# Packet Station: only NPM on docker-1 (TRUSTED_PROXY_HOST) and the VM itself may reach port 8000.
# Loads /etc/packetstation/packetstation.nft, which deploy/vm/install.sh writes from the env file.
# The table is Packet Station's own (inet packetstation); other rules on the VM are left alone.
[Unit]
Description=Packet Station firewall for the app port
Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
Before=network-pre.target packetstation-app.service
Wants=network-pre.target
# A restart of nftables.service flushes the whole ruleset. Load the table again after it.
After=nftables.service
PartOf=nftables.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/packetstation/packetstation.nft
ExecReload=/usr/sbin/nft -f /etc/packetstation/packetstation.nft
ExecStop=-/usr/sbin/nft delete table inet packetstation

[Install]
WantedBy=multi-user.target