DebTik

DebTik

DebTik is a Debian/Proxmox router appliance with an embedded web interface, REST API and RouterOS-style CLI. It manages network interfaces, routing, firewall/NAT, DHCP/DNS, WireGuard, IPsec, PPP, VRRP and AeroTUN. AeroTUN v3 uses pinned peer identities and encrypted tunnels; it works with native TUN or a veth fallback when /dev/net/tun is unavailable.

Current release: 1.2.1. See functionality corrections and verification for network persistence, firewall isolation/IPv6, service error handling and certificate renewal changes.

Install

On a Debian 13 host or container with systemd and root access:

git clone http://gogs.eparmak.local/eparmak/DebTik.git
cd DebTik
sudo ./install.sh

install.sh installs the Debian packages used by the application, including BIRD, WireGuard, firewall, DHCP/DNS, PPP, keepalived, pptp-linux, charon-systemd and diagnostic tools. It obtains the Go toolchain specified by go.mod when the installed Go is older, builds proxmox-router and debtik-cli, installs the updater helper, and starts proxmox-router.service. It can be run again; existing /etc/proxmox-router files and tunnel keys are preserved. Previous binaries are saved as /usr/local/bin/*.previous. For native TUN in an LXC container, enable /dev/net/tun on the Proxmox host; otherwise AeroTUN uses veth.

The web UI and authenticated REST API use HTTP port 80 by default. HTTPS is an optional separate www-ssl management service, normally port 443, configured in Certificates and Management Services. The application SSH CLI normally listens on 2222, and Telnet/debtik-cli on 8282. The built-in bandwidth test server uses 2000. Ports can be changed in the management services UI where available. The main service command is /usr/local/bin/proxmox-router -addr :80; systemd/proxmox-router.service defines the installed unit.

Configuration is JSON under /etc/proxmox-router/ (including services.json and vpn/aerotun_instances.json). AeroTUN secrets and private identities remain on the local appliance. Do not copy one side's private identity to the other.

Usage

Open http://<appliance-ip>/ and sign in. For the appliance SSH CLI, connect to port 2222. The standalone debtik-cli connects to the Telnet CLI by default:

debtik-cli -addr 127.0.0.1:8282
debtik-cli -addr 127.0.0.1:8282 -u admin -p '<password>' -c '/interface aerotun print'

Run help within the CLI for supported commands. The API is under /api/ on the web listener and requires an authenticated session except for login. Read-only users can inspect state; configuration changes require elevated roles. AeroTUN operations require the full administrator role.

Git updates

In Updates, enter an HTTP(S) or SSH Git repository, then save and check for releases. Releases are stable Git tags named vMAJOR.MINOR.PATCH (for example v1.1.0). The largest numeric version is selected; installation is allowed only when it is strictly greater than the installed version. Equal versions, older versions, malformed tags and prereleases are not installed. The selected tag must match the repository’s VERSION file. The updater clones into /var/lib/debtik/update, builds the server and CLI first, backs up the installed binaries, restarts the service and checks that it remains active. If installation fails, it restores the previous binaries. Restore previous version is available in the same menu. Logs and the current state are shown there. Only full administrators can change the source or run update actions. New releases require bumping VERSION, committing the change, creating its matching vX.Y.Z tag and pushing both the commit and tag. Recovery rollback remains an explicit separate action. The server carries its matching updater helpers and refreshes an existing managed installation at startup, including upgrades started by older updater versions. Each appliance updates independently; for paired AeroTUN peers, update one side and verify its connection before updating the other.

install.sh must have been run from a Git checkout at least once to install the updater helper. Git access from the appliance to the selected repository and the required Go toolchain are needed. Git credentials belong in the appliance's Git/SSH configuration; repository URLs containing embedded credentials are rejected. For a private Git server whose CA is not trusted by Debian, enter its verified sha256//... TLS public key pin in Updates. Rotate the pin when that server changes its TLS key.

Development and checks

go test ./...
go vet ./...
node --test scripts/ui-regression.test.cjs
make build

The application embeds internal/web/static. See AeroTUN v3, AeroTUN v2 compatibility and UI/CLI changes.