Guard only packets addressed to this machine, and order the guard's unit before the network and against shutdown (hq ADR 0103)

internal/catalogue/adoption_test.go

@@ -200,13 +200,33 @@ delete table inet mesh_guard
 table inet mesh_guard {
 	chain prerouting {
 		type filter hook prerouting priority raw; policy accept;
-		iifname != "lo" iifname != "docker0" iifname != "br-*" iifname != "mesh0" tcp dport { 5432, 15672 } drop
+		fib daddr type local iifname != "lo" iifname != "docker0" iifname != "br-*" iifname != "mesh0" tcp dport { 5432, 15672 } drop
 	}
 }
 `
 	if got := AsGuard([]int{15672, 5432}); got != golden {
 		t.Fatalf("the guard changed:\n%s", got)
 	}
+	const unit = `[Unit]
+Description=The mesh's guard: refuses its own ports from outside (novox/hq ADR 0100)
+DefaultDependencies=no
+Wants=network-pre.target
+Before=network-pre.target shutdown.target
+Conflicts=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=nft -f /etc/mesh/guard.nft
+ExecReload=nft -f /etc/mesh/guard.nft
+ExecStop=nft delete table inet mesh_guard
+
+[Install]
+WantedBy=multi-user.target
+`
+	if got := GuardUnitText(); got != unit {
+		t.Fatalf("the guard's unit changed:\n%s", got)
+	}
 	if GuardResources(nil) != nil {
 		t.Fatal("a guard with nothing to guard is an empty set nft refuses to load")
 	}