# Installation and update dependencies

`install.sh` invokes `scripts/install-dependencies.sh` as the single dependency
manifest. Full installation, `--dependencies-only`, and Git upgrades (`debtik-update`)
all use it; `--check-dependencies` verifies package status, executable availability and Go
version without installing anything. Debian 13 (or Proxmox VE), systemd and root are required.

| Feature | Debian packages |
| --- | --- |
| Shell and system management | bash, coreutils, grep, gawk, sed, findutils, util-linux, systemd, procps, kmod, tzdata |
| Downloads, Git, SSH repositories and helpers | ca-certificates, curl, git, openssh-client, tar, python3, openssl |
| Interfaces, bridges, diagnostics and firewall | iproute2, bridge-utils, iptables, ipset, conntrack, ethtool, tcpdump |
| WireGuard | wireguard-tools |
| VRRP and dynamic routing | keepalived, bird2 |
| DHCP/DNS | dnsmasq, isc-dhcp-client |
| PPPoE, PPTP, L2TP clients and servers | ppp, pppoe, pptp-linux, pptpd, xl2tpd |
| IPsec | charon-systemd, strongswan-swanctl, libstrongswan-standard-plugins, libcharon-extra-plugins, libcharon-extauth-plugins |
| Diagnostics | iputils-ping, iputils-tracepath, traceroute, bind9-dnsutils, mtr-tiny |
| Debian network persistence | existing ifupdown2 or ifupdown; install ifupdown only when neither is installed |

Go modules are resolved from `go.mod`/`go.sum` during the build. The installer
checks the native toolchain version with `GOTOOLCHAIN=local`, prefers
`/opt/debtik/go/bin/go`, and installs the version requested by `go.mod` there
when needed. AMD64 and ARM64 are supported for downloaded Go toolchains.
Downloads use official HTTPS endpoints and the matching SHA-256 checksum.
Explicit HOME and Go cache locations support execution from systemd.

## RSTP

Use the distribution's `mstpd` package when available. Otherwise build upstream
[release 0.2.0](https://github.com/mstpd/mstpd/tree/8995e5d11ee89f2251734e34cea711bb5a5bb911),
pinned to commit `8995e5d11ee89f2251734e34cea711bb5a5bb911`. The archive SHA-256 is
`f965e715c82640484f89fcf11cd85dbd86c325dcf42ef85bd15173d9a9aa45b3`.
The source build needs gcc, make, libc6-dev, autoconf, automake, libtool and pkg-config;
these are installed only when compilation is needed. It installs `mstpd` and
`mstpctl` under `/usr/local/sbin`, plus the upstream license and revision record
under `/usr/local/share/doc/debtik-mstpd`.

The daemon runs through `mstpd.service`. A DebTik service drop-in orders it before
the application. DebTik explicitly adds its configured RSTP bridges to the daemon;
the source installation does not install global bridge-stp or ifupdown hooks.
See the [upstream control manual](https://github.com/mstpd/mstpd/blob/8995e5d11ee89f2251734e34cea711bb5a5bb911/utils/mstpctl.8).

Package-triggered daemon starts/restarts are suppressed while dependencies are
installed, using a temporary policy-rc.d only if no existing policy is present.
The existing policy is preserved, and an installer-created policy is removed on
success or failure. Dependency repair does not restart DebTik. Newly installed
runtime daemons are started by their corresponding application features;
`mstpd` is explicitly started and enabled for RSTP readiness.

ACME issuance and renewal are implemented in Go; external certbot is not a
runtime dependency. Kernel capabilities such as WireGuard, bridge networking and
network administration permissions must be provided by the host/container.

Git application updates (`debtik-update`, triggered from the Web UI or CLI)
automatically synchronize and install dependencies prior to compiling and activating
the new release. The updater runs `scripts/install-dependencies.sh` from the target
release, ensuring newly required Debian packages, mstpd bridge routing tools, and
matching Go toolchains are fully installed and verified before building. If dependency
synchronization fails, the update aborts cleanly before stopping or modifying the
active DebTik service.
The dependency installer helper is also installed to `/usr/local/libexec/debtik-install-dependencies`
and refreshed automatically on startup. Standalone checks can be performed via
`install.sh --check-dependencies` or `/usr/local/libexec/debtik-install-dependencies --check`.

## Verification

The dependency installation and command check were exercised on the existing
AMD64 appliance. RSTP daemon/control integration was verified using a real bridge
in an isolated network namespace. All 43 runtime packages and the source-build
tools were checked against Debian 13 ARM64 package metadata. The server and CLI
are cross-built for ARM64; a complete fresh ARM64 installation remains a separate
end-to-end deployment check.