From dc406c4f56da0b1025b061689749a6ae43239676 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 5 Oct 2026 13:41:57 +1100
Subject: [PATCH] Add boot unit applying a local config

---
 packaging/nfpm.yaml              | 11 +++++++++++
 packaging/tomswall-agent.service |  1 +
 packaging/tomswall.env           |  2 ++
 packaging/tomswall.service       | 19 +++++++++++++++++++
 4 files changed, 33 insertions(+)
 create mode 100644 packaging/tomswall.env
 create mode 100644 packaging/tomswall.service

diff --git a/packaging/nfpm.yaml b/packaging/nfpm.yaml
index 823bd11..a74f673 100644
--- a/packaging/nfpm.yaml
+++ b/packaging/nfpm.yaml
@@ -47,6 +47,17 @@ contents:
     file_info:
       mode: 0640
 
+  # systemd unit + environment file for applying a local config at boot.
+  - src: packaging/tomswall.service
+    dst: /usr/lib/systemd/system/tomswall.service
+    file_info:
+      mode: 0644
+  - src: packaging/tomswall.env
+    dst: /etc/tomswall/tomswall.env
+    type: config|noreplace
+    file_info:
+      mode: 0644
+
   # Shell completions (generated by scripts/build-rpm.sh before packaging).
   - src: dist/completions/tomswall.bash
     dst: /usr/share/bash-completion/completions/tomswall
diff --git a/packaging/tomswall-agent.service b/packaging/tomswall-agent.service
index 8996b03..f078634 100644
--- a/packaging/tomswall-agent.service
+++ b/packaging/tomswall-agent.service
@@ -3,6 +3,7 @@ Description=tomswall control-plane agent (pull and apply firewall config)
 Documentation=https://git.unkin.net/unkin/tomswall
 After=network-online.target
 Wants=network-online.target
+Conflicts=tomswall.service
 
 [Service]
 Type=simple
diff --git a/packaging/tomswall.env b/packaging/tomswall.env
new file mode 100644
index 0000000..883006c
--- /dev/null
+++ b/packaging/tomswall.env
@@ -0,0 +1,2 @@
+# Config applied by tomswall.service: a tomswall YAML file or a shorewall directory.
+TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
diff --git a/packaging/tomswall.service b/packaging/tomswall.service
new file mode 100644
index 0000000..622d0a5
--- /dev/null
+++ b/packaging/tomswall.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=tomswall firewall (apply local config at boot)
+Documentation=https://git.unkin.net/unkin/tomswall
+Wants=network-pre.target
+Before=network-pre.target
+After=local-fs.target systemd-sysctl.service
+Conflicts=tomswall-agent.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
+EnvironmentFile=-/etc/tomswall/tomswall.env
+ExecStart=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
+ExecReload=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
+# No ExecStop: stopping the unit leaves the ruleset in place (flush would open the firewall).
+
+[Install]
+WantedBy=basic.target