[czpython]

The secrets proxy refused every destination that is not public. A box had no way to reach a server on a private network through it, such as an on-prem model server.

• The proxy reads SECRETS_PROXY_PRIVATE_NETWORKS, a comma-separated list of CIDRs, into its private_networks option. It reads the variable the same way as SECRETS_EXCHANGE_URL, so the image CMD does not change.
• Swap.can_reach accepts an address inside a named network. CONNECT, plain HTTP, and the upstream connect resolve the host, then ask it, so they follow this one rule.
• Loopback stays refused inside a named network, because the exchange listens there. So does 0.0.0.0, which connects to loopback. Multicast stays refused.
• The list is empty by default, so an install that does not set it does not change.
• An invalid CIDR, such as 172.17.0.1/16, makes mitmproxy exit at start.
• Upstream CA trust stays with mitmproxy's own ssl_verify_upstream_trusted_ca option. This change adds no CA setting.
• The deploy, security, and architecture docs name the setting.
• The proxy test file drops a one-caller helper and an unused argument, as the checklist asks of a touched file.

Checks

• uv run ruff check, uv run ruff format --check: pass
• uv run pyright src/secrets_exchange/tests/test_swap.py: 0 errors
• druks-house-rules check --base origin/main (v0.0.5): pass
• uv run pytest src/secrets_exchange/tests/test_swap.py: 59 passed. CI runs the full suite.
• The proxy image built from this branch ran on a scratch Docker network, with a fake exchange and an HTTPS server on a private address:
  • With a named network, HTTPS to the registered host returns 200, and the server receives the real credential.
  • With an empty list, CONNECT and plain HTTP get 403.
  • With an invalid CIDR, the proxy exits at start.