# DebTik

DebTik is a Debian/Proxmox router appliance with an embedded web interface, REST API and RouterOS-style CLI. It manages network interfaces, routing, firewall/NAT, DHCP/DNS, WireGuard, IPsec, PPP, VRRP and AeroTUN. AeroTUN v3 uses pinned peer identities and encrypted tunnels; it works with native TUN or a veth fallback when `/dev/net/tun` is unavailable.

## Install

On a Debian 13 host or container with systemd and root access:

```sh
git clone http://gogs.eparmak.local/eparmak/DebTik.git
cd DebTik
sudo ./install.sh
```

`install.sh` installs the Debian packages used by the application, including BIRD, WireGuard, firewall, DHCP/DNS, PPP and diagnostic tools. It obtains the Go toolchain specified by `go.mod` when the installed Go is older, builds `proxmox-router` and `debtik-cli`, installs the updater helper, and starts `proxmox-router.service`. It can be run again; existing `/etc/proxmox-router` files and tunnel keys are preserved. Previous binaries are saved as `/usr/local/bin/*.previous`. For native TUN in an LXC container, enable `/dev/net/tun` on the Proxmox host; otherwise AeroTUN uses veth.

The web UI and authenticated REST API use HTTP port **80** by default. HTTPS is an optional separate `www-ssl` management service, normally port **443**, configured in **Certificates** and **Management Services**. The application SSH CLI normally listens on **2222**, and Telnet/`debtik-cli` on **8282**. The built-in bandwidth test server uses **2000**. Ports can be changed in the management services UI where available. The main service command is `/usr/local/bin/proxmox-router -addr :80`; `systemd/proxmox-router.service` defines the installed unit.

Configuration is JSON under `/etc/proxmox-router/` (including `services.json` and `vpn/aerotun_instances.json`). AeroTUN secrets and private identities remain on the local appliance. Do not copy one side's private identity to the other.

## Usage

Open `http://<appliance-ip>/` and sign in. For the appliance SSH CLI, connect to port 2222. The standalone `debtik-cli` connects to the Telnet CLI by default:

```sh
debtik-cli -addr 127.0.0.1:8282
debtik-cli -addr 127.0.0.1:8282 -u admin -p '<password>' -c '/interface aerotun print'
```

Run `help` within the CLI for supported commands. The API is under `/api/` on the web listener and requires an authenticated session except for login. Read-only users can inspect state; configuration changes require elevated roles. AeroTUN operations require the full administrator role.

## Git updates

In **Updates**, enter an HTTP(S) or SSH Git repository, then save and check for releases. Releases are stable Git tags named `vMAJOR.MINOR.PATCH` (for example `v1.1.0`). The largest numeric version is selected; installation is allowed only when it is strictly greater than the installed version. Equal versions, older versions, malformed tags and prereleases are not installed. The selected tag must match the repository’s `VERSION` file. The updater clones into `/var/lib/debtik/update`, builds the server and CLI first, backs up the installed binaries, restarts the service and checks that it remains active. If installation fails, it restores the previous binaries. **Restore previous version** is available in the same menu. Logs and the current state are shown there. Only full administrators can change the source or run update actions. New releases require bumping `VERSION`, committing the change, creating its matching `vX.Y.Z` tag and pushing both the commit and tag. Recovery rollback remains an explicit separate action. Each appliance updates independently; for paired AeroTUN peers, update one side and verify its connection before updating the other.

`install.sh` must have been run from a Git checkout at least once to install the updater helper. Git access from the appliance to the selected repository and the required Go toolchain are needed. Git credentials belong in the appliance's Git/SSH configuration; repository URLs containing embedded credentials are rejected. For a private Git server whose CA is not trusted by Debian, enter its verified `sha256//...` TLS public key pin in Updates. Rotate the pin when that server changes its TLS key.

## Development and checks

```sh
go test ./...
go vet ./...
node --test scripts/ui-regression.test.cjs
make build
```

The application embeds `internal/web/static`. See [AeroTUN v3](docs/aerotun-v3.md), [AeroTUN v2 compatibility](docs/aerotun-v2.md) and [UI/CLI changes](docs/ui-cli-fixes.md).