diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-20 15:46:09 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-20 15:46:09 -0500 |
| commit | 36daf763d4007eccbb5608de0e77278c2f5a1135 (patch) | |
| tree | 6cd4d02d96ff745ff1d09a466a58a9f7cd5a5dd7 /working/clock-display-references | |
| parent | 948a1fc0fbc300076b6f5b605a6a555c1b50e66a (diff) | |
| download | archsetup-36daf763d4007eccbb5608de0e77278c2f5a1135.tar.gz archsetup-36daf763d4007eccbb5608de0e77278c2f5a1135.zip | |
fix(wireguard): bring the tunnel down before the rename modify
`nmcli connection import` activates a full-tunnel (0.0.0.0/0) Proton profile immediately. The import loop renamed and set autoconnect off, then brought the tunnel down. Under `set -euo pipefail`, a failed modify aborted the script before that down ran, leaving a live full-tunnel VPN routing all traffic through Proton -- the exact unasked-for VPN the script exists to prevent. The next-run guard catches the leftover profile but not the still-active tunnel.
Moved the down ahead of the modify. It targets the UUID, which is stable across the rename, so downing first is safe and no failure between import and modify can leave the tunnel up.
Diffstat (limited to 'working/clock-display-references')
0 files changed, 0 insertions, 0 deletions