network-online.target

The target that means an interface is configured and reachable, as opposed to network.target, which the manual calls "only very weakly defined": reaching it means the stack was set up, not that any address is up. network-online.target pulls in a unit that blocks until the network is usable — on Ubuntu 24.04, systemd-networkd-wait-online.service. It takes two lines, not one: Wants=network-online.target and After=network-online.target. The Wants= looks redundant on Ubuntu, and that is the trap: cloud-init ships on every Server image, its cloud-config.service and cloud-final.service both want the target, so After= alone appears to work. Put the same unit on a machine without cloud-init and nothing pulls it: the target never starts, and your ordering waits on nothing.