Skip to content

fix: remove host-wide WireGuard dependency #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
protostatis merged 1 commit into from
Aug 13, 2026
Merged

fix: remove host-wide WireGuard dependency #102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 1 addition & 12 deletions .env.docker.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,10 @@ WHALE_ALERT_API_KEY=
# Etherscan (for on-chain data)
ETHERSCAN_API_KEY=

# ============================================
# WireGuard VPN (host outbound traffic)
# ============================================
# WireGuard remains enabled for normal crawler dependencies. Reddit HTML uses
# the cookie-backed Unbrowser transport described in docs/REDDIT_UNBROWSER_SETUP.md.
# Run deploy/setup-wireguard.sh to configure WireGuard.
WG_PRIVATE_KEY=your_wireguard_private_key
WG_ADDRESS=10.x.x.x/32
WG_DNS=10.64.0.1
WG_PEER_PUBKEY=server_public_key
WG_ENDPOINT=server_ip:51820

# ============================================
# Reddit Unbrowser Cookie Transport
# ============================================
# Production hosts use direct EC2 egress; do not configure a host-wide VPN.
# The release workflow sets REDDIT_FETCH_MODE and the Unix socket itself.
# Set this token only after configuring the local solver; never commit it.
UNBROWSER_COOKIE_SERVICE_TOKEN=
Expand Down
34 changes: 32 additions & 2 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,8 +117,38 @@ jobs:

cd /home/ec2-user/crypto_sentiment_crawler

# Keep WireGuard active for non-Reddit crawler dependencies. Reddit
# HTML is fetched by Unbrowser with a local cookie refresh socket.
# Retire the legacy host-wide WireGuard tunnel before any
# DNS-dependent deployment step. Reddit now uses the cookie-backed
# Unbrowser transport; all other traffic uses direct EC2 egress.
sudo systemctl disable --now wg-quick@wg0 >/dev/null 2>&1 || true
if /sbin/ip link show wg0 >/dev/null 2>&1; then
echo "Stopping legacy WireGuard interface..."
if ! command -v wg-quick >/dev/null 2>&1; then
echo "ERROR: wg0 is active but wg-quick is unavailable"
exit 1
fi
sudo wg-quick down wg0
fi
if /sbin/ip link show wg0 >/dev/null 2>&1; then
echo "ERROR: Legacy WireGuard interface is still active"
exit 1
fi
WG_UNIT_STATE=$(sudo systemctl is-enabled wg-quick@wg0 2>/dev/null || true)
case "$WG_UNIT_STATE" in
enabled|enabled-runtime|linked|linked-runtime)
echo "ERROR: Legacy WireGuard service remains enabled ($WG_UNIT_STATE)"
exit 1
;;
esac
sudo rm -f /etc/wireguard/wg0.conf
if ! timeout 15 getent ahostsv4 github.com >/dev/null 2>&1; then

@protostatis protostatis Aug 13, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Weak egress canary: the removed deploy/setup-wireguard.sh added static bypass routes for GitHub ranges (140.82.112.0/20, 185.199.108.0/22 in PostUp), so github.com DNS + robots.txt were reachable via direct EC2 even while the full tunnel and VPN-only DNS were installed. A host with a still-active (dead-peer) wg0 would pass this check and silently deploy with broken DNS for the exact feeds this PR fixes. Use api.coingecko.com (as docs/EC2_INSTANCES.md already does) for both the DNS and HTTPS egress checks, since that host was carried over the VPN and is the true signal of direct egress.

echo "ERROR: Direct EC2 DNS is unavailable after WireGuard cleanup"
exit 1
fi
if ! curl -fsS --connect-timeout 5 --max-time 15 https://github.com/robots.txt >/dev/null; then

@protostatis protostatis Aug 13, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as the DNS check above: github.com/robots.txt is not a meaningful direct-egress canary because GitHub was explicitly bypass-routed in the retired WireGuard config. Prefer a host like api.coingecko.com that actually traversed the VPN tunnel.

echo "ERROR: Direct EC2 HTTPS egress is unavailable after WireGuard cleanup"
exit 1
fi

# Pull latest code. Preserve any EC2-local edits so deployment can
# move to the release tag without discarding operational changes.
Expand Down
29 changes: 12 additions & 17 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,26 +68,21 @@ cd /opt/crypto-sentiment && docker-compose up -d

`deploy/push-to-ec2.sh <EC2_IP>` — packages local code, uploads via SCP, rebuilds on EC2. Only use if CI/CD is broken.

## Reddit Access via WireGuard VPN
## Reddit Access via Unbrowser

Reddit blocks AWS/EC2 IP addresses. A WireGuard VPN on the EC2 host routes
outbound crawler traffic through a clean IP.
Production uses direct EC2 egress. Reddit HTML is fetched by Unbrowser with
cookies supplied by a supervised Mac solver over a mode-0600 SSH Unix socket.
Do not enable a host-wide VPN: a dead full tunnel also blocks CoinGecko,
Telegram, and every other outbound feed.

### Setup (one-time):

1. Add WireGuard config to `/opt/crypto-sentiment/.env` (see `.env.docker.example` for template).
2. Run `deploy/setup-wireguard.sh /opt/crypto-sentiment/.env` on EC2.

