Skip to content

Tolerate read-only EC2 resolver during deploy #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
protostatis merged 1 commit into from
Jun 1, 2026
Merged

Tolerate read-only EC2 resolver during deploy #62

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 28 additions & 6 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,14 +111,34 @@ jobs:
# Disable the legacy Reddit VPN before the first GitHub/Docker
# network operation. This deploy path now uses an app-level proxy.
echo "Disabling legacy WireGuard before network operations."
sudo systemctl disable --now wg-quick@wg0 2>/dev/null || true
sudo systemctl stop wg-quick@wg0 2>/dev/null || true
sudo wg-quick down wg0 2>/dev/null || true
sudo systemctl disable wg-quick@wg0 2>/dev/null || true

# wg-quick can leave the host pointed at VPN DNS after shutdown.
# Restore the EC2 VPC resolver so git fetch and docker pull can
# resolve github.com/ghcr.io before the deploy proceeds.
echo "Restoring EC2 DNS resolver."
sudo sh -c 'printf "nameserver 169.254.169.253\noptions timeout:2 attempts:3\n" > /etc/resolv.conf'
# Prefer systemd-resolved recovery because /etc/resolv.conf may be
# a read-only managed mount on EC2 images.
echo "Restoring EC2 DNS resolver if needed."
if ! getent hosts github.com >/dev/null || ! getent hosts ghcr.io >/dev/null; then
sudo systemctl restart systemd-resolved 2>/dev/null || true

DEFAULT_IFACE=$(ip route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}')
if [ -n "$DEFAULT_IFACE" ] && command -v resolvectl >/dev/null 2>&1; then
sudo resolvectl revert wg0 2>/dev/null || true
sudo resolvectl dns "$DEFAULT_IFACE" 169.254.169.253 1.1.1.1 8.8.8.8 2>/dev/null || true
sudo resolvectl domain "$DEFAULT_IFACE" "~." 2>/dev/null || true
sudo resolvectl flush-caches 2>/dev/null || true
fi

if ! getent hosts github.com >/dev/null || ! getent hosts ghcr.io >/dev/null; then
echo "systemd DNS recovery did not resolve GitHub hosts; trying /etc/resolv.conf fallback."
if ! sudo sh -c 'printf "nameserver 169.254.169.253\nnameserver 1.1.1.1\nnameserver 8.8.8.8\noptions timeout:2 attempts:3\n" > /etc/resolv.conf' 2>/dev/null; then
echo "WARNING: Could not write /etc/resolv.conf; continuing to final DNS check."
fi
fi
fi
getent hosts github.com >/dev/null
getent hosts ghcr.io >/dev/null

# Pull latest code. Preserve any EC2-local edits so deployment can
# move to the release tag without discarding operational changes.
Expand All @@ -144,7 +164,9 @@ jobs:
CRAWLER_ENV_ARGS="--env-file /opt/crypto-sentiment/.env"
if grep -Eq '^(PROXY_URL|RESIDENTIAL_PROXY)=[^[:space:]]+' /opt/crypto-sentiment/.env; then
echo "Residential proxy configured; WireGuard is not needed for Reddit."
sudo systemctl disable --now wg-quick@wg0 2>/dev/null || true
sudo systemctl stop wg-quick@wg0 2>/dev/null || true
sudo wg-quick down wg0 2>/dev/null || true
sudo systemctl disable wg-quick@wg0 2>/dev/null || true
fi
else
echo "WARNING: /opt/crypto-sentiment/.env not found; crawler will run without local env config"
Expand Down
Loading