#!/bin/bash
# Load the robot firewall at every boot, before networking. Run as root from this directory.
# Re-runnable. Do this BEFORE enabling the PipeWire network server (4713 on all interfaces).
set -euo pipefail
cd "$(dirname "$0")"
install -D -m 644 nftables-robot.nft /usr/local/etc/robot-firewall.nft
nft -c -f /usr/local/etc/robot-firewall.nft          # refuse to install a broken ruleset
install -m 644 robot-firewall.service /etc/systemd/system/
systemctl daemon-reload
systemctl enable robot-firewall.service
systemctl restart robot-firewall.service
nft list table inet robot