[Unit]
Description=Contextra Metadata LAN access guard
Before=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/python3 /tmp/codex/ltb1021/2026-09-11_contextra-metadata-boundary_r01/controls/firewall.py apply

[Install]
WantedBy=multi-user.target