Role ipt-server: detect ulogd2 via systemd instead of ps (logging_ipv{4,6}.conf).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/files/etc/ipt-firewall/logging_ipv4.conf

@@ -5,7 +5,12 @@
 # --- Logging
 # -------------
 
-if $(ps -e f | grep -q -E "/usr/sbin/ulogd2?\s" 2>/dev/null) ; then 
+# Use NFLOG only if ulogd2 runs (or will run at boot) on this host itself.
+# Not 'ps': on LXC hosts it also lists the ulogd of containers, which do not
+# receive the NFLOG packets of the host (other network namespace); at boot
+# the firewall may also start before ulogd2.
+if systemctl is-enabled --quiet ulogd2 2>/dev/null \
+      || systemctl is-active --quiet ulogd2 2>/dev/null ; then
    tag_log_prefix="--nflog-prefix"
    LOG_TARGET="NFLOG --nflog-group 11"
 else