admin
a34aac64d0
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
20 lines
813 B
Desktop File
20 lines
813 B
Desktop File
# felhom-oob-nft.service (TASK H1) — install as /etc/systemd/system/felhom-oob-nft.service.
|
|
#
|
|
# Loads the STATIC felhom_oob belt table on boot (the agent then fills its sets each tick). Oneshot +
|
|
# RemainAfterExit so `systemctl status` reflects "loaded". Independent of pve-firewall/nftables.service
|
|
# (the table is a self-contained `inet felhom_oob`, additive — it never flushes the ruleset).
|
|
[Unit]
|
|
Description=Felhom OOB belt — load the static felhom_oob nft table (H1)
|
|
After=network-pre.target
|
|
Before=network.target felhom-agent.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/sbin/nft -f /etc/felhom-oob.nft
|
|
# On stop, remove the table (best-effort) so an uninstall/disable leaves nft clean.
|
|
ExecStop=-/usr/sbin/nft delete table inet felhom_oob
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|