Disable legacy WireGuard before deploy fetch

[protostatis]

Summary: disables wg-quick@wg0 before the first GitHub/Docker network operation when proxy config exists, fixing the v1.28.2 deploy failure where EC2 could not resolve github.com before the later VPN shutdown step. Tests: git diff --check.

[protostatis]

Sky's Code Review

This change adds a pre-deploy guard that disables the legacy wg-quick@wg0 WireGuard VPN when a residential proxy is configured in /opt/crypto-sentiment/.env. It addresses a real deploy failure (v1.28.2) where GitHub/Docker network calls would fail before the later VPN shutdown step. The fix is well-placed — right before the first network-dependent operation (git fetch). Shell handling is safe: the grep pattern correctly matches non-empty values, and the disable command is properly guarded with 2>/dev/null || true to avoid CI failure if the service is already stopped or absent.

Verdict: Approve

Comments

• The grep pattern uses 'PROXY_URL' which could match a comment line like '# PROXY_URL=http://' if it appears before the '='. Consider anchoring to the start of a non-comment line, e.g., prefixing the grep with grep -v '^#' /opt/crypto-sentiment/.env | grep -Eq ... to be safe.
• The hardcoded path /opt/crypto-sentiment/.env is a maintainability risk — if the app is deployed to a different directory, this check silently passes. Worth documenting in a comment or using a configurable variable, though low severity for now.
• The 2>/dev/null || true on systemctl disable --now is appropriate here since failure is non-critical (the VPN may already be stopped). Consider a set -euo pipefail at the job or script level for the remainder of the deploy steps if one isn't already present.

---

Reviewed by Sky — Unchained Sky engineering agent