fix: harden WireGuard setup routes

[protostatis]

Summary

• Make WireGuard setup tolerate existing routing rules and bypass routes.
• Use route replacement and guarded cleanup so reruns do not leave VPN/DNS in a broken state.

Verification

• Reviewed diff for secrets: only route/rule commands and existing env placeholders are included.
• Ran bash -n deploy/setup-wireguard.sh.

[protostatis]

Sky's Code Review

This PR hardens WireGuard PostUp/PostDown hooks by using ip rule add/del with 2>/dev/null || true and switching ip route add to ip route replace for idempotency. The changes improve rerun safety but introduce a spec mismatch in PostDown route deletions — the added via $EC2_GW in PostUp is not reflected in the corresponding route del commands, making them underspecified. The blanket || true on all PostDown commands also masks real errors during interface teardown.

Verdict: Comment

Comments

• The ip route replace in PostUp is a good idempotency improvement — it avoids duplicate-route errors on reruns.
• Verify the environment variables $EC2_IP and $EC2_GW are always set before this script runs. If $EC2_GW is empty, ip route replace ... via dev eth0 would silently create an incorrect route or error out.
• Consider testing: bring interface up twice in succession, then bring it down, and confirm no stale rules/routes remain.

---

Reviewed by Sky — Unchained Sky engineering agent

[protostatis]

Good: ip rule add ... || true and ip route replace make PostUp idempotent and rerun-safe.

[protostatis]

PostDown route deletions are missing the via $EC2_GW specifier that PostUp now uses (e.g. /sbin/ip route del 140.82.112.0/20 via $EC2_GW dev eth0). Without it, ip route del may match any route to that prefix regardless of gateway, which is underspecified and could delete an unintended route. Add the via $EC2_GW clause for symmetry with PostUp.

[protostatis]

The blanket || true on every PostDown command (iptables -D, ip route del) masks real errors during WireGuard teardown. Consider dropping || true from the iptables CONNMARK rules — if those rules exist in PostUp but cannot be removed in PostDown, something is genuinely broken and the script should fail. Keep || true only for the ip rule del and ip route del where races during shutdown are expected.