Advanced mode and the router's commands#

The web interface describes the router in words. Settings have names, pending changes read as sentences, and each revision in the history says what it changed. Behind every one of those words is the router's own configuration language: a change is a list of set and delete commands against the configuration tree.

Advanced mode shows that language beside the words. It is a preference of each user, off by default, turned on under Account → Preferences → Advanced mode (Shows the router's configuration commands, the configuration tree and reconcile.). It is kept with the account, so it follows the user from one browser to the next.

Advanced mode changes what is shown, not what anyone may do. What a user can change is decided by their role.

What it adds#

Where	Without Advanced mode	With Advanced mode, also
Page headers	The title and a subtitle	The part of the configuration tree the page edits
Editors	Fields, and the checks under them	A preview of the commands the change adds
Empty pages	What is missing, and the button that adds it	The commands that would add it
The Commit Bar	Pending changes as sentences, each with Remove	Each operation, marked `+` or `−`, with × to remove it, and a Commands block holding the whole set
A change the router refused	The router's reason	The router's whole message
System → History	What this change did, in sentences	The router's own diff of that revision
System → Audit log	Who did what, and the changes in sentences	The operation, the setting it named, and the commands
API tokens	The new token, once	An example request that uses it
Navigation	Every other page	Configuration tree and Reconcile under System

The Configuration tree page shows the running configuration and the commands that recreate any part of it; it is read only. The Reconcile page compares the router with a desired-state file.

One spelling, rendered the same everywhere#

The commands Advanced mode shows are the commands that run. The same quoting rule renders the Commit Bar's list, the lines the agent returns for GET /api/staged, and the lines the audit log keeps.

A path element containing a space, a tab, a single quote or a double quote is wrapped in single quotes with embedded single quotes escaped, which is what the router's own tab completion produces. A double quote counts: description WAN "primary" left bare is two shell words.

An empty path element is spelled '' and refused before it can be added to the pending changes, rather than failing later with a message that does not name the change.

Taking the commands to a terminal#

The commands are ordinary configuration commands. In a configuration session on the router they do what Apply changes does:

bash

ssh vyos@<router>
configure

set interfaces ethernet eth1 description 'primary uplink'
set interfaces ethernet eth1 address 203.0.113.2/24

bash

compare        # the same changes the Commit Bar lists
commit
exit

If the commands Advanced mode shows and the router's own compare disagree, the page is wrong.

What the commands do not cover#

Every change Wheelhouse applies is a set or a delete against the configuration tree. There is no second control plane beneath the tree in the shipped agent: it programs no netlink interface and runs no programs on the router to configure it. Everything reaches the router over its HTTP API.

Two limits:

A command is not a validation. The commands are what the router will be asked to run. Whether it accepts them is decided when they are applied, and a refusal comes back with the router's own reason; see The Commit Bar.
A command can contain a secret. A pre-shared key you just typed appears in the commands, because a preview that showed [redacted] for your own change would not be a preview. It is redacted for anyone below the operator role. The sentences shown without Advanced mode never contain a secret, whatever the role.