Initial Commit

vm/host/owuivm-nft-guard.service

@@ -0,0 +1,21 @@
+[Unit]
+# Deliberately the same shape as /etc/systemd/system/node_exporter_nft_guard.service,
+# which is this host's established pattern for a composable guard table
+# that lives alongside ufw's own ip/ip6 filter tables rather than fighting
+# them. Ordered Before= the VM unit so a guest can never run with the
+# second layer absent - though note the FIRST layer is IPAddressDeny= in
+# owuivm.service, which does not depend on this unit at all.
+Description=Second-layer egress filter for the owuitools VM sandbox
+Documentation=https://documentation.ubuntu.com/security/security-features/network/firewall/nftables/
+Before=owuivm.service owuivm-maint.service
+After=local-fs.target
+ConditionPathExists=/etc/nftables.d/60-owuivm.nft
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/sh -c '/usr/sbin/nft delete table inet owuivm_guard >/dev/null 2>&1 || true; exec /usr/sbin/nft -f /etc/nftables.d/60-owuivm.nft'
+ExecStop=/bin/sh -c '/usr/sbin/nft delete table inet owuivm_guard >/dev/null 2>&1 || true'
+
+[Install]
+WantedBy=multi-user.target