# Installation dependencies (1.2.2)

`install.sh` invokes `scripts/install-dependencies.sh` as the single dependency
manifest. Both the full installation and `--dependencies-only` use it;
`--check-dependencies` verifies package status, executable availability and Go
version without installing anything. Debian 13, systemd and root are required.

| Feature | Debian packages |
| --- | --- |
| Shell and system management | bash, coreutils, grep, gawk, sed, findutils, util-linux, systemd, procps, kmod, tzdata |
| Downloads, Git, SSH repositories and helpers | ca-certificates, curl, git, openssh-client, tar, python3, openssl |
| Interfaces, bridges and firewall | iproute2, bridge-utils, iptables, ipset, conntrack |
| WireGuard | wireguard-tools |
| VRRP and dynamic routing | keepalived, bird2 |
| DHCP/DNS | dnsmasq, isc-dhcp-client |
| PPPoE, PPTP, L2TP clients and servers | ppp, pppoe, pptp-linux, pptpd, xl2tpd |
| IPsec | charon-systemd, strongswan-swanctl, libstrongswan-standard-plugins, libcharon-extra-plugins, libcharon-extauth-plugins |
| Diagnostics | iputils-ping, iputils-tracepath, traceroute, bind9-dnsutils, mtr-tiny |
| Debian network persistence | existing ifupdown2 or ifupdown; install ifupdown only when neither is installed |

Go modules are resolved from `go.mod`/`go.sum` during the build. The installer
checks the native toolchain version with `GOTOOLCHAIN=local`, prefers
`/opt/debtik/go/bin/go`, and installs the version requested by `go.mod` there
when needed. AMD64 and ARM64 are supported for downloaded Go toolchains.
Downloads use official HTTPS endpoints and the matching SHA-256 checksum.
Explicit HOME and Go cache locations support execution from systemd.

## RSTP

Use the distribution's `mstpd` package when available. Otherwise build upstream
[release 0.2.0](https://github.com/mstpd/mstpd/tree/8995e5d11ee89f2251734e34cea711bb5a5bb911),
pinned to commit `8995e5d11ee89f2251734e34cea711bb5a5bb911`. The archive SHA-256 is
`f965e715c82640484f89fcf11cd85dbd86c325dcf42ef85bd15173d9a9aa45b3`.
The source build needs gcc, make, libc6-dev, autoconf, automake, libtool and pkg-config;
these are installed only when compilation is needed. It installs `mstpd` and
`mstpctl` under `/usr/local/sbin`, plus the upstream license and revision record
under `/usr/local/share/doc/debtik-mstpd`.

The daemon runs through `mstpd.service`. A DebTik service drop-in orders it before
the application. DebTik explicitly adds its configured RSTP bridges to the daemon;
the source installation does not install global bridge-stp or ifupdown hooks.
See the [upstream control manual](https://github.com/mstpd/mstpd/blob/8995e5d11ee89f2251734e34cea711bb5a5bb911/utils/mstpctl.8).

Package-triggered daemon starts/restarts are suppressed while dependencies are
installed, using a temporary policy-rc.d only if no existing policy is present.
The existing policy is preserved, and an installer-created policy is removed on
success or failure. Dependency repair does not restart DebTik. Newly installed
runtime daemons are started by their corresponding application features;
`mstpd` is explicitly started and enabled for RSTP readiness.

ACME issuance and renewal are implemented in Go; external certbot is not a
runtime dependency. Kernel capabilities such as WireGuard, bridge networking and
network administration permissions must be provided by the host/container.

Git application updates currently replace binaries and updater helpers. Use the
latest checkout's `./install.sh --dependencies-only` to synchronize dependencies
on an existing installation; the updater does not run apt automatically.

## Verification

The dependency installation and command check were exercised on the existing
AMD64 appliance. RSTP daemon/control integration was verified using a real bridge
in an isolated network namespace. All 43 runtime packages and the source-build
tools were checked against Debian 13 ARM64 package metadata. The server and CLI
are cross-built for ARM64; a complete fresh ARM64 installation remains a separate
end-to-end deployment check.