Wheelhouse and VyOS#

Wheelhouse is built on VyOS, which is GPL-licensed, on a Debian base. The router underneath is VyOS: its configuration tree, its commit and commit-confirm, its revision archive, its HTTP API, and the Linux networking stack it integrates. Wheelhouse adds a control-plane agent, a web UI, accounts and roles, an audit log, an app catalogue, a desired-state engine and an installer, and drives VyOS as a separate program over its documented API.

Which half is which#

From the base	From Wheelhouse
The configuration tree, and `set` / `delete` as the way to change it	The staging area and the Commit Bar — the change set as an object you can see
`commit`, `commit-confirm` and the reboot that makes it safe	The button that arms it, the countdown, and the flagging of paths that warrant it
The revision archive and `show system commit`	The history screen, the per-revision diff view and `POST /api/rollback`
The Linux kernel, nftables, conntrack, `tc`, WireGuard, veth and VLAN	The screens over them, and the state-beside-intent comparisons
FRR, Kea, `pdns-recursor`, strongSwan, OpenVPN, Suricata, Podman	The pages that read and write their configuration subtrees
The HTTP API the agent talks to	`wheelhouse-agent`: caching, parsing, staging, accounts, audit, metrics
—	Accounts, roles, sessions, TOTP, OIDC, API tokens, the audit log
—	The app catalogue and the apps-are-config model on top of `set container`
—	The desired-state engine and the reconcile loop
—	The installer, the image build, the branding and the release pipeline
—	The licence

The transactional configuration model this product is built around is VyOS', not Wheelhouse's.

Where the boundary is drawn#

agent/ and ui/ are separate programs from every GPL component. The agent speaks to the router over its documented HTTP API and its op-mode commands; it links against no VyOS code and copies none. No Wheelhouse file is derived from vyos-1x, FRR, Kea, pdns-recursor, nftables or the kernel. The rules:

No GPL or AGPL code is copied into agent/ or ui/ — not a function, not a parser, not a constant table. Behaviour that exists in a GPL project is called, or reimplemented from its documented behaviour.
Compiled-in dependencies are permissive only (MIT, BSD, ISC, Apache-2.0). Anything weak-copyleft needs a recorded decision first; strong-copyleft is out.
Patches to GPL components are published.
The trademark is separate from the licence. Shipped images are self-built and rebranded per upstream's trademark policy, with attribution intact.

The agent has five direct dependencies and everything else is the Go standard library. Third-party licences lists them with their versions and licences.

When the base cannot express something#

Some things a router needs have no node in the configuration tree, or have one that does not behave as its shape suggests. This documentation calls those platform gaps. Four of them, with what Wheelhouse does about each:

Gap	What Wheelhouse does
Wildcard DNS records: `records a *` fails validation, and the wildcard is spelled `any`	The DNS page takes `` and stages `any`, which the base writes into the zone as ``.
RFC 4578 architecture-conditional PXE: one boot file per subnet	The dnsmasq catalogue app. Per-host DNS servers and routers are a reservation's own options on the DHCP page.
CAKE: no DOCSIS or ATM overhead compensation — there is no `docsis`, `overhead`, `mpu` or `atm` leaf under `qos policy cake`, so the kernel keeps reporting `raw overhead 0`	The QoS page stages what the tree does express — an upload and a download rate on each interface, a VLAN included, with bandwidth, flow isolation, RTT, `ack-filter`, `flow-isolation-nat` and `no-split-gso` for CAKE — and says whether the kernel is running what the configuration asks for. Overhead compensation is named as a gap rather than offered as a command the tree would refuse.
CAKE cannot attach to `ingress`: that node takes a limiter and nothing else	The QoS page offers both routes as the download's two methods: Policing is a limiter on `qos interface <if> ingress`, and CAKE shaping goes through an IFB (`interfaces input ifbN`, a `redirect` on the interface, and the policy on the IFB's egress) that the agent's planner chooses and reuses. Upload is CAKE on the interface's egress. The IFB device itself is never deleted, because that commit is one this base has been seen to fault on: turning download shaping off leaves it idle for the next use, and nothing is handed to the console.
Committing `nat static` through this base's HTTP API stops the API process; the CLI accepts the same lines	Wheelhouse does not write `nat static`: the NAT page builds a 1:1 mapping as a destination and source NAT rule pair, which the Commit Bar applies like any other change, and lists a `nat static` rule made elsewhere as read-only. The agent refuses `nat static` at every staging and configure route, so nothing can reach that commit path by accident.

Living on a rolling base#

The base is a rolling release, and its configuration syntax moves — mac-address became mac for Kea static mappings, for instance. Two things follow.

Images are pinned and self-built. Each release is built from vyos-build at a named commit, and every release carries a SOURCES-<version>-amd64.txt recording that commit, the container it was built in and the version of every installed package.
Platform behaviour is verified against a live router. The API behaviour this product depends on is checked against a running system, and re-checked, because a rolling base can change it.

Saying so on the box#

The attribution is not confined to a documentation page.

The console banner shown above every login prints the Wheelhouse version and the host name, the web UI addresses, the path to the licence texts, and at its foot Built on VyOS <version>.
The post-login banner the router itself renders says Built on VyOS <version> (GPL). Corresponding source: /usr/share/doc/wheelhouse.
The product's own About page says the same inside the web UI.
/usr/share/doc/wheelhouse/ on a running router carries the third-party licence text, the source record and where the corresponding source is.

Both banners name the base version as /etc/os-release records it. Where that version cannot be resolved, the credit prints without one rather than with a wrong one.