Support#

Support is a subscription tier, not a product, and there is no support channel published yet — that is the first thing to know and this page says it before anything else. What does exist is a clear split between what an unlicensed router can still do, what a subscription is intended to include, and exactly which four or five commands answer most questions before anyone writes in. This page is SUPPORT.md restated for the web; where the code and that file disagree, the code wins and the difference is noted.

What each tier gets#

Tier	Who	Channel	Response
Unlicensed	Anyone, forever	none	—
Pro	Subscribers	e-mail	1 business day
Business	Subscribers	e-mail and scheduled check-ins	4 business hours

Unlicensed is a real tier, not a trial that expires into a brick. A router with no licence signs you in, shows every page, counter, log and audit entry, and refuses only to change configuration. It comes with no support channel.

A security vulnerability does not go to support. Use the disclosure route instead, and do not open an ordinary support thread describing the flaw — Reporting a vulnerability.

Before you write in#

There is no support-bundle command. Collect these by hand. Everything except /health needs authentication: use an API token with the viewer role (Administration → API tokens) in an Authorization: Bearer wh_… header rather than a copied session cookie — a cookie will bite you the first time you need a request that changes something, because every mutation also has to echo the X-Wheelhouse-CSRF header that the browser sends and a token does not.

bash

R=https://<router>:8443
T=wh_...                                    # an API token with the viewer role

wheelhouse-agent --version                  # on the router: the exact build
curl -sk  $R/health                         # liveness only: no auth, no version
curl -sk -H "Authorization: Bearer $T" "$R/api/audit?limit=300"   # who changed what, when
curl -sk -H "Authorization: Bearer $T" "$R/api/history"           # the router's commit revisions
curl -sk -H "Authorization: Bearer $T" "$R/api/fleet"             # multi-router status (licensed only)

GET /health answers {"status":"ok"} and nothing else. That is deliberate: telling an unauthenticated caller which build a router is running is free reconnaissance, and the version was removed from that response — agent/main.go (handleHealth), CHANGELOG.md.

GET /api/audit returns the most recent 300 entries unless ?limit= says otherwise.

Getting the version#

Where	What it tells you
`wheelhouse-agent --version`, or the `version` subcommand	The agent's version. It is answered before any configuration is read or any secret file is opened, so a router whose agent will not start still answers it
`dpkg-query -W -f='${Version}\n' wheelhouse-agent`	The same, from the package database
The console banner	`Wheelhouse <version>` on the first line, with the host name; `Built on VyOS <version>` below the rule
`cat /etc/os-release`	`VERSION`, and `VYOS_VERSION` for the base
`GET /api/version`, signed in	The router's own `show version` output, which is the base's, not the agent's

The log#

On a Wheelhouse appliance the agent's log is the journal:

bash

sudo journalctl -u wheelhouse-agent --since '1 hour ago'

/opt/wheelhouse/agent.log exists only on the developer install path (install/install.sh without systemd), not on the shipped image.

What to tell us#

Versions — both of them, from the table above.
What you did and what happened. For a configuration problem, the exact set or delete path the editor showed you, and the router's own error text if it refused.
How to reproduce it. wheelhouse-agent --demo starts without VyOS credentials and reproduces most UI and API behaviour with no router at all; a minimal desired-state file or fleet.json is enough for the reconcile and fleet paths.
The audit entries and the journal lines around the timestamp.

Known gaps that generate tickets#

Ours, not yours. Listed so nobody spends an afternoon proving them:

A failed upgrade is not self-service. There is a documented recovery order and no rescue boot entry — docs/upgrade.md.
No admin can reset another account's second factor, and there are no recovery codes. Losing an enrolled phone means console access and a hand-edited state.json.
App images are floating tags. If an install worked last month and fails today, the upstream image changed underneath you — docs/apps.md.
Packet capture is not implemented. The Diagnostics page hands you the monitor traffic command instead of pretending to run a capture.

The longer list is on What is finished, and what is not.

Beta#

The beta is closed and invite-only while the ISO gets its first bare-metal runs. Seats go to operators willing to install on real hardware and report what breaks. The terms, the seat count and how to apply are not set: <TODO: owner>. There is nothing to apply to in the meantime, and this page will not pretend otherwise.

Reporting an error in this documentation#

Same route, and the same gap: there is no address published yet. When there is, a documentation report is most useful as the page's URL, the sentence that is wrong, and what the code actually does. Every page here ends with the files its claims were checked against, which is usually the fastest way to show that one of them has drifted — About this documentation.

Checked against#

SUPPORT.md · PRICING.md · SECURITY.md · agent/main.go · agent/store.go · docs/upgrade.md · docs/apps.md · CHANGELOG.md