Order boot unit before sysinit and retry on failure

packaging/tomswall.env

@@ -1,2 +1,3 @@
 # Config applied by tomswall.service: a tomswall YAML file or a shorewall directory.
 TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
+#TOMSWALL_CONFIG=/etc/shorewall

packaging/tomswall.service

@@ -1,10 +1,11 @@
 [Unit]
 Description=tomswall firewall (apply local config at boot)
 Documentation=https://git.unkin.net/unkin/tomswall
+DefaultDependencies=no
 Wants=network-pre.target
-Before=network-pre.target
+Before=network-pre.target shutdown.target
 After=local-fs.target systemd-sysctl.service
-Conflicts=tomswall-agent.service
+Conflicts=shutdown.target tomswall-agent.service
 
 [Service]
 Type=oneshot
@@ -13,7 +14,10 @@ Environment=TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
 EnvironmentFile=-/etc/tomswall/tomswall.env
 ExecStart=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
 ExecReload=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
+# Fails open: once restarts are exhausted, boot continues without the ruleset.
+Restart=on-failure
+RestartSec=5
 # No ExecStop: stopping the unit leaves the ruleset in place (flush would open the firewall).
 
 [Install]
-WantedBy=basic.target
+WantedBy=sysinit.target