iNetPanel 1.26: Debian 13 (Trixie) Support and an HTTPS Setup Wizard

iNetPanel 1.26.0 is out. It adds support for Debian 13 (Trixie) and serves the setup wizard over HTTPS. If you are running Debian 12, nothing changes and there is nothing you need to do.

Most of this release is the unglamorous work of making a clean install actually finish on a new Debian release. The interesting part is what broke, because almost none of it is specific to iNetPanel — if you self-host on Trixie you will hit several of these regardless of what panel you use.

Both Debian 12 and Debian 13 are supported

Debian 12 (Bookworm) left regular support on 11 July 2026 but stays on LTS until June 2028. There is no need to migrate an existing server. Debian 13 (Trixie) is now a first-class target, verified by a full clean install: install, create an account, issue DNS and a certificate, then delete the account.

What actually broke on Trixie

dnsutils no longer exists

dnsutils was a transitional package and Trixie dropped it. This was the first hard failure — the installer died before installing anything at all. The installer now uses bind9-dnsutils, which exists on both releases.

The PHP repository was pinned to bookworm

This one failed later and far more confusingly. The bookworm suite still resolves on Trixie, so the repository added cleanly and the error surfaced much further into the install: sury's bookworm build depends on libssl3, and Trixie ships libssl3t64 instead.

cloudflared deliberately stays on bookworm

Cloudflare publishes no Trixie suite. The bookworm package is a static Go binary with no dependencies, so it runs correctly on Trixie and pinning it there is the right call rather than a workaround. There is now also a direct .deb fallback, so a repository outage cannot abort an install part-way through.

PHP pinning is now built dynamically

phpMyAdmin depends on php-cli and php-mysql, which on Trixie resolve to a complete PHP 8.4 stack. The old pin only blocked 8.6 and above, so you could finish an install with two full PHP stacks side by side. The pin is now generated from the PHP version actually in use.

The setup wizard now uses HTTPS

The wizard collects your admin password and, a few steps later, your Cloudflare API key. Both previously travelled over plain HTTP. There was an HTTPS option, but it required running panel_ssl.sh by hand — which happens after those credentials have already been sent.

The installer now generates a self-signed certificate, serves the panel over TLS on port 443, and redirects HTTP. Your browser will warn you once; that is expected for a self-signed certificate and the closing message explains it. Replace it with a trusted certificate whenever you like:

inetp panel_ssl <hostname>

Fixes worth knowing about

Certificates could silently be self-signed on Debian 13

The worst kind of bug: it reported success. Trixie ships certbot 4.0, and certbot-dns-cloudflare 4.x removed support for the Cloudflare Global API Key. Issuance would fail, the panel would quietly fall back to a self-signed certificate, and then report the domain as done.

It now uses a scoped API token (Settings → Cloudflare), refuses rather than degrading, and verifies the certificate issuer before calling a domain complete.

inetp db_repair did nothing

MariaDB 11.x ships most mysql* compatibility symlinks but not mysqlcheck. The error was discarded, so the command reported zero tables checked and exited successfully.

Changing the SSH port could lock you out

Under systemd socket activation the listening port comes from ssh.socket, not sshd_config — but the safety check used sshd -T, which reads the config file. It now verifies the actual listener and keeps the socket unit in step.

WireGuard failed where iptables was absent

iptables is not a dependency of wireguard-tools, and firewalld 2.x no longer pulls it in. The NAT rules now prefer nft.

A newly added domain could return 503

An API request that omitted the PHP version reloaded a PHP-FPM service that did not exist, so the new pool's socket was never created. A related case: a domain set to inherit the panel default produced an invalid service name, and its FPM reload silently never happened.

Also in this release

install_LAMP.sh is now tracked in the repository, so it is covered by the same linting and secret scanning as every other script.

Upgrading

Existing Debian 12 servers are unaffected and need no action. To move an existing install onto HTTPS, run:

inetp panel_ssl <hostname>

iNetPanel is free and GPL-3.0. Full release notes and downloads are on GitHub.