# DebTik 1.2.1 — functionality corrections

This release addresses the 2026-10-31 functionality review. Changes were tested
before deployment; disruptive tests use private mount and network namespaces.

- Network persistence preserves host gateway, DHCP, bridge and other existing
  stanzas. Addresses on existing host interfaces use bounded DebTik-managed
  hooks; generated VLAN and physical snippets support IPv4 and IPv6. Failed
  persistence is returned to the caller instead of a success response.
- Firewall rules live in `DT_<table>_<chain>` chains. Applying rules preserves
  external chains and built-in policies, migrates legacy DebTik ID rules, and
  validates both IP families before applying. Failed edits restore the previous
  saved/in-memory rule set and kernel rules. Counter reset affects owned chains.
- Filter/NAT/mangle forms explicitly select IPv4 or IPv6. Existing rules default
  to IPv4. Address lists maintain separate IPv4/IPv6 sets using temporary sets
  and atomic swaps. Invalid entries preserve the old set. GeoIP datasets remain
  IPv4; an IPv6 GeoIP rule is rejected explicitly rather than applied incorrectly.
- Interface role changes immediately rebuild the corresponding firewall rules;
  failure restores the previous role and rules. Rule tables refresh when any
  configuration field changes, while counter-only refreshes avoid rebuilding.
- Route synchronization leaves DHCP/host-owned default routes alone. Static
  route Save propagates kernel failures and restores the previous managed state.
- Bridge VLAN edits remove old memberships and add new memberships, with rollback
  on error. Bridge/port commands return failures. Linux port priority values are
  mapped from the UI representation. Ingress filtering is shown as the actual
  bridge-wide VLAN filtering setting, not a fictitious per-port command.
- Kernel STP and userspace RSTP are distinguished. New RSTP settings require
  `mstpd/mstpctl`. Existing legacy RSTP labels fall back to real kernel STP if the
  daemon is absent, preserving boot connectivity and reporting the real mode.
  See the [mstpd control manual](https://github.com/mstpd/mstpd/blob/master/utils/mstpctl.8).
- WireGuard edits preserve an existing private identity when omitted; comment
  edits leave the running link intact. Start/Save return errors synchronously.
  Peer option clearing is applied to the kernel, including zero keepalive,
  empty allowed IPs/PSK, and a removed endpoint. Already-running WireGuard links
  are preserved during appliance startup.
- DHCP/DNS restart failures reach the API. Failed application restores previous
  daemon/resolver files and attempts to restart the previous running service.
- BIRD reload failures reach the caller. OSPF running state is matched to each
  instance's own protocol, not a global indication that any OSPF process is up.
- Management hooks run synchronously outside the settings lock, returning bind
  failures and restoring previous settings. SSH/Telnet wait for readiness;
  HTTPS binds before claiming success, and HTTP port changes actually rebind.
- IPsec load failures and PPP client launch/control failures are reported.
  L2TP control writes are nonblocking and report unavailable control channels.
- Installation includes keepalived, pptp-linux and charon-systemd (the daemon
  used by swanctl), and suppresses package-triggered daemon starts. Installation
  and update jobs share a lock.
- Updates install and restore updater helpers together with server/CLI binaries.
  The server also embeds and refreshes existing helpers, allowing upgrades launched by legacy updaters to migrate their tooling. Rollback also restores the previous firewall snapshot after restarting the
  previous service. Version gating remains strictly increasing.
- ACME certificates renew when less than 30 days remain. Checks begin after the
  web listener starts and repeat every 12 hours. ACME account keys are reused;
  renewal errors and attempts are persisted. TLS reloads the renewed files on
  subsequent handshakes. HTTP-01 still needs public reachability on port 80.

## Verification

Normal tests: `go test ./...`, `go vet ./...`, race checks for affected packages,
Node UI regression checks and shell syntax checks.

Kernel integration tests use private namespaces and temporary filesystem binds:

- Firewall: repeated apply, external rule/policy preservation, actual IPv6 rules,
  failed-save rollback, IPv4/IPv6 address lists, rejected list updates.
- Migration: a snapshot of the first appliance's real firewall configuration/rules.
- Bridge: changing VLAN ID and port membership and disabling a VLAN.
- WireGuard: stable link/index and key across comment edits; actual kernel clearing
  of keepalive, endpoint, allowed IPs and preshared key.

Public CA issuance is not triggered by tests. Renewal selection and account-key
reuse are unit tested; actual renewal depends on the configured public domain
and challenge connectivity.

## Legacy updater environment

Version 1.2.1 explicitly sets Go cache paths because transient systemd units may
omit HOME. An existing 1.1.0 helper can fail before installing this fix with
`module cache not found`. Such an installation needs its first upgrade started
with HOME set, or the current helper installed once from this checkout.
Subsequent updates use the corrected helper automatically.