DebTik

DebTik

DebTik is a network router appliance with an embedded web interface, REST API and RouterOS-style CLI. It manages network interfaces, routing, firewall/NAT, DHCP/DNS, WireGuard, IPsec, PPP, VRRP and AeroTUN. AeroTUN v3 uses pinned peer identities and encrypted tunnels; it works with native TUN or a veth fallback when /dev/net/tun is unavailable.

Current release: 1.3.9. See functionality corrections and verification for network persistence, firewall isolation/IPv6, service error handling and certificate renewal changes.

Install

On a Debian 13 AMD64 or ARM64 host/container with systemd, run as root:

apt-get update
apt-get install -y git ca-certificates
git clone https://gogs.eparmak.local/eparmak/DebTik.git
cd DebTik
./install.sh

The internal Git server uses a private CA. Trust that CA before cloning, or replace the clone command above with this command using its verified TLS public key pin:

git -c http.sslVerify=false \
  -c 'http.pinnedpubkey=sha256//u4xyt0njDzn4BAQnS6OTGrXBxVE8vMg5BSNIuryUsMo=' \
  clone --depth 1 --branch v1.3.9 https://gogs.eparmak.local/eparmak/DebTik.git

This verifies the server's pinned key for this command; it does not change global Git settings. Reverify the pin if the server's TLS key changes. For a reproducible fresh installation, v1.3.9 contains the complete dependency installer and native Linux firewall corrections.

install.sh installs and verifies the dependencies listed in Dependencies, including Go, WireGuard, firewall, BIRD, DHCP/DNS, PPP clients and servers, strongSwan plugins, diagnostics and the RSTP daemon. It builds debtik and debtik-cli, installs the updater helpers, and starts debtik.service. It can be run again; existing /etc/debtik files and tunnel keys are preserved. Previous binaries are saved as /usr/local/bin/*.previous. For native TUN in an LXC container, enable /dev/net/tun on the host; otherwise AeroTUN uses veth.

To install or repair dependencies on an existing appliance without replacing the application binaries or restarting DebTik:

sudo ./install.sh --dependencies-only
sudo ./install.sh --check-dependencies

The dependency check exits nonzero and names missing packages, commands or an outdated Go toolchain. Existing Proxmox ifupdown2 installations are retained. On Debian 13, where mstpd is not packaged, the installer builds a pinned upstream release with archive checksum verification; its daemon is enabled before DebTik starts. Go archives are checksum verified as well.

The web UI and authenticated REST API use HTTP port 80 by default. HTTPS is an optional separate www-ssl management service, normally port 443, configured in Certificates and Management Services. The application SSH CLI normally listens on 2222, and Telnet/debtik-cli on 8282. The built-in bandwidth test server uses 2000. Ports can be changed in the management services UI where available. The main service command is /usr/local/bin/debtik -addr :80; systemd/debtik.service defines the installed unit.

Configuration is JSON under /etc/debtik/ (including services.json and vpn/aerotun_instances.json). AeroTUN secrets and private identities remain on the local appliance. Do not copy one side's private identity to the other.

Usage

Open http://<appliance-ip>/ and sign in. For the appliance SSH CLI, connect to port 2222. The standalone debtik-cli connects to the Telnet CLI by default:

debtik-cli -addr 127.0.0.1:8282
debtik-cli -addr 127.0.0.1:8282 -u admin -p '<password>' -c '/interface aerotun print'

Run help within the CLI for supported commands. The API is under /api/ on the web listener and requires an authenticated session except for login. Read-only users can inspect state; configuration changes require elevated roles. AeroTUN operations require the full administrator role.

Git updates

In Updates, enter an HTTP(S) or SSH Git repository, then save and check for releases. Releases are stable Git tags named vMAJOR.MINOR.PATCH (for example v1.1.0). The largest numeric version is selected; installation is allowed only when it is strictly greater than the installed version. Equal versions, older versions, malformed tags and prereleases are not installed. The selected tag must match the repository’s VERSION file. The updater clones into /var/lib/debtik/update, builds the server and CLI first, backs up the installed binaries, restarts the service and checks that it remains active. If installation fails, it restores the previous binaries. Restore previous version is available in the same menu. Logs and the current state are shown there. Only full administrators can change the source or run update actions. New releases require bumping VERSION, committing the change, creating its matching vX.Y.Z tag and pushing both the commit and tag. Recovery rollback remains an explicit separate action. The server carries its matching updater helpers and refreshes an existing managed installation at startup, including upgrades started by older updater versions. Each appliance updates independently; for paired AeroTUN peers, update one side and verify its connection before updating the other.

install.sh must have been run from a Git checkout at least once to install the updater helper. Git access from the appliance to the selected repository and the required Go toolchain are needed. Git credentials belong in the appliance's Git/SSH configuration; repository URLs containing embedded credentials are rejected. For a private Git server whose CA is not trusted by Debian, enter its verified sha256//... TLS public key pin in Updates. Rotate the pin when that server changes its TLS key.

See native Linux firewall behavior and supported options.

Development and checks

go test ./...
go vet ./...
node --test scripts/ui-regression.test.cjs
make build

The application embeds internal/web/static. See AeroTUN v3, AeroTUN v2 compatibility and UI/CLI changes.