From 1e9834fc0dfc46aeb0b5507009bf8051cfacc47f Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Sat, 20 Jun 2026 22:35:25 +0200
Subject: [PATCH] =?UTF-8?q?feat(wg):=20clusev-wg-gate.service=20=E2=80=94?=
 =?UTF-8?q?=20boot/docker-restart=20gate=20persistence?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docker/wg/clusev-wg-gate.service | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 docker/wg/clusev-wg-gate.service

diff --git a/docker/wg/clusev-wg-gate.service b/docker/wg/clusev-wg-gate.service
new file mode 100644
index 0000000..4663701
--- /dev/null
+++ b/docker/wg/clusev-wg-gate.service
@@ -0,0 +1,25 @@
+# Clusev WireGuard gate — persistence oneshot (HOST-side).
+#
+# Re-applies the CLUSEV-WG-GATE iptables chain after boot and after a Docker daemon restart (Docker
+# flushes DOCKER-USER). It is a no-op unless BOTH are true:
+#   - wg0 is up        (ConditionPathExists below — a failed wg0 on boot leaves the panel OPEN, not bricked)
+#   - the gate marker  (/etc/clusev/wg-gate.enabled, checked inside `clusev-wg.sh gate-apply`)
+# So `clusev wg down` (removes the marker) survives a reboot, and a tunnel that fails to come up never
+# drops the panel with no way in. install.sh rewrites the /home/nexxo/clusev paths to the real tree.
+[Unit]
+Description=Clusev WireGuard gate — re-apply the panel firewall when wg0 is up
+After=docker.service wg-quick@wg0.service
+Wants=docker.service
+ConditionPathExists=/sys/class/net/wg0
+
+[Service]
+Type=oneshot
+User=root
+Environment=CLUSEV_DIR=/home/nexxo/clusev
+WorkingDirectory=/home/nexxo/clusev
+ExecStart=/home/nexxo/clusev/docker/wg/clusev-wg.sh gate-apply
+
+[Install]
+# Pulled in when docker.service starts (boot AND `systemctl restart docker`), so a Docker restart
+# that flushes DOCKER-USER re-applies the gate.
+WantedBy=docker.service