#!/bin/sh
set -eu
case "${1:-start}" in
start|reload|restart|force-reload)
    # Atomic replacement before Tailscale/Docker chains; explicitly permits Tailscale UDP.
    if /usr/sbin/nft list table inet ufw_cup_guard >/dev/null 2>&1; then
        { echo 'delete table inet ufw_cup_guard'; cat /etc/ufw/cup-guard.nft; } | /usr/sbin/nft -f -
    else
        /usr/sbin/nft -f /etc/ufw/cup-guard.nft
    fi
    ;;
stop|flush-all) /usr/sbin/nft delete table inet ufw_cup_guard 2>/dev/null || true ;;
status) /usr/sbin/nft list table inet ufw_cup_guard ;;
esac
