# Housecarl: loads the last confirmed ruleset at boot, before the network
# comes up and whether or not housecarld starts.
# Installed as /etc/systemd/system/housecarl-ruleset.service.
[Unit]
Description=Housecarl firewall ruleset
Documentation=file:///usr/local/share/doc/housecarl/README.md
DefaultDependencies=no
Before=network-pre.target shutdown.target
Wants=network-pre.target
# Debian's nftables.service flushes the whole ruleset: Housecarl's loads after it.
After=nftables.service local-fs.target
Conflicts=shutdown.target
ConditionPathExists=/var/lib/housecarl/ruleset.nft

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /var/lib/housecarl/ruleset.nft

[Install]
WantedBy=sysinit.target