# Housecarl: loads the last confirmed ruleset at boot, before the network
# comes up and whether or not housecarld starts. If it fails to load, the
# fallback housecarld saved beside it is loaded instead: nothing new gets
# in from external zones (docs/operations.md), and the unit is marked
# failed, until housecarld starts and puts the real ruleset back.
# Installed as /etc/systemd/system/housecarl-ruleset.service.
[Unit]
Description=Housecarl firewall ruleset
Documentation=file:///usr/local/share/doc/housecarl/README.md
DefaultDependencies=no
Before=network-pre.target shutdown.target
Wants=network-pre.target
# Debian's nftables.service flushes the whole ruleset: Housecarl's loads after it.
After=nftables.service local-fs.target
Conflicts=shutdown.target
ConditionPathExists=/var/lib/housecarl/ruleset.nft

[Service]
Type=oneshot
RemainAfterExit=yes
# "<2>": logged as critical.
ExecStart=/bin/sh -c '/usr/sbin/nft -f /var/lib/housecarl/ruleset.nft && exit 0; echo "<2>the saved ruleset failed to load: loading the fallback (nothing new gets in from external zones) until housecarld puts the real one back" >&2; /usr/sbin/nft -f /var/lib/housecarl/ruleset-fallback.nft; exit 1'

[Install]
WantedBy=sysinit.target