# Written by an LLM (Claude Code) — review before trusting on a machine
# other than the one this was diagnosed on. See README.md.
#
# Runs docker-tailscale-route.service shortly after boot and then every
# 15s afterward, so the ip rule that exempts Docker's bridge traffic from
# Tailscale's exit-node catch-all route gets reinstated quickly after a
# reboot or a Tailscale reconnect (both can wipe/recreate Tailscale's own
# ip rules and leave ours missing in the process). Polling is used
# instead of a network-event hook because NetworkManager doesn't manage
# the tailscale0 interface and never fires dispatcher/udev events we
# could reliably hook into for it (confirmed by testing).

[Unit]
Description=Periodically ensure Docker bridge traffic bypasses Tailscale's exit-node route

[Timer]
OnBootSec=5s
OnUnitActiveSec=15s
Unit=docker-tailscale-route.service

[Install]
WantedBy=timers.target