v1.26.0 — Adds Debian 13 (Trixie) support and serves the setup wizard

Adds Debian 13 (Trixie) support and serves the setup wizard over HTTPS.

Debian 13

Both Debian 12 (Bookworm) and Debian 13 (Trixie) are supported. Debian 12 left regular support on 2026-07-11 but stays on LTS until June 2028, so existing servers do not need to migrate.

Verified by a full clean install on Debian 13: install → create account → DNS and certificate → delete account.

What had to change:

• dnsutils no longer exists on Trixie. It was a transitional package. The installer now uses bind9-dnsutils, which exists on both releases. This was the first hard failure — the installer died before installing anything.
• The PHP repository was pinned to bookworm. That suite still resolves, so the failure came later and confusingly: sury's bookworm build depends on libssl3 and Trixie only ships libssl3t64.
• cloudflared stays on the bookworm suite deliberately. Cloudflare publishes no Trixie suite, and the bookworm package is a static Go binary with no dependencies, so it runs correctly on Trixie. There is now also a direct .deb fallback so a repository outage cannot abort an install part-way.
• PHP version pinning is built dynamically. phpMyAdmin depends on php-cli/php-mysql, which resolve to a full PHP 8.4 stack on Trixie. The old pin only blocked 8.6 and above, so two complete PHP stacks would end up installed side by side.

Setup wizard is now HTTPS

The wizard collects the admin password and, a few steps later, your Cloudflare API key. Both previously went over plain HTTP, and there was no HTTPS option until panel_ssl.sh was run by hand — which is after those credentials have been sent.

The installer now generates a self-signed certificate, serves the panel over TLS on 443, and redirects HTTP. Your browser will warn once; that is expected, and the closing message explains it. Replace it with a trusted certificate at any time:

inetp panel_ssl <hostname>

Fixed

Certificates could silently be self-signed on Debian 13. Trixie ships certbot 4.0, and certbot-dns-cloudflare 4.x removed support for the Cloudflare Global API Key. Issuance would fail, the panel would fall back to a self-signed certificate, and report success. It now uses a scoped API token (Settings → Cloudflare), refuses rather than degrading, and verifies the certificate issuer before calling a domain done.

inetp db_repair did nothing on Debian 13. MariaDB 11.x ships most mysql* compatibility symlinks but not mysqlcheck, and the error was discarded — so it reported zero tables checked and exited successfully.

Changing the SSH port could lock you out. Under systemd socket activation the listening port comes from ssh.socket, not sshd_config, but the check used sshd -T, which reads the config. It now verifies the actual listener and keeps the socket unit in step.

WireGuard setup failed where iptables was absent. It is not a dependency of wireguard-tools, and firewalld 2.x no longer pulls it in. The NAT rules now prefer nft.

A newly added domain could return 503. An API request omitting the PHP version reloaded a PHP-FPM service that did not exist, so the new pool's socket was never created. Related: a domain set to inherit the panel default produced an invalid service name, and its FPM reload silently never happened.

Also

install_LAMP.sh is now tracked in the repository, so it is covered by the same lint and secret-scanning as every other script.

Upgrading

Existing Debian 12 servers are unaffected and need no action. To move the panel to HTTPS on an existing install, run inetp panel_ssl <hostname>.