### Verify VPN is active:
See `docs/REDDIT_UNBROWSER_SETUP.md` for setup and recovery. Quick checks:

```bash
# Should show the VPN egress IP, not the EC2 IP
curl https://httpbin.org/ip

# Check WireGuard status
sudo wg show
curl --unix-socket /opt/crypto-sentiment/run/reddit-cookie-solver.sock \
http://localhost/healthz
docker exec crypto-crawler sh -c 'test "$REDDIT_FETCH_MODE" = unbrowser'
```

### If crawler shows "No fresh posts" or 403 errors:
- VPN may be down: `sudo wg-quick up wg0`.
- Check status: `sudo systemctl status wg-quick@wg0`.
If the crawler shows repeated empty results, verify the solver/tunnel agents on
the Mac, the EC2 socket metadata, and the deployment canary before restarting
the crawler.
78 changes: 65 additions & 13 deletions deploy/push-to-ec2.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,17 +56,75 @@ echo "Deploying on EC2..."
ssh -i "$KEY_PATH" -o StrictHostKeyChecking=no "ec2-user@$EC2_IP" << 'ENDSSH'
set -e

# Extract application
sudo rm -rf /opt/crypto-sentiment/*
APP_DIR=/opt/crypto-sentiment
PERSIST_DIR=/tmp/crypto-sentiment-persist

# Retire the legacy host-wide VPN before any destructive deployment step.
# Reddit uses the cookie-backed Unbrowser transport in production.
sudo systemctl disable --now wg-quick@wg0 >/dev/null 2>&1 || true
if /sbin/ip link show wg0 >/dev/null 2>&1; then
echo "Stopping legacy WireGuard interface..."
if ! command -v wg-quick >/dev/null 2>&1; then
echo "ERROR: wg0 is active but wg-quick is unavailable"
exit 1
fi
sudo wg-quick down wg0
fi
if /sbin/ip link show wg0 >/dev/null 2>&1; then
echo "ERROR: Legacy WireGuard interface is still active"
exit 1
fi
WG_UNIT_STATE=$(sudo systemctl is-enabled wg-quick@wg0 2>/dev/null || true)
case "$WG_UNIT_STATE" in
enabled|enabled-runtime|linked|linked-runtime)
echo "ERROR: Legacy WireGuard service remains enabled ($WG_UNIT_STATE)"
exit 1
;;
esac
sudo rm -f /etc/wireguard/wg0.conf
if ! timeout 15 getent ahostsv4 github.com >/dev/null 2>&1; then

@protostatis protostatis Aug 13, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mirrors the deploy.yml canary gap: getent/curl on github.com won't detect a lingering full tunnel because GitHub was a hardcoded bypass route in the old PostUp. Switch the canary to api.coingecko.com to actually verify direct EC2 egress.

echo "ERROR: Direct EC2 DNS is unavailable after WireGuard cleanup"
exit 1
fi
if ! curl -fsS --connect-timeout 5 --max-time 15 https://github.com/robots.txt >/dev/null; then
echo "ERROR: Direct EC2 HTTPS egress is unavailable after WireGuard cleanup"
exit 1
fi

# Preserve runtime state before replacing application files.
rm -rf "$PERSIST_DIR"

@protostatis protostatis Aug 13, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PERSIST_DIR lives under /tmp (typically mode 1777), and the loop moves .env there with its original ownership/permissions intact. For the duration of the deploy, the API keys and UNBROWSER_COOKIE_SERVICE_TOKEN in .env are readable by any local user. Prefer a persist location outside /tmp (e.g. /var/tmp/crypto-sentiment-persist or a root-owned dir) and/or chmod 600 the staged .env after the mv.

mkdir -p "$PERSIST_DIR"
for name in data logs backups run .env; do
if [ -e "$APP_DIR/$name" ]; then
mv "$APP_DIR/$name" "$PERSIST_DIR/$name"

@protostatis protostatis Aug 13, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The persist-out phase (rm -rf $PERSIST_DIR through the for-loop mv) runs before the EXIT trap is installed, so an interruption mid-move leaves runtime state split between /opt and /tmp with no automatic restore. Consider installing the trap (or a targeted cleanup) before the move-out loop so a failed move cannot strand data.

fi
done

# Extract application. Restore runtime state even if extraction fails.
restore_runtime_state() {
sudo mkdir -p "$APP_DIR"
sudo chown ec2-user:ec2-user "$APP_DIR"
for name in data logs backups run .env; do
if [ -e "$PERSIST_DIR/$name" ]; then
rm -rf "$APP_DIR/$name"
mv "$PERSIST_DIR/$name" "$APP_DIR/$name"
fi
done
}
trap restore_runtime_state EXIT

sudo rm -rf "$APP_DIR"
sudo tar -xzf /tmp/crypto-sentiment.tar.gz -C /opt
sudo mv /opt/app/* /opt/crypto-sentiment/
sudo rmdir /opt/app
sudo chown -R ec2-user:ec2-user /opt/crypto-sentiment
sudo mv /opt/app "$APP_DIR"
sudo chown -R ec2-user:ec2-user "$APP_DIR"
restore_runtime_state
trap - EXIT
rm -rf "$PERSIST_DIR"

cd /opt/crypto-sentiment
cd "$APP_DIR"

# Create data directories
mkdir -p data logs
mkdir -p data logs backups run

# Check for .env file
if [ ! -f .env ]; then
Expand All @@ -77,12 +135,6 @@ if [ ! -f .env ]; then
echo ""
fi

# Setup WireGuard VPN if configured
if grep -q WG_PRIVATE_KEY .env 2>/dev/null; then
echo "Setting up WireGuard VPN..."
bash deploy/setup-wireguard.sh .env
fi

# Build and start services
echo "Building Docker images..."
docker-compose build --no-cache
Expand Down
83 changes: 0 additions & 83 deletions deploy/setup-wireguard.sh
View file
Open in desktop

This file was deleted.

Loading
Loading