[Unit]
# Deliberately the same shape as /etc/systemd/system/node_exporter_nft_guard.service,
# which is this host's established pattern for a composable guard table
# that lives alongside ufw's own ip/ip6 filter tables rather than fighting
# them. Ordered Before= the VM unit so a guest can never run with the
# second layer absent - though note the FIRST layer is IPAddressDeny= in
# owuivm.service, which does not depend on this unit at all.
Description=Second-layer egress filter for the owuitools VM sandbox
Documentation=https://documentation.ubuntu.com/security/security-features/network/firewall/nftables/
Before=owuivm.service owuivm-maint.service
After=local-fs.target
ConditionPathExists=/etc/nftables.d/60-owuivm.nft

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sh -c '/usr/sbin/nft delete table inet owuivm_guard >/dev/null 2>&1 || true; exec /usr/sbin/nft -f /etc/nftables.d/60-owuivm.nft'
ExecStop=/bin/sh -c '/usr/sbin/nft delete table inet owuivm_guard >/dev/null 2>&1 || true'

[Install]
WantedBy=multi-user.target