I got a few cases where the service i want to check is only reachable from a few of my hosts and (intentionally) not from my icinga2 server.
E.g. a tunnel somewhere to reach an API
How do I defer those checks to the icinga2 agent on the box that can actually reach the target?
You could add igonore option to these service checks and define a new variable e.g. host.vars.not_reachable = true for according hosts.
Err … the issue is not checks being run that can’t possibly work.
The issue is I need f.ex. a check_http run on a specific agent instead of the master.
Is the way to go™ adding a template to those checks that says run on agent?
You might checkout the distributed monitoring docs
It’s possible I’m sure and we do something similar → in our case we send all of hosts/services to certain Zones
I think this section has what you need.
Checks are executed by an endpoint of a zone where a host is member of. With command_endpoint this can be changed to any other icinga node.
now to figure out how to properly configure an endpoint and a zone from director on the host that can actually reach the target 
then i should be able to set the target host to that zone
The director automatically manage zone and endpoint objects for hosts when Icinga Agent is set to yes.
But I need to somehow tell it to run this check from that host …
got any docs/ecxamples how to do that?
I’m a bit confused currently…