Re: [PATCH pve-firewall v2 06/12] fix #5759: firewall: restore from dumped config before network-pre

[Stefan Hanreich <s.hanreich@proxmox.com>]

> pve-firewall depends on pve-cluster for its config, pve-cluster
> depends on corosync, which itself depends on network-online. This
> creates a window at boot where the network is up with no protection.
> 
> To address this, add a simple oneshot service depending on
> network-pre [0] that applies the last remembered rules to bridge the gap
> until the configured firewall daemon takes over.
> 
> [0] https://systemd.io/NETWORK_ONLINE/
> 
> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=5759
> Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
> Reviewed-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> Tested-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
>
> diff --git a/debian/pve-firewall-pre-network.service b/debian/pve-firewall-pre-network.service
> new file mode 100644
> index 0000000..e1127e4
> --- /dev/null
> +++ b/debian/pve-firewall-pre-network.service
> @@ -0,0 +1,16 @@
> +[Unit]
> +Description=Proxmox VE Pre-Network iptables Firewall
> +Wants=network-pre.target
> +Before=network-pre.target shutdown.target
> +Conflicts=shutdown.target
> +DefaultDependencies=no
> +After=local-fs.target
> +
> +[Service]
> +Type=oneshot
> +ExecStart=/usr/sbin/pve-firewall restore
> +RemainAfterExit=true
> +Environment=PVE_LOG=info

Is this potentially a leftover from the nftables service? Afaik
there's no such envvar for pve-firewall.

-- 
Stefan Hanreich <s.hanreich@proxmox.com>