Fix firewall backend installation

test/Dockerfile.server

@@ -18,7 +18,7 @@ ENV ENABLE_NFTABLES=${ENABLE_NFTABLES}
 # Note: socat is installed by openvpn-install.sh during OpenVPN installation
 RUN if command -v apt-get >/dev/null; then \
         apt-get update && apt-get install -y --no-install-recommends \
-            iproute2 iptables curl procps systemd systemd-sysv dnsutils jq \
+            iproute2 curl procps systemd systemd-sysv dnsutils jq \
         && if [ "$ENABLE_NFTABLES" = "y" ]; then apt-get install -y --no-install-recommends nftables; fi \
         && rm -rf /var/lib/apt/lists/*; \
     elif command -v dnf >/dev/null; then \
@@ -69,7 +69,8 @@ RUN chmod +x /opt/openvpn-install.sh
 COPY test/server-entrypoint.sh /entrypoint.sh
 COPY test/validate-output.sh /opt/test/validate-output.sh
 COPY test/local-network-detection.sh /opt/test/local-network-detection.sh
-RUN chmod +x /entrypoint.sh /opt/test/validate-output.sh /opt/test/local-network-detection.sh
+COPY test/interactive-install-flow.sh /opt/test/interactive-install-flow.sh
+RUN chmod +x /entrypoint.sh /opt/test/validate-output.sh /opt/test/local-network-detection.sh /opt/test/interactive-install-flow.sh
 
 # Create systemd service for the test script
 # PassEnvironment passes Docker env vars (-e) from PID 1 to the service

test/interactive-install-flow.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# shellcheck disable=SC1091,SC2034
+# SC1091: The installer path is provided by the test environment.
+# SC2034: Configuration globals are consumed by sourced installer functions.
+set -euo pipefail
+
+INSTALLER=${1:-/opt/openvpn-install.sh}
+export FORCE_COLOR=0 LOG_FILE="" NON_INTERACTIVE_INSTALL=n OUTPUT_FORMAT=table
+# shellcheck source=../openvpn-install.sh
+source "$INSTALLER"
+
+questions_called=n
+validation_called=n
+install_called=n
+
+isOpenVPNInstalled() {
+	return 1
+}
+
+requireNoOpenVPN() {
+	return 0
+}
+
+installQuestions() {
+	questions_called=y
+	VPN_SUBNET_IPV4=10.23.0.0
+	VPN_SUBNET_IPV6=fd42:23::
+	CLIENT_IPV6=n
+	ROUTE_INTERNET=y
+}
+
+validate_configuration() {
+	validation_called=y
+}
+
+installOpenVPN() {
+	install_called=y
+	if [[ ${VPN_GATEWAY_IPV4:-} != "10.23.0.1" ]]; then
+		echo "FAIL: Interactive install did not prepare the IPv4 VPN gateway" >&2
+		exit 1
+	fi
+	if [[ ${IPV6_SUPPORT:-} != "n" ]]; then
+		echo "FAIL: Interactive install did not prepare legacy IPv6 state" >&2
+		exit 1
+	fi
+}
+
+cmd_interactive
+
+for state in \
+	"questions_called:$questions_called" \
+	"validation_called:$validation_called" \
+	"install_called:$install_called"; do
+	if [[ ${state#*:} != "y" ]]; then
+		echo "FAIL: Interactive install skipped ${state%%:*}" >&2
+		exit 1
+	fi
+done
+
+echo "PASS: Interactive install prepares derived network configuration"

test/server-entrypoint.sh

@@ -4,6 +4,7 @@ set -e
 echo "=== OpenVPN Server Container ==="
 
 /opt/test/local-network-detection.sh /opt/openvpn-install.sh
+/opt/test/interactive-install-flow.sh /opt/openvpn-install.sh
 
 # Create TUN device if it doesn't exist
 if [ ! -c /dev/net/tun ]; then
@@ -185,6 +186,21 @@ if [ "$INSTALL_EXIT_CODE" -ne 0 ]; then
 	exit 1
 fi
 
+# Native firewall backends must not require the iptables package. The fallback
+# backend must install it because the test image does not include it.
+if systemctl is-active --quiet firewalld || systemctl is-active --quiet nftables; then
+	if command -v dpkg-query >/dev/null && dpkg-query -W -f='${db:Status-Abbrev}' iptables 2>/dev/null | grep -q '^ii'; then
+		echo "FAIL: iptables was installed with a native firewall backend"
+		exit 1
+	fi
+else
+	if ! command -v iptables >/dev/null; then
+		echo "FAIL: iptables fallback dependency was not installed"
+		exit 1
+	fi
+fi
+echo "PASS: Firewall dependencies match the selected backend"
+
 # Verify all expected files were created
 echo "Verifying installation..."
 MISSING_FILES=0