17 lines
911 B
Text
17 lines
911 B
Text
|
# What wg-quick@wg-halkyon needs beyond wg-quick itself on the instance's host at home
|
||
|
|
# (ADR 0039, D9, D12), as /etc/systemd/system/wg-quick@wg-halkyon.service.d/halkyon.conf.
|
||
|
|
#
|
||
|
|
# The tunnel comes up before Docker: Caddy publishes 443 on the tunnel's address alone
|
||
|
|
# (compose.forwarded.yaml), which must exist when Docker starts the container.
|
||
|
|
#
|
||
|
|
# Its rules (wg-halkyon.nft) are loaded here, before the interface exists, and deleted
|
||
|
|
# after it is gone, so the tunnel is never up without them: they match it by name. Not
|
||
|
|
# by wg-quick's PostUp, as on ramiel: Ubuntu 26.04 confines wg-quick in an AppArmor
|
||
|
|
# profile whose nft may read nothing in /etc/wireguard (found 8 Nov 2026), and which
|
||
|
|
# no local override reaches. systemd runs these unconfined.
|
||
|
|
[Unit]
|
||
|
|
Before=docker.service
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
ExecStartPre=/usr/sbin/nft -f /etc/wireguard/wg-halkyon.nft
|
||
|
|
ExecStopPost=-/usr/sbin/nft delete table inet halkyon_tunnel
|