The proxy runs non-root; a root-owned bind mount (/opt/netbird-proxy/certs)
was unwritable ('open lock file ...: permission denied'), which would block
cert issuance once the host gets traffic. Switch to a named volume like
VPS-1, which inherits the image's writable ownership.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>