fix(wireguard): bring the tunnel down before the rename modify

`nmcli connection import` activates a full-tunnel (0.0.0.0/0) Proton profile immediately. The import loop renamed and set autoconnect off, then brought the tunnel down. Under `set -euo pipefail`, a failed modify aborted the script before that down ran, leaving a live full-tunnel VPN routing all traffic through Proton -- the exact unasked-for VPN the script exists to prevent. The next-run guard catches the leftover profile but not the still-active tunnel.

Moved the down ahead of the modify. It targets the UUID, which is stable across the rename, so downing first is safe and no failure between import and modify can leave the tunnel up.

1 files changed, 5 insertions, 3 deletions

diff --git a/scripts/import-wireguard-configs.sh b/scripts/import-wireguard-configs.sh
index 9e42033..e1db5a6 100755
--- a/scripts/import-wireguard-configs.sh
+++ b/scripts/import-wireguard-configs.sh
@@ -55,11 +55,13 @@ for conf in "$dir"/*.conf; do
         echo "  $out" >&2
         exit 1
     fi
+    # nmcli import auto-activates a full-tunnel (0.0.0.0/0) profile. Bring it
+    # down FIRST, before the rename/modify that could fail under set -e, so a
+    # failed modify can never leave a live unasked-for VPN up. A profile that
+    # didn't activate makes this a harmless no-op.
+    nmcli connection down "$uuid" >/dev/null 2>&1 || true
     nmcli connection modify "$uuid" connection.id "$name" \
         connection.autoconnect no
-    # nmcli import auto-activates; bring it back down so importing never leaves
-    # a tunnel up. A profile that didn't activate makes this a harmless no-op.
-    nmcli connection down "$uuid" >/dev/null 2>&1 || true
     echo "imported: $name (inactive, autoconnect off, iface wgpvpn)"
 done
 [ "$found" = 1 ] || { echo "no .conf files in $dir" >&2; exit 1; }