diff --git a/server/services/postInstall.ts b/server/services/postInstall.ts
index 4f430b2..5f0a0ae 100644
--- a/server/services/postInstall.ts
+++ b/server/services/postInstall.ts
@@ -48,8 +48,8 @@ export const PROFILES: Record<string, ProfileManifest> = {
   },
   identity_network: {
     id: "identity_network",
-    label: "Hostname + IP statique",
-    description: "Définit le hostname, le domaine et l'adresse IP statique (sauvegarde des fichiers).",
+    label: "Hostname + IP statique (Debian/VM)",
+    description: "Définit hostname, domaine et IP statique. Cible Debian + ifupdown (VM netinstall) ; refuse proprement les autres cas (Ubuntu/netplan…). Réseau appliqué au reboot.",
     risk: "network_change",
     requiresConfirmation: true,
     template: "custom/identity-network.sh.tpl",
diff --git a/templates/custom/identity-network.sh.tpl b/templates/custom/identity-network.sh.tpl
index 2340467..6b5192e 100644
--- a/templates/custom/identity-network.sh.tpl
+++ b/templates/custom/identity-network.sh.tpl
@@ -11,6 +11,27 @@ GW="{{gateway}}"
 DNS="{{dnsNameservers}}"
 echo "===SU:CUSTOM_IDENTITY==="
 
+# --- Précheck : Debian + ifupdown uniquement (MVP, cible VM netinstall) ---
+. /etc/os-release 2>/dev/null
+if [ "$ID" != "debian" ]; then
+  echo "ERR=os_not_supported"
+  echo "DETAIL=identity_network ne gère que Debian (ID=$ID)"
+  echo "===SU:EXIT=2==="
+  exit 2
+fi
+if ls /etc/netplan/*.yaml >/dev/null 2>&1; then
+  echo "ERR=unsupported_network_manager"
+  echo "DETAIL=netplan détecté ; ce profil cible ifupdown"
+  echo "===SU:EXIT=2==="
+  exit 2
+fi
+if [ ! -f /etc/network/interfaces ]; then
+  echo "ERR=ifupdown_not_found"
+  echo "DETAIL=/etc/network/interfaces absent"
+  echo "===SU:EXIT=2==="
+  exit 2
+fi
+
 # --- Sauvegardes ---
 TS=$(date +%s)
 cp -a /etc/hosts "/etc/hosts.su.bak.${TS}" 2>/dev/null