forked from heavy-duty/box
043e556027
Found by running the drill on a real host, which I could not do before. The unit is Type=oneshot with no RemainAfterExit, so systemd marks it 'inactive (dead)' the moment ExecStart succeeds. The rules are applied and the box-to-box drop is live, and the unit still reads as though it died. That is precisely the question people ask this unit: drill.sh's own failure hint sends you to 'systemctl status box-firewall.service' to find out whether the firewall came up, and today the honest answer and the alarming one look identical. setup-host.sh already believed this was set — 'The unit is RemainAfterExit, so once it has run it stays "active" forever' — and reasoned from it to explain why it uses restart instead of 'enable --now'. The reasoning is right and the restart is right; only the unit was missing the line the comment assumed. Verified live: before, 'nft list table bridge box' showed the drop present while is-active said inactive. After, is-active says active (exited) with the drop still present, and restart still re-applies. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| box-firewall.service | ||
| box-firewall.sh | ||
| migrate-host.sh | ||
| setup-host.sh | ||
| teardown-host.sh | ||