Pass residential proxy secret during deploy

[protostatis]

Summary: disables legacy WireGuard unconditionally before deploy network operations, passes the RESIDENTIAL_PROXY repository secret to the EC2 SSH step, and injects it into the crawler container. Also set the repository RESIDENTIAL_PROXY secret from the existing searchagentsky.com value without logging it. Tests: git diff --check.

[protostatis]

Sky's Code Review

This PR unconditionally disables the legacy WireGuard VPN during deploy, passes the RESIDENTIAL_PROXY GitHub secret through to the EC2 SSH step via appleboy/ssh-action env/envs, and injects it into the crawler Docker container as an environment variable. The WireGuard change is a net reliability improvement — the old conditional check could silently skip if the env file drifted, and the unconditional disable with || true is safe. The main concern is that passing a secret via docker run -e RESIDENTIAL_PROXY=... exposes the value in docker inspect and ps output on the EC2 host, where any user on the machine could read it.

Verdict: Comment

Comments

• No shell syntax issues. The set -e at script scope provides adequate error handling, and || true on the systemctl disable prevents failure when the WireGuard service doesn't exist.
• The diff doesn't show the full docker run command, so Docker resource limits (--memory, --cpus), healthchecks, or log rotation are outside scope of this change. Verify they exist elsewhere in the script or in the Dockerfile/compose config.
• PR mentions setting the repository-level RESIDENTIAL_PROXY secret from searchagentsky.com — make sure this is done in GitHub repo settings (Settings → Secrets and variables → Actions), not committed or printed anywhere.
• The git diff --check self-test mentioned in the description would only catch trailing whitespace / trailing newline issues, not functional correctness. Consider whether a shellcheck or shell-lint step would add value for this deploy script.

---

Reviewed by Sky — Unchained Sky engineering agent

[protostatis]

Secrets passed via docker run -e VAR=value are visible in docker inspect, docker logs (occasionally), and the host's /proc/*/environ. On a shared EC2 instance, any user with SSH access can read this value. Consider writing it to a file with restrictive permissions (e.g., chmod 600) and using --env-file instead, or sourcing it via an existing env file that already has limited permissions. This is lower risk on a single-tenant server, but worth flagging.

[protostatis]

The echo confirms the secret's presence but doesn't leak the value — good. Consider omitting it entirely in deploy scripts to reduce noise and prevent accidental exposure in CI logs if someone later changes the echo.

[protostatis]

Previously, WireGuard was only disabled if RESIDENTIAL_PROXY or PROXY_URL was set in /opt/crypto-sentiment/.env. Now it's unconditionally disabled on every deploy. This is a net improvement for reliability — the old check could silently fail if the env file was removed or drifted. Still worth noting in case a future operator expects the conditional behavior (e.g., if WireGuard is ever needed for something else on this host).

[protostatis]

Using env: + envs: together is the correct pattern for appleboy/ssh-action — env makes the variable available to the action process, and envs (comma-separated) tells the action which variables to forward to the remote SSH session. This looks correct.