[Unit]
Description=Lab edge DNAT (tailnet :80/:443 -> kc-lab-edge)
After=network-online.target libvirtd.service
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/nftables.d/lab-edge-dnat.nft

# libvirt's own guest_input chain ends in `oif virbr0 ... reject`, and nftables
# does NOT let an accept in an earlier base chain override a reject in a later
# one. So the hole has to be punched inside libvirt's chain, at the top.
# `-` because libvirt_network only exists once the virtual network is up; if it
# is missing the DNAT still loads and this can be re-applied with a restart.
ExecStartPost=-/usr/sbin/nft insert rule ip libvirt_network guest_input oif virbr0 ip daddr 192.168.122.10 tcp dport {80,443} ct state new counter accept

ExecStop=/usr/sbin/nft delete table ip lab_edge

[Install]
WantedBy=multi-user.target