# DebTik

DebTik is a Debian/Proxmox router appliance with an embedded web interface, REST API and RouterOS-style CLI. It manages network interfaces, routing, firewall/NAT, DHCP/DNS, WireGuard, IPsec, PPP, VRRP and AeroTUN. AeroTUN v3 uses pinned peer identities and encrypted tunnels; it works with native TUN or a veth fallback when `/dev/net/tun` is unavailable.

Current release: **1.3.7**. See [functionality corrections and verification](docs/functionality-fixes.md) for network persistence, firewall isolation/IPv6, service error handling and certificate renewal changes.

## Install

On a Debian 13 AMD64 or ARM64 host/container with systemd, run as root:

```sh
apt-get update
apt-get install -y git ca-certificates
git clone https://gogs.eparmak.local/eparmak/DebTik.git
cd DebTik
./install.sh
```

The internal Git server uses a private CA. Trust that CA before cloning, or replace the clone command above with this command using its verified TLS public key pin:

```sh
git -c http.sslVerify=false \
  -c 'http.pinnedpubkey=sha256//u4xyt0njDzn4BAQnS6OTGrXBxVE8vMg5BSNIuryUsMo=' \
  clone --depth 1 --branch v1.3.7 https://gogs.eparmak.local/eparmak/DebTik.git
```

This verifies the server's pinned key for this command; it does not change global Git settings. Reverify the pin if the server's TLS key changes. For a reproducible fresh installation, `v1.3.7` contains the complete dependency installer and native Linux firewall corrections.

`install.sh` installs and verifies the dependencies listed in [Dependencies](docs/dependencies.md), including Go, WireGuard, firewall, BIRD, DHCP/DNS, PPP clients and servers, strongSwan plugins, diagnostics and the RSTP daemon. It builds `proxmox-router` and `debtik-cli`, installs the updater helpers, and starts `proxmox-router.service`. It can be run again; existing `/etc/proxmox-router` files and tunnel keys are preserved. Previous binaries are saved as `/usr/local/bin/*.previous`. For native TUN in an LXC container, enable `/dev/net/tun` on the Proxmox host; otherwise AeroTUN uses veth.

To install or repair dependencies on an existing appliance without replacing the application binaries or restarting DebTik:

```sh
sudo ./install.sh --dependencies-only
sudo ./install.sh --check-dependencies
```

The dependency check exits nonzero and names missing packages, commands or an outdated Go toolchain. Existing Proxmox `ifupdown2` installations are retained. On Debian 13, where `mstpd` is not packaged, the installer builds a pinned upstream release with archive checksum verification; its daemon is enabled before DebTik starts. Go archives are checksum verified as well.

The web UI and authenticated REST API use HTTP port **80** by default. HTTPS is an optional separate `www-ssl` management service, normally port **443**, configured in **Certificates** and **Management Services**. The application SSH CLI normally listens on **2222**, and Telnet/`debtik-cli` on **8282**. The built-in bandwidth test server uses **2000**. Ports can be changed in the management services UI where available. The main service command is `/usr/local/bin/proxmox-router -addr :80`; `systemd/proxmox-router.service` defines the installed unit.

Configuration is JSON under `/etc/proxmox-router/` (including `services.json` and `vpn/aerotun_instances.json`). AeroTUN secrets and private identities remain on the local appliance. Do not copy one side's private identity to the other.

## Usage

Open `http://<appliance-ip>/` and sign in. For the appliance SSH CLI, connect to port 2222. The standalone `debtik-cli` connects to the Telnet CLI by default:

```sh
debtik-cli -addr 127.0.0.1:8282
debtik-cli -addr 127.0.0.1:8282 -u admin -p '<password>' -c '/interface aerotun print'
```

Run `help` within the CLI for supported commands. The API is under `/api/` on the web listener and requires an authenticated session except for login. Read-only users can inspect state; configuration changes require elevated roles. AeroTUN operations require the full administrator role.

## Git updates

In **Updates**, enter an HTTP(S) or SSH Git repository, then save and check for releases. Releases are stable Git tags named `vMAJOR.MINOR.PATCH` (for example `v1.1.0`). The largest numeric version is selected; installation is allowed only when it is strictly greater than the installed version. Equal versions, older versions, malformed tags and prereleases are not installed. The selected tag must match the repository’s `VERSION` file. The updater clones into `/var/lib/debtik/update`, builds the server and CLI first, backs up the installed binaries, restarts the service and checks that it remains active. If installation fails, it restores the previous binaries. **Restore previous version** is available in the same menu. Logs and the current state are shown there. Only full administrators can change the source or run update actions. New releases require bumping `VERSION`, committing the change, creating its matching `vX.Y.Z` tag and pushing both the commit and tag. Recovery rollback remains an explicit separate action. The server carries its matching updater helpers and refreshes an existing managed installation at startup, including upgrades started by older updater versions. Each appliance updates independently; for paired AeroTUN peers, update one side and verify its connection before updating the other.

`install.sh` must have been run from a Git checkout at least once to install the updater helper. Git access from the appliance to the selected repository and the required Go toolchain are needed. Git credentials belong in the appliance's Git/SSH configuration; repository URLs containing embedded credentials are rejected. For a private Git server whose CA is not trusted by Debian, enter its verified `sha256//...` TLS public key pin in Updates. Rotate the pin when that server changes its TLS key.

See [native Linux firewall behavior and supported options](docs/firewall-native.md).

## Development and checks

```sh
go test ./...
go vet ./...
node --test scripts/ui-regression.test.cjs
make build
```

The application embeds `internal/web/static`. See [AeroTUN v3](docs/aerotun-v3.md), [AeroTUN v2 compatibility](docs/aerotun-v2.md) and [UI/CLI changes](docs/ui-cli-fixes.md).