# felhom-oob-nft.service (TASK H1) — install as /etc/systemd/system/felhom-oob-nft.service.
#
# Loads the STATIC felhom_oob belt table on boot (the agent then fills its sets each tick). Oneshot +
# RemainAfterExit so `systemctl status` reflects "loaded". Independent of pve-firewall/nftables.service
# (the table is a self-contained `inet felhom_oob`, additive — it never flushes the ruleset).
[Unit]
Description=Felhom OOB belt — load the static felhom_oob nft table (H1)
After=network-pre.target
Before=network.target felhom-agent.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/felhom-oob.nft
# On stop, remove the table (best-effort) so an uninstall/disable leaves nft clean.
ExecStop=-/usr/sbin/nft delete table inet felhom_oob

[Install]
WantedBy=multi-user.target