From 9392ff4d42939f29e655b98e4d0e526ce025e12e Mon Sep 17 00:00:00 2001 From: "protostatis.dev" Date: Mon, 1 Jun 2026 08:10:33 -0500 Subject: [PATCH] fix: tolerate read-only EC2 resolver --- .github/workflows/deploy.yml | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 42c4f5b..10ac1ff 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -111,14 +111,34 @@ jobs: # Disable the legacy Reddit VPN before the first GitHub/Docker # network operation. This deploy path now uses an app-level proxy. echo "Disabling legacy WireGuard before network operations." - sudo systemctl disable --now wg-quick@wg0 2>/dev/null || true + sudo systemctl stop wg-quick@wg0 2>/dev/null || true + sudo wg-quick down wg0 2>/dev/null || true + sudo systemctl disable wg-quick@wg0 2>/dev/null || true # wg-quick can leave the host pointed at VPN DNS after shutdown. - # Restore the EC2 VPC resolver so git fetch and docker pull can - # resolve github.com/ghcr.io before the deploy proceeds. - echo "Restoring EC2 DNS resolver." - sudo sh -c 'printf "nameserver 169.254.169.253\noptions timeout:2 attempts:3\n" > /etc/resolv.conf' + # Prefer systemd-resolved recovery because /etc/resolv.conf may be + # a read-only managed mount on EC2 images. + echo "Restoring EC2 DNS resolver if needed." + if ! getent hosts github.com >/dev/null || ! getent hosts ghcr.io >/dev/null; then + sudo systemctl restart systemd-resolved 2>/dev/null || true + + DEFAULT_IFACE=$(ip route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}') + if [ -n "$DEFAULT_IFACE" ] && command -v resolvectl >/dev/null 2>&1; then + sudo resolvectl revert wg0 2>/dev/null || true + sudo resolvectl dns "$DEFAULT_IFACE" 169.254.169.253 1.1.1.1 8.8.8.8 2>/dev/null || true + sudo resolvectl domain "$DEFAULT_IFACE" "~." 2>/dev/null || true + sudo resolvectl flush-caches 2>/dev/null || true + fi + + if ! getent hosts github.com >/dev/null || ! getent hosts ghcr.io >/dev/null; then + echo "systemd DNS recovery did not resolve GitHub hosts; trying /etc/resolv.conf fallback." + if ! sudo sh -c 'printf "nameserver 169.254.169.253\nnameserver 1.1.1.1\nnameserver 8.8.8.8\noptions timeout:2 attempts:3\n" > /etc/resolv.conf' 2>/dev/null; then + echo "WARNING: Could not write /etc/resolv.conf; continuing to final DNS check." + fi + fi + fi getent hosts github.com >/dev/null + getent hosts ghcr.io >/dev/null # Pull latest code. Preserve any EC2-local edits so deployment can # move to the release tag without discarding operational changes. @@ -144,7 +164,9 @@ jobs: CRAWLER_ENV_ARGS="--env-file /opt/crypto-sentiment/.env" if grep -Eq '^(PROXY_URL|RESIDENTIAL_PROXY)=[^[:space:]]+' /opt/crypto-sentiment/.env; then echo "Residential proxy configured; WireGuard is not needed for Reddit." - sudo systemctl disable --now wg-quick@wg0 2>/dev/null || true + sudo systemctl stop wg-quick@wg0 2>/dev/null || true + sudo wg-quick down wg0 2>/dev/null || true + sudo systemctl disable wg-quick@wg0 2>/dev/null || true fi else echo "WARNING: /opt/crypto-sentiment/.env not found; crawler will run without local env config"