What Wheelhouse is#

Wheelhouse OS is a bootable router image. Underneath it is VyOS, which is GPL-licensed, on a Debian base. On top are two programs: wheelhouse-agent, a single Go binary that systemd runs as root, and a React web UI that the agent serves on port 8443. The agent drives the router over VyOS' documented HTTP API and its operational-mode commands; it links against no VyOS code. You install one image and manage it at one URL.

The division of labour#

	Whose it is
The kernel, nftables, conntrack, FRR, Kea, `pdns-recursor`, strongSwan, OpenVPN, the container runtime	VyOS' and Debian's
The configuration tree, `commit`, `commit-confirm`, `rollback`, the config archive	VyOS'
The agent, the web UI, the installer, the app catalogue, the pending changes, the licence	Wheelhouse's

Wheelhouse does not reimplement routing and does not hide the router. Every editor in the UI writes VyOS set and delete lines, says in plain words what they will change before anything happens, and applies them through the same transaction the CLI uses.

What it adds#

Every setting is edited in a form. Pages name settings in words and check what is typed before anything is saved. Nothing on any page applies itself.
One Commit Bar. Changes from every page wait in one list of pending changes, each said as a sentence (Add VLAN 20 on eth1). That list is what is applied, and the bar at the bottom of the page is the only thing that applies it.
Auto-revert is the router's own. Changes can be applied with VyOS' commit-confirm timer armed: unless they are kept in time, the router restarts with its saved configuration.
The router's own language, when you want it. Advanced mode shows the exact set and delete lines behind every change, and the whole configuration as commands.
Accounts, roles and an attributed audit log. Argon2id password hashing, TOTP, sessions with CSRF, three server-enforced roles, scoped API tokens, OIDC single sign-on, and an audit entry naming who changed what from where.

What it manages#

A page per left-hand nav entry, across eight groups: interfaces, static routes, BGP and OSPF, high availability and uplinks, QoS, firewall, NAT, an inline IDS, WireGuard, IPsec, OpenVPN, DHCP, DNS, apps, sessions, diagnostics, logs, certificates, the raw configuration tree, a desired-state reconciler, a fleet view, users, API tokens and the licence. Live operational state sits beside configured intent on the same screen, with drift flagged where the two disagree.

What it does not do#

It does not manage wireless. VyOS can configure interfaces wireless from the CLI; the Wheelhouse UI has no page for it and the installer does not offer it. Put an access point behind the router.
It is not a UniFi controller, and it is not for CGNAT ISP gear or consumer households. Wheelhouse manages the router.
IPv6 is not yet everywhere IPv4 is. Network → IPv6 shows v6 addresses, neighbours, routes and ip6 counters, and edits addressing, router advertisements and prefix delegation; static routes cover both families. The neighbour tables are v4, and the uplink model has no v6 concept; the firewall page is v4-first. The installer's firewall checkbox does write a v6 ruleset — see Every installer question — but the UI you manage it with afterwards is not symmetric.
A capture outlives the page for about twenty seconds. Diagnostics → Capture starts a real tcpdump on the router and ends in a downloadable pcap. With Stop it when nobody is watching — on by default — it ends 20-25 seconds after the last time a page asked how it was doing, and at its limits regardless: at most 300 seconds. Unticked, only the limits end it.

What it costs to run#

The agent is one process. Its resource budget is under 150 MB resident and under 3% idle CPU on an N100-class machine. That is a target the software is designed to, not a measurement: no CPU, memory or throughput figure for this product has been measured on hardware. The shipped systemd unit sets MemoryMax=200M and CPUQuota=300%, so the ceiling is enforced regardless. Routing performance is VyOS' and the kernel's, and Wheelhouse does not change it.

The one deliberately expensive thing the agent does is hash passwords: Argon2id at three passes over 64 MiB, about 60 ms per check. Simultaneous logins are the memory spike.

What it costs to buy#

Three plans, the same software on each: Homelab (one router, non-commercial), Lab (three routers, non-commercial, with the fleet view) and Business (ten routers, commercial use). No plan includes support, and the image goes to subscribers rather than to a public download. A licence unlocks configuration changes; a router whose key has lapsed still signs you in and shows every page, every counter, every log and the audit trail, and refuses to add or apply changes, restore a revision, install an app or run the reconcile loop, saying so with a link to the Licence page. See Enter a licence for what that looks like in practice, and the product site for the figures. Nothing is on sale until the licence agreement exists.

Two things to know first#

The hardware record is one machine. The image boots on physical hardware, installs to a disk and reboots into the installed system, but only one board is on record. There is no hardware compatibility list. What you need has the full inventory; a VM is the cheapest way to find out whether you want this.

Wheelhouse is not open source. The agent and the UI are proprietary programs driving GPL components as separate programs. The base is GPL and its corresponding source is published with every release. About Wheelhouse has the boundary and where the corresponding source is.