043e556027
Found by running the drill on a real host, which I could not do before. The unit is Type=oneshot with no RemainAfterExit, so systemd marks it 'inactive (dead)' the moment ExecStart succeeds. The rules are applied and the box-to-box drop is live, and the unit still reads as though it died. That is precisely the question people ask this unit: drill.sh's own failure hint sends you to 'systemctl status box-firewall.service' to find out whether the firewall came up, and today the honest answer and the alarming one look identical. setup-host.sh already believed this was set — 'The unit is RemainAfterExit, so once it has run it stays "active" forever' — and reasoned from it to explain why it uses restart instead of 'enable --now'. The reasoning is right and the restart is right; only the unit was missing the line the comment assumed. Verified live: before, 'nft list table bridge box' showed the drop present while is-active said inactive. After, is-active says active (exited) with the drop still present, and restart still re-applies. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
19 lines
731 B
Desktop File
19 lines
731 B
Desktop File
[Unit]
|
|
Description=Re-apply box host firewall rules
|
|
# After docker so DOCKER-USER exists; still fine if docker is absent.
|
|
After=network.target incus.service docker.service
|
|
Wants=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# The unit's state must mean "the rules are applied", because that is the
|
|
# question everyone asks it — drill.sh sends you to 'systemctl status
|
|
# box-firewall' to diagnose exactly that. Without this, a oneshot goes
|
|
# 'inactive (dead)' the moment it succeeds, so a host whose isolation is
|
|
# perfectly live reads as a host whose firewall unit died. setup-host.sh's
|
|
# comment already assumed this was set; it was not.
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/box-firewall
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|