#!/bin/sh
# Atomic replacement of this table only; existing Tailscale rules survive.
set -eu
export PATH=/usr/sbin:/usr/bin:/sbin:/bin
exec 9>/run/lock/cup-guard.lock
flock -x 9
rules=$(mktemp /run/cup-guard.XXXXXX)
trap 'rm -f "$rules"' EXIT HUP INT TERM
if nft list table inet cup_guard >/dev/null 2>&1; then
    printf '%s\n' 'delete table inet cup_guard' > "$rules"
fi
cat /etc/nftables.d/cup-guard.nft >> "$rules"
nft --check --file "$rules"
nft --file "$rules"
