[Unit]
Description=Robot firewall: audio, MCP and webhook ports only over the USB link
Before=network-pre.target
Wants=network-pre.target
DefaultDependencies=no
After=local-fs.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /usr/local/etc/robot-firewall.nft
ExecStop=/usr/sbin/nft delete table inet robot

[Install]
WantedBy=multi-user.target