First sign-in#

The machine reboots into the installed system and prints a banner above the login prompt with the web UI address on every interface it has an address on. Browse to that address — the port is 8443 and the scheme is https — accept the self-signed certificate, and sign in as admin with the password you chose during the install. If the box was installed some other way, or the install could not copy the agent's data across, the banner tells you the password instead.

The console banner#

  Wheelhouse 0.5.1 -- edge
  ==========================================================================
  Web UI:    https://192.168.1.1:8443  (eth1)
  Sign in:   with your Wheelhouse admin account
  Console:   wheelhouse, with the password chosen at install
             vyos is kept for recovery
  --------------------------------------------------------------------------
  Built on VyOS 1.5-rolling-202608220006
  Licences and corresponding source: /usr/share/doc/wheelhouse
  ==========================================================================

It is rewritten at boot and every 20 seconds after that. When the text changes and nobody is logged in on a console, that console's login prompt is restarted so the new banner is drawn at once.

Reading it:

• One Web UI: line per addressed interface, IPv4 first, then IPv6 in brackets. Up to five are listed; beyond that it says how many more there are, so that a router with a dozen VLANs does not push the login prompt off the screen.
• "waiting for an address on any interface" means the machine has not got one yet. Plug something in, or set an address from the console.
• An Agent: line appears only when the agent is not active, and names the command to read its log.
• [live image, not installed] on the first line means you are still on the stick.
• The Console: line names the account to log in with at the keyboard — wheelhouse after an install by the current installer, with vyos kept beside it for recovery and given the same password. On a live image it reads vyos / vyos on the live image; the installer sets yours.
• The last two lines are the attribution — the base version, read from VYOS_VERSION in /etc/os-release — and the path to the licences and the corresponding source on the machine itself.

The address and the port#

8443, over HTTPS. Material naming port 8090 describes the developer install, where the agent runs off-router against an existing VyOS box. That is not this.

The shipped systemd unit runs the agent with --addr 0.0.0.0:8443, which means it listens on every interface, including the WAN. Nothing but the firewall keeps the management UI off the internet. With the installer's firewall written and a LAN configured, the UI is reachable from the LAN and from nowhere else.

The certificate warning#

Your browser will warn. The agent generates a self-signed certificate on first start, because --tls-self-signed is in the shipped unit:

Add a security exception for this host. Do not import it into a root store: it is a leaf certificate for one machine, not a certificate authority, and a key on a router must not become a trust anchor for every site you visit.

The certificate is reused across restarts, and regenerated when it is unreadable, when it is marked as a CA, or when it is within 30 days of expiring. Replacing it with one your browsers already trust is what makes a certificate warning start meaning something again.

Signing in#

Sign in as admin with the password you typed during the install.

If the banner says Sign in: admin / <some string>#

The installer could not copy the agent's data onto the disk and the agent started fresh. That string is a one-time password the agent generated and wrote to /config/wheelhouse/initial-password, mode 600. Sign in with it. The file is deleted the moment that account's password changes.

The same thing happens on any machine where the agent starts with no accounts at all — a .deb installed on a stock VyOS box, for instance. The password is also logged once, at warning level, in the agent's journal.

The forced password change#

The bootstrap admin account is created with must_change_password set, and so is any account an administrator creates or resets. While that flag is set, a password screen stands in front of every router page.

The screen asks for the current password and the new one twice. It shows a strength note as you type — Strong, Reasonable, Workable, or a line saying short and simple is accepted but a passphrase is better. The note is advice and never blocks the form. Any non-empty password is accepted; there is no minimum length and no character rule. The gate lifts once the agent has confirmed the change.

Where you land#

The first page is Bridge → Overview. A ring and a headline say whether anything needs you — All clear when nothing does, or what does in a few words. Under them are the WAN traffic, what needs attention, and a drawing of what is connected to the router. It is described card by card in Overview.

The navigation is on the left, with Pinned at the top: Firewall, Sessions and Logs until you pin your own. The top bar holds the router's host name, a search field that finds pages, rules, reservations and peers (⌘K or Ctrl-K), and the account menu with Account, the theme switch and Sign out. The web UI starts dark; the theme switch changes it to light, and this browser remembers the choice.

What you can do before you have a licence#

Everything that reads. An unlicensed router signs you in and shows every page, every counter, every log and the audit trail; the Overview says "No licence is entered, so configuration changes are turned off." It refuses to stage, commit, roll back, install an app or run the reconcile loop, and the refusal names the fix. Enter a licence is the next page.

See also#

• Enter a licence — what an unlicensed router will and will not do.
• The first hour — the first things to do.
• If the install goes wrong — no banner, no address, no 8443.
• Serial consoles — what the banner says on a serial line.
• Accounts and sessions — what the password gate is guarding.
• Roles and the three planes — what admin can do that other roles cannot.
• Working from the console — the banner, the login and the shell.
• Locked out — when the sign-in is the problem.
• Overview — the first page you land on.
• The manual — every page of the navigation, group by group.