	ctrl := gomock.NewController(t)

management/internals/modules/agentnetwork/types/provider.go

@@ -46,6 +46,11 @@ type Provider struct {
 	// Empty means all catalog models are allowed at catalog prices.
 	Models  []ProviderModel `gorm:"serializer:json"`
 	Enabled bool
+	// SkipTLSVerification disables upstream TLS certificate verification for
+	// this provider's URL. For self-hosted / internal gateways fronted by a
+	// private or self-signed certificate. The synthesiser propagates it into
+	// the router route so the proxy dials that provider's upstream insecurely.
+	SkipTLSVerification bool `gorm:"column:skip_tls_verification"`
 	// SessionPrivateKey + SessionPublicKey are the ed25519 keypair the
 	// synthesised reverse-proxy service uses to sign / verify session
 	// JWTs after a successful OIDC handshake. Generated once on
@@ -129,6 +134,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.Enabled != nil {
 		p.Enabled = *req.Enabled
 	}
+	if req.SkipTlsVerification != nil {
+		p.SkipTLSVerification = *req.SkipTlsVerification
+	}
 	// Identity-header overrides for catalogs flagged Customizable.
 	// nil pointer = "field omitted on the wire" → leave the stored
 	// value untouched (per the openapi description). Empty string is
@@ -155,14 +163,15 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	created := p.CreatedAt
 	updated := p.UpdatedAt
 	resp := &api.AgentNetworkProvider{
-		Id:          p.ID,
-		ProviderId:  p.ProviderID,
-		Name:        p.Name,
-		UpstreamUrl: p.UpstreamURL,
-		Models:      models,
-		Enabled:     p.Enabled,
-		CreatedAt:   &created,
-		UpdatedAt:   &updated,
+		Id:                  p.ID,
+		ProviderId:          p.ProviderID,
+		Name:                p.Name,
+		UpstreamUrl:         p.UpstreamURL,
+		Models:              models,
+		Enabled:             p.Enabled,
+		SkipTlsVerification: p.SkipTLSVerification,
+		CreatedAt:           &created,
+		UpdatedAt:           &updated,
 	}
 	if len(p.ExtraValues) > 0 {
 		out := make(map[string]string, len(p.ExtraValues))

management/internals/modules/agentnetwork/types/provider_test.go

@@ -0,0 +1,44 @@
+package types
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestProvider_SkipTLSVerification_RoundTrip covers the request→provider→
+// response mapping of skip_tls_verification, including the update semantics
+// (nil pointer preserves, explicit false clears).
+func TestProvider_SkipTLSVerification_RoundTrip(t *testing.T) {
+	enable := true
+	disable := false
+
+	base := func() *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "openai_api",
+			Name:        "internal",
+			UpstreamUrl: "https://gw.internal",
+		}
+	}
+
+	p := NewProvider("acc-1")
+
+	req := base()
+	req.SkipTlsVerification = &enable
+	p.FromAPIRequest(req)
+	assert.True(t, p.SkipTLSVerification, "create with skip_tls_verification=true must set the field")
+	assert.True(t, p.ToAPIResponse().SkipTlsVerification, "response must surface skip_tls_verification")
+
+	// Omitting the field on update leaves the stored value untouched.
+	p.FromAPIRequest(base())
+	assert.True(t, p.SkipTLSVerification, "omitting skip_tls_verification on update must preserve it")
+
+	// Explicit false clears it.
+	req = base()
+	req.SkipTlsVerification = &disable
+	p.FromAPIRequest(req)
+	assert.False(t, p.SkipTLSVerification, "explicit false must clear skip_tls_verification")
+	assert.False(t, p.ToAPIResponse().SkipTlsVerification, "response must reflect the cleared value")
+}