Built on VyOS#

Wheelhouse is built on VyOS, which is free software under the GNU General Public License, version 2, on a Debian base. That is not a footnote. The kernel, nftables, FRR, Kea, pdns-recursor, WireGuard, strongSwan, OpenVPN, Podman and the configuration tree they all read are VyOS' work. Wheelhouse adds four things — the agent, the web UI, the installer and the app catalogue — and each of them is a separate program that drives VyOS over its documented HTTP API and its op-mode commands. This page says exactly where that line is drawn, which base each image is built from, and what upstream cannot express that Wheelhouse has had to work around.

What the base provides#

Everything in this column exists because VyOS built it, and the product would not be possible without it — PLAN.md §3.

The REST endpoints stay off until service https api rest is set, which first boot does — packaging/firstboot.sh. A router that has not had it set answers 404 {"detail": "Not Found"} to everything, and the agent says so rather than reporting an empty router.

What Wheelhouse adds#

• wheelhouse-agent — a single Go binary, run by systemd as root. Staging, native commit-confirm, revision rollback, an attributed audit log, parsed operational state, a telemetry WebSocket, accounts with Argon2id and TOTP, three roles enforced per route, scoped API tokens, OIDC single sign-on, Prometheus metrics, TLS, and the UI embedded in its own assets.
• The web UI — a React single-page application. Every editor renders the set and delete lines it will run before it runs them.
• The installer — wheelhouse-install and its unattended path, plus the OPNsense importer that turns a config.xml into VyOS commands and a report.
• The app catalogue — container entries declared in the router's own configuration tree, and two built-in feature modules.
• The licence — offline-verified subscription keys gating the write plane only.

None of it is derived from VyOS or from any other GPL work.

Where the boundary sits#

agent/ and ui/ are separate processes from every GPL component. The agent links against no VyOS code and copies none. No file in the repository is derived from vyos-1x, FRR, Kea, pdns-recursor, nftables or the kernel. Four rules keep it that way, in order of importance — docs/licenses.md:

1. No GPL or AGPL code is copied into agent/ or ui/. Not a function, not a parser, not a constant table. Where behaviour is needed that exists in a GPL project, it is called or reimplemented from its documented behaviour.
2. Permissive only for compiled-in dependencies: MIT, BSD-2/3, ISC, Apache-2.0. Anything weak-copyleft needs a decision recorded in an ADR first; anything strong-copyleft is out. The list is short enough to audit — Third-party licences.
3. Patches to GPL components get published. Wheelhouse patches exactly one GPL file today, in the build tooling — see below.
4. The trademark is separate from the licence. See Trademarks.

The practical consequence for you: the GPL parts of a Wheelhouse image are ordinary, unmodified upstream packages, and you can obtain their source — Corresponding source. The agent, the UI and the installer are proprietary and their source is not offered — The Wheelhouse licence.

Which base an image is built from#

Images are self-built. packaging/iso/build-iso.sh clones vyos-build, resets it to a pinned commit, applies the branding, drops the Wheelhouse .deb into packages/ and runs upstream's own build-vyos-image inside upstream's own build container.

The pin matters because the base is a rolling release with no snapshots: the apt repository it installs from moves, so two builds a week apart are not the same image. The exact package versions of a given build are recorded in SOURCES-<version>.txt and in /var/lib/dpkg/status on the image itself. That record, not the pin, is what identifies a build.

The base version is written into /etc/os-release as VYOS_VERSION, in the form <branch>@<commit> — packaging/iso/wheelhouse.toml. Four places on a running router will tell you what you are on:

cat /etc/os-release            # NAME, ID=wheelhouse, ID_LIKE="vyos debian", VYOS_VERSION
cat /opt/vyatta/etc/version    # the base's own version line
show version                   # VyOS' own op-mode command

and the console banner's last lines, which print Built on VyOS <version> above every login prompt — packaging/console-banner.sh.

The one GPL file Wheelhouse changes#

Not in the image — in the build tooling. build-iso.sh applies three substitutions to vyos-build's own scripts/image-build/build-vyos-image:

--iso-application "VyOS"   ->  "Wheelhouse"
--iso-volume "VyOS"        ->  "WHEELHOUSE"
hostname=vyos              ->  hostname=wheelhouse

Each substitution asserts that the string it replaces is really there and fails the build if it is not. The resulting diff is published with every release as vyos-build-wheelhouse-<version>.patch, is named in the source record, and the build fails if that diff comes out empty. Everything else Wheelhouse contributes to the image is added as new files — the flavor, two branding hooks, the boot splash, the documents under /usr/share/doc/wheelhouse/ and the agent package — and none of them is derived from upstream's.

What the image changes about identity#

Removing those two files strips no required notice. Every licence and every copyright file stays exactly where the packages put it, under /usr/share/doc/ — Third-party licences.

The branding hook asserts ID=wheelhouse in /etc/os-release afterwards and fails the build if the override stopped winning, so the failure mode is a build that stops rather than an image that calls itself something it is not.

Platform gaps#

Facts, with the date they were checked and what Wheelhouse does about each one today. These are the cost of the base, stated so you can judge it; they are not complaints about upstream, and the same tree gives Wheelhouse everything on the list further up this page.

Trademarks, briefly#

VyOS is a registered trademark of Sentrium S.L. Wheelhouse is not affiliated with, endorsed by, certified by or supported by the VyOS project or Sentrium S.L. The images are self-built and rebranded per upstream's trademark policy with attribution intact, and support for this product comes from Wheelhouse — do not ask the VyOS project about it. The full position is on Trademarks.

See also#

• Corresponding source — how to get the source for every GPL and LGPL component in the image.
• Third-party licences — what is compiled into the agent and bundled into the UI, and under what terms.
• The Wheelhouse licence — what the proprietary half is licensed under.
• Roadmap — which of the gaps above are planned, and which are open questions.
• Wheelhouse and VyOS — which half of the box you are looking at, as a concept.
• The agent and the router — what actually talks to what.
• 1:1 NAT and QoS — the two pages where the gaps above are visible on screen.

Checked against#

PLAN.md · README.md · docs/licenses.md · docs/apps.md · packaging/iso/build-iso.sh · packaging/iso/wheelhouse.toml · packaging/iso/branding/50-wheelhouse-brand.chroot · packaging/console-banner.sh · packaging/firstboot.sh · agent/vyos.go · agent/opmode.go