#!/bin/sh
# "svctl reload nftables" applies a changed ruleset WITHOUT emptying the kernel
# in between.
#
# This exists because of what a restart does to a oneshot: down first, then up.
# The down flushes the ruleset, and if the new file does not parse, the up
# refuses -- leaving the machine with no filtering and no NAT at all. On a
# router that is the worst possible outcome of a typo. (systemctl restart
# nftables behaves exactly the same way; this is not an s6 peculiarity.)
#
# The up script validates before it loads, and /etc/nftables.conf begins with
# "flush ruleset", so a successful reload replaces the old ruleset and a failed
# one leaves it untouched. Applying a new ruleset is therefore a reload here,
# not a restart.
exec /usr/lib/nftables-s6/nftables-up
