DebTik/docs/dependencies.md

Installation and update dependencies

install.sh invokes scripts/install-dependencies.sh as the single dependency manifest. Full installation, --dependencies-only, and Git upgrades (debtik-update) all use it; --check-dependencies verifies package status, executable availability and Go version without installing anything. Debian 13 (or Proxmox VE), systemd and root are required.

Feature	Debian packages
Shell and system management	bash, coreutils, grep, gawk, sed, findutils, util-linux, systemd, procps, kmod, tzdata
Downloads, Git, SSH repositories and helpers	ca-certificates, curl, git, openssh-client, tar, python3, openssl
Interfaces, bridges, diagnostics and firewall	iproute2, bridge-utils, iptables, ipset, conntrack, ethtool, tcpdump
WireGuard	wireguard-tools
VRRP and dynamic routing	keepalived, bird2
DHCP/DNS	dnsmasq, isc-dhcp-client
PPPoE, PPTP, L2TP clients and servers	ppp, pppoe, pptp-linux, pptpd, xl2tpd
IPsec	charon-systemd, strongswan-swanctl, libstrongswan-standard-plugins, libcharon-extra-plugins, libcharon-extauth-plugins
Diagnostics	iputils-ping, iputils-tracepath, traceroute, bind9-dnsutils, mtr-tiny
Debian network persistence	existing ifupdown2 or ifupdown; install ifupdown only when neither is installed

Go modules are resolved from go.mod/go.sum during the build. The installer checks the native toolchain version with GOTOOLCHAIN=local, prefers /opt/debtik/go/bin/go, and installs the version requested by go.mod there when needed. AMD64 and ARM64 are supported for downloaded Go toolchains. Downloads use official HTTPS endpoints and the matching SHA-256 checksum. Explicit HOME and Go cache locations support execution from systemd.

RSTP

Use the distribution's mstpd package when available. Otherwise build upstream release 0.2.0, pinned to commit 8995e5d11ee89f2251734e34cea711bb5a5bb911. The archive SHA-256 is f965e715c82640484f89fcf11cd85dbd86c325dcf42ef85bd15173d9a9aa45b3. The source build needs gcc, make, libc6-dev, autoconf, automake, libtool and pkg-config; these are installed only when compilation is needed. It installs mstpd and mstpctl under /usr/local/sbin, plus the upstream license and revision record under /usr/local/share/doc/debtik-mstpd.

The daemon runs through mstpd.service. A DebTik service drop-in orders it before the application. DebTik explicitly adds its configured RSTP bridges to the daemon; the source installation does not install global bridge-stp or ifupdown hooks. See the upstream control manual.

Package-triggered daemon starts/restarts are suppressed while dependencies are installed, using a temporary policy-rc.d only if no existing policy is present. The existing policy is preserved, and an installer-created policy is removed on success or failure. Dependency repair does not restart DebTik. Newly installed runtime daemons are started by their corresponding application features; mstpd is explicitly started and enabled for RSTP readiness.

ACME issuance and renewal are implemented in Go; external certbot is not a runtime dependency. Kernel capabilities such as WireGuard, bridge networking and network administration permissions must be provided by the host/container.

Git application updates (debtik-update, triggered from the Web UI or CLI) automatically synchronize and install dependencies prior to compiling and activating the new release. The updater runs scripts/install-dependencies.sh from the target release, ensuring newly required Debian packages, mstpd bridge routing tools, and matching Go toolchains are fully installed and verified before building. If dependency synchronization fails, the update aborts cleanly before stopping or modifying the active DebTik service. The dependency installer helper is also installed to /usr/local/libexec/debtik-install-dependencies and refreshed automatically on startup. Standalone checks can be performed via install.sh --check-dependencies or /usr/local/libexec/debtik-install-dependencies --check.

Verification

The dependency installation and command check were exercised on the existing AMD64 appliance. RSTP daemon/control integration was verified using a real bridge in an isolated network namespace. All 43 runtime packages and the source-build tools were checked against Debian 13 ARM64 package metadata. The server and CLI are cross-built for ARM64; a complete fresh ARM64 installation remains a separate end-to-end deployment check.