DebTik/docs/dependencies.md

Installation dependencies (1.2.2)

install.sh invokes scripts/install-dependencies.sh as the single dependency manifest. Both the full installation and --dependencies-only use it; --check-dependencies verifies package status, executable availability and Go version without installing anything. Debian 13, systemd and root are required.

Feature	Debian packages
Shell and system management	bash, coreutils, grep, gawk, sed, findutils, util-linux, systemd, procps, kmod, tzdata
Downloads, Git, SSH repositories and helpers	ca-certificates, curl, git, openssh-client, tar, python3, openssl
Interfaces, bridges and firewall	iproute2, bridge-utils, iptables, ipset, conntrack
WireGuard	wireguard-tools
VRRP and dynamic routing	keepalived, bird2
DHCP/DNS	dnsmasq, isc-dhcp-client
PPPoE, PPTP, L2TP clients and servers	ppp, pppoe, pptp-linux, pptpd, xl2tpd
IPsec	charon-systemd, strongswan-swanctl, libstrongswan-standard-plugins, libcharon-extra-plugins, libcharon-extauth-plugins
Diagnostics	iputils-ping, iputils-tracepath, traceroute, bind9-dnsutils, mtr-tiny
Debian network persistence	existing ifupdown2 or ifupdown; install ifupdown only when neither is installed

Go modules are resolved from go.mod/go.sum during the build. The installer checks the native toolchain version with GOTOOLCHAIN=local, prefers /opt/debtik/go/bin/go, and installs the version requested by go.mod there when needed. AMD64 and ARM64 are supported for downloaded Go toolchains. Downloads use official HTTPS endpoints and the matching SHA-256 checksum. Explicit HOME and Go cache locations support execution from systemd.

RSTP

Use the distribution's mstpd package when available. Otherwise build upstream release 0.2.0, pinned to commit 8995e5d11ee89f2251734e34cea711bb5a5bb911. The archive SHA-256 is f965e715c82640484f89fcf11cd85dbd86c325dcf42ef85bd15173d9a9aa45b3. The source build needs gcc, make, libc6-dev, autoconf, automake, libtool and pkg-config; these are installed only when compilation is needed. It installs mstpd and mstpctl under /usr/local/sbin, plus the upstream license and revision record under /usr/local/share/doc/debtik-mstpd.

The daemon runs through mstpd.service. A DebTik service drop-in orders it before the application. DebTik explicitly adds its configured RSTP bridges to the daemon; the source installation does not install global bridge-stp or ifupdown hooks. See the upstream control manual.

Package-triggered daemon starts/restarts are suppressed while dependencies are installed, using a temporary policy-rc.d only if no existing policy is present. The existing policy is preserved, and an installer-created policy is removed on success or failure. Dependency repair does not restart DebTik. Newly installed runtime daemons are started by their corresponding application features; mstpd is explicitly started and enabled for RSTP readiness.

ACME issuance and renewal are implemented in Go; external certbot is not a runtime dependency. Kernel capabilities such as WireGuard, bridge networking and network administration permissions must be provided by the host/container.

Git application updates currently replace binaries and updater helpers. Use the latest checkout's ./install.sh --dependencies-only to synchronize dependencies on an existing installation; the updater does not run apt automatically.

Verification

The dependency installation and command check were exercised on the existing AMD64 appliance. RSTP daemon/control integration was verified using a real bridge in an isolated network namespace. All 43 runtime packages and the source-build tools were checked against Debian 13 ARM64 package metadata. The server and CLI are cross-built for ARM64; a complete fresh ARM64 installation remains a separate end-to-end deployment check.