stop-pa-vm.service calls the PAN-OS XML API on host shutdown so the firewall
VM goes down cleanly rather than being killed.
The API key is read from conf/pa-vm.conf, resolved relative to the script.
See conf/pa-vm.conf.example.
Pass the request through curl --config on stdin with the key in an X-PAN-KEY
header, instead of embedding it in the URL. A key in the query string is
visible in ps and would be recorded in any proxy or webserver log along the
path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
