From 7fcbb5fad8f4fd66ba3e3db13700148ec01478b8 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 5 Oct 2026 13:44:58 +1100
Subject: [PATCH] Order boot unit before sysinit and retry on failure

---
 packaging/tomswall.env     |  1 +
 packaging/tomswall.service | 10 +++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/packaging/tomswall.env b/packaging/tomswall.env
index 883006c..de01378 100644
--- a/packaging/tomswall.env
+++ b/packaging/tomswall.env
@@ -1,2 +1,3 @@
 # Config applied by tomswall.service: a tomswall YAML file or a shorewall directory.
 TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
+#TOMSWALL_CONFIG=/etc/shorewall
diff --git a/packaging/tomswall.service b/packaging/tomswall.service
index 622d0a5..61f1931 100644
--- a/packaging/tomswall.service
+++ b/packaging/tomswall.service
@@ -1,10 +1,11 @@
 [Unit]
 Description=tomswall firewall (apply local config at boot)
 Documentation=https://git.unkin.net/unkin/tomswall
+DefaultDependencies=no
 Wants=network-pre.target
-Before=network-pre.target
+Before=network-pre.target shutdown.target
 After=local-fs.target systemd-sysctl.service
-Conflicts=tomswall-agent.service
+Conflicts=shutdown.target tomswall-agent.service
 
 [Service]
 Type=oneshot
@@ -13,7 +14,10 @@ Environment=TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
 EnvironmentFile=-/etc/tomswall/tomswall.env
 ExecStart=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
 ExecReload=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
+# Fails open: once restarts are exhausted, boot continues without the ruleset.
+Restart=on-failure
+RestartSec=5
 # No ExecStop: stopping the unit leaves the ruleset in place (flush would open the firewall).
 
 [Install]
-WantedBy=basic.target
+WantedBy=sysinit.target