Document fresh Debian bootstrap and pinned internal Git clone

README.md

@@ -6,14 +6,26 @@ Current release: **1.2.2**. See [functionality corrections and verification](doc
 
 ## Install
 
-On a Debian 13 AMD64 or ARM64 host/container with systemd and root access:
+On a Debian 13 AMD64 or ARM64 host/container with systemd, run as root:
 
 ```sh
-git clone http://gogs.eparmak.local/eparmak/DebTik.git
+apt-get update
+apt-get install -y git ca-certificates
+git clone https://gogs.eparmak.local/eparmak/DebTik.git
 cd DebTik
-sudo ./install.sh
+./install.sh
 ```
 
+The internal Git server uses a private CA. Trust that CA before cloning, or replace the clone command above with this command using its verified TLS public key pin:
+
+```sh
+git -c http.sslVerify=false \
+  -c 'http.pinnedpubkey=sha256//u4xyt0njDzn4BAQnS6OTGrXBxVE8vMg5BSNIuryUsMo=' \
+  clone --depth 1 --branch v1.2.2 https://gogs.eparmak.local/eparmak/DebTik.git
+```
+
+This verifies the server's pinned key for this command; it does not change global Git settings. Reverify the pin if the server's TLS key changes. For a reproducible fresh installation, `v1.2.2` contains the complete dependency installer.
+
 `install.sh` installs and verifies the dependencies listed in [Dependencies](docs/dependencies.md), including Go, WireGuard, firewall, BIRD, DHCP/DNS, PPP clients and servers, strongSwan plugins, diagnostics and the RSTP daemon. It builds `proxmox-router` and `debtik-cli`, installs the updater helpers, and starts `proxmox-router.service`. It can be run again; existing `/etc/proxmox-router` files and tunnel keys are preserved. Previous binaries are saved as `/usr/local/bin/*.previous`. For native TUN in an LXC container, enable `/dev/net/tun` on the Proxmox host; otherwise AeroTUN uses veth.
 
 To install or repair dependencies on an existing appliance without replacing the application binaries or restarting DebTik: