Guard only packets addressed to this machine, and load the guard before the network and stop it only at shutdown (hq ADR 0103)

internal/bootstrap/adopted_test.go

@@ -21,7 +21,7 @@ delete table inet mesh_guard
 table inet mesh_guard {
 	chain prerouting {
 		type filter hook prerouting priority raw; policy accept;
-		iifname != "lo" iifname != "docker0" iifname != "br-*" iifname != "mesh0" tcp dport { 5432, 15672 } drop
+		fib daddr type local iifname != "lo" iifname != "docker0" iifname != "br-*" iifname != "mesh0" tcp dport { 5432, 15672 } drop
 	}
 }
 `
@@ -32,6 +32,42 @@ func TestTheGuardIsExactlyThisTable(t *testing.T) {
 	}
 }
 
+// The same golden unit the controller's test holds its guard unit to. It is loaded before the
+// network is up, so it carries no default dependencies, and it is stopped only at shutdown.
+const goldenGuardUnit = `[Unit]
+Description=The mesh's guard: refuses its own ports from outside (novox/hq ADR 0100)
+DefaultDependencies=no
+Wants=network-pre.target
+Before=network-pre.target shutdown.target
+Conflicts=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=nft -f /etc/mesh/guard.nft
+ExecReload=nft -f /etc/mesh/guard.nft
+ExecStop=nft delete table inet mesh_guard
+
+[Install]
+WantedBy=multi-user.target
+`
+
+func TestTheGuardUnitIsExactlyThisUnit(t *testing.T) {
+	if got := guardUnitText(); got != goldenGuardUnit {
+		t.Fatalf("the guard's unit changed:\n%s", got)
+	}
+}
+
+func TestTheGuardRefusesOnlyWhatIsAddressedToThisMachine(t *testing.T) {
+	// A machine that routes for others — a predecessor's private-network hub — must not have a
+	// packet for another machine's database port refused (novox/hq ADR 0103).
+	for _, line := range strings.Split(AsGuard([]int{5432}), "\n") {
+		if strings.Contains(line, " drop") && !strings.HasPrefix(strings.TrimSpace(line), "fib daddr type local ") {
+			t.Errorf("a refusal matches packets not addressed to this machine: %q", line)
+		}
+	}
+}
+
 func TestAnAdoptedBundleLoadsNoDroppingTableAndExactlyTheGuard(t *testing.T) {
 	r := producedBundle(t)
 	p := FoundationPorts{Store: 5433, Management: 15673}