# dnsmasq drop-in: refuse to start DHCP/PXE unless the imaging NIC is on
# the isolated imaging network.
#
# Installed as /etc/systemd/system/dnsmasq.service.d/nic-guard.conf by
# pxe_server_setup.yml. pxe-nic-check --guard listens on the imaging NIC
# for 5 s and sends one DHCPDISCOVER (~6 s total), then exits:
#   0  safe to serve (isolated, no link, or the check itself broke - it
#      fails open on bugs and says so loudly in the journal)
#   1  DO NOT serve: a foreign DHCP server or a managed/corporate switch
#      (LLDP, CDP, 802.1X) is on the imaging NIC. dnsmasq does not start.
#
# Why did dnsmasq not start?   journalctl -u dnsmasq -b | grep pxe-nic-check
# Full picture:                pxe-nic-check        (or the webapp status page)
# Guard does not run on "systemctl reload"; every start/restart runs it,
# including the @reboot cron restart.

[Service]
ExecStartPre=/usr/local/sbin/pxe-nic-check --guard