Wheelhouse docs

Roadmap#

Everything on this page is not built. It is here because the plan names it, because a reader will reasonably expect it, or because a gap is better stated than discovered — and each row says what the product does today in its place. There are no dates on this page and there will not be: a date is a promise, and the only honest promise a small team can make about an unbuilt feature is that it is unbuilt. What is finished is on What is finished, and what is not, and what changed in each release is on Release history.

Visibility and diagnostics#

Not builtWhat there is today
An nftables ruleset inspector — the real ruleset chain by chain, mapped back to the configuration objects that generated each ruleFirewall hit counters joined from firewall statistics, per rule. There is no per-object nftables view — PLAN.md §7
Packet capture from the UI, ending in a downloadable .pcapPOST /api/capture answers 501 and returns the monitor traffic command to run by hand; the Diagnostics page shows you that command rather than reporting a capture that never started — agent/main.go
Per-host traffic history, an embedded time-series database, long-term graphsLive counters, a server-sampled throughput series, and conntrack top-talkers. Flow export exists so an external collector can keep the history — PLAN.md §8
IPv6 operational viewsIPv6 is configurable and not observable: no v6 route view, no v6 concept in the uplink model, and a v4-first Firewall page — README.md
A tc and qdisc tree visualiser, and the full CAKE knob set with an IFB ingress pipelineThe QoS editor stages qos policy cake with bandwidth, flow isolation and RTT, attached as egress on one interface, beside the qdisc the kernel installed — ui/src/pages/Qos.tsx
Network namespace and VRF panelsNot built at all — PLAN.md §7
Ethtool and offload controls on the interface detailThe detail panel edits MTU, admin state and addresses. Ring and queue statistics are not surfaced — PLAN.md §8
WireGuard handshake and transfer countersTunnels, peers and configuration are shown. Those counters need wg show exposed by the agent, which it does not do

Services#

Not builtWhat there is today
UPnP or NAT-PMP, in any formNothing. No credible published miniupnpd image exists — the available ones are unaudited personal builds, refused on principle for a privileged host-network daemon — and the Companions page says the gap is open rather than offering something that does not work
A companion daemon for wildcard DNS, per-host DHCP options and PXE architecture matchingNothing. Each of those is a platform gap in the base — Built on VyOS
Creating an OpenVPN instance from the UIThe page lists instances with per-mode status and can disable or delete them. Creation waits on a generate pki flow, and the page shows the commands instead — PLAN.md §8
A 1:1 NAT editorThe nat static table reads rules made from the CLI; the editor is switched off, with the reason on the page — Built on VyOS
A deeper Tailscale integration — join, routes, exit node, ACL hintsTailscale is one of the 38 catalogue entries, installed like any other container app. There is no dedicated page — agent/catalog.json, PLAN.md §7

Configuration and automation#

Not builtWhat there is today
Git-backed configuration exportRevisions, a per-revision diff, a two-step restore and a configuration download — PLAN.md §8
An OpenAPI document or a generated API referenceThe endpoint table in the operator reference is the contract
An in-product update notificationNothing in the agent reads the release channel. The channel index exists for a person or a script to watch — Release history
A support-bundle commandFour manual calls, listed on Support
Audit export to syslog or a SIEM, and a tamper-evident logAn append-only file of JSON lines on the box, complete and attributed, with no hash chain and no export — Reporting a vulnerability
A catalogue fetched from a signed indexThe catalogue is embedded in the agent binary, so a corrected entry needs an agent release
Digest-pinned app imagesAll 36 container entries use floating :latest tags. Pinning is tooled (scripts/check-images.py --pin) and not applied — scripts/check-images.py

Accounts and access#

Not builtWhat there is today
Per-object permissionsThree roles — viewer, operator, admin — enforced server-side on every route
A hardware-key second factorTOTP only
Recovery codes, and an admin reset of another account's second factorNeither exists. Losing an enrolled device means console access and a hand-edited state.json

Platform, packaging and the product itself#

Not builtWhat there is today
A verified bare-metal installThe live image boots on hardware; a complete install to disk followed by a reboot into it is recorded only in VMs — What is finished, and what is not
A hardware compatibility listNone, and none will be invented. The image's driver packages can be listed; that is not a compatibility claim
A VM image — qcow2 or OVANone. Install from the ISO into a VM
An arm64 imageNone. The arm64 .deb exists for running the agent off-router against an arm64 router
A rescue boot entry, or a factory resetNeither. Recovery is the documented order in the upgrade guide, and a console shell
Signed releasesThe pipeline signs SHA256SUMS whenever a release key is configured, and publishes unsigned checksums with a warning when it is not. No key exists yet, so nothing published so far is signed — .forgejo/workflows/publish.sh
UI testsThe agent has over two hundred test functions, run race-clean in CI. ui/ has none; CI typechecks and builds it
A licence agreement, terms of service, a support address, published beta terms, pricesNone of them exist — The Wheelhouse licence, Support

What is deliberately not planned#

Not everything absent is a gap. These are decisions, and they are unlikely to move:

  • Per-app dashboard widgets. An app's health probe is TCP plus an optional HTTP path and never an app-specific API, so the store stays a store rather than becoming a collection of integrations to maintain — docs/apps.md.
  • Container start and stop out of band. There is no control socket. Stopping an app stages disable, starting it deletes that, and a restart is a two-commit bounce — because an app is configuration, and configuration is what rolls back.
  • Consumer features: WiFi controller parity, CGNAT ISP equipment, household routers. Wheelhouse manages the router — README.md.

See also#

Checked against#

PLAN.md · README.md · docs/apps.md · docs/upgrade.md · agent/main.go · agent/catalog.json · ui/src/pages/Qos.tsx · scripts/check-images.py · .forgejo/workflows/publish.sh

Updated 2026-09-02 roadmap status