Repository navigation
wireguard: tolerate a failed public IP lookup - #2976
Merged
Merged
Conversation
prepare-wireguard-configuration.sh fills the manager's public address into the WireGuard client configuration with an unquoted $(curl my.ip.fi) inside the sed expression. When my.ip.fi answers with an error page, curl still exits 0, the HTML is word-split into sed's arguments and the deployment dies with sed: -e expression #1, char 37: unterminated `s' command which says nothing about the actual cause. It happened on 2026-01-04 and 2026-10-18, both times with nginx's 502 Bad Gateway page. The address is only used by the client configuration that users fetch with the terraform Makefile's WireGuard target; nothing in the deployment reads it. Losing a deployment over it is not warranted. Fetch the address with curl -f, so HTTP errors count as failures, and retry with a timeout. Only substitute it when it looks like an IPv4 or IPv6 address. Otherwise print a warning and leave the WIREGUARD_PUBLIC_IP_ADDRESS placeholder, so the configuration visibly needs a manual edit, and continue. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
scripts/prepare-wireguard-configuration.shsubstitutes$(curl my.ip.fi)unquoted into a sed expression. When my.ip.fi returns an error page, curl still exits 0, the HTML is word-split into sed's arguments, and the deploy aborts in "Deploy manager + bootstrap nodes" withSeen twice, both with a 157-byte body (nginx's default 502 page):
4cd1178d)b5a3aa13)The address only ends up in the client config fetched by the terraform Makefile's WireGuard target; the deployment never reads it. So:
curl -fsS --retry 3 --max-time 10— HTTP errors fail, short outages are retriedWIREGUARD_PUBLIC_IP_ADDRESSplaceholder, and continueTested locally with a stub
curl(IPv4, IPv6, curl -f failure, HTML body with exit 0); shellcheck clean.🤖 Generated with Claude Code