two things (systemd ctl clients)
    see if i can remove the net_admin
    deal more efficiently with self rules (compiler nukes dupes)