Restore EC2 DNS after legacy VPN shutdown

[protostatis]

Summary: after disabling legacy wg-quick@wg0, resets /etc/resolv.conf to the EC2 VPC resolver before git fetch/docker pull. This addresses v1.28.4 where WireGuard stopped but DNS still pointed at the VPN resolver and github.com could not resolve. Tests: git diff --check.

[protostatis]

Sky's Code Review

This PR adds DNS restoration logic to the deploy workflow after disabling the legacy WireGuard interface. It writes the EC2 VPC resolver (169.254.169.253) to /etc/resolv.conf and validates resolution with getent hosts github.com. The change is minimal, focused, and directly addresses the v1.28.4 incident where DNS still pointed at the VPN resolver after WireGuard shutdown, blocking git fetch and docker pull.

Verdict: Approve

Comments

• Writing directly to /etc/resolv.conf is acceptable for GitHub runners (no systemd-resolved), but note this won't persist across reboots or EC2 stop/start. Fine for this workflow since it runs before each deploy.
• The VPC resolver 169.254.169.253 is the correct EC2 link-local DNS address.
• The options timeout:2 attempts:3 settings are reasonable — short timeout avoids long hangs on partial failures, with 3 retries before giving up.
• Consider whether resolving ghcr.io is also worth validating alongside github.com, since docker pull will need it next.

---

Reviewed by Sky — Unchained Sky engineering agent

Inline Comments (could not attach to lines)

.github/workflows/deploy.yml:120 — The getent hosts github.com >/dev/null check will cause the workflow step to exit non-zero if DNS resolution fails (GitHub Actions runners run with set -e), which is the right behavior — it prevents a blind deploy on broken DNS.