Accounts and access#
Five jobs. The first thing to get straight is that there are two kinds of account on a Wheelhouse router, and they have nothing to do with each other.
| Kind | Lives in | Signs into | Guide |
|---|---|---|---|
| A Wheelhouse account | The agent's own store, state.json | The web UI and the API | Add an operator |
A router account (system login user) | The router's configuration | The console, and SSH | The console account and its SSH keys |
Changing one does not change the other. A person who needs both needs both.
| Guide | The job |
|---|---|
| Add an operator | A Wheelhouse account with the lowest role that works |
| Enrol a second factor | TOTP, and the recovery that does not exist |
| Issue a token for automation | One wh_ token per consumer, with an expiry |
| Single sign-on with an OIDC provider | Link by subject, map groups to roles |
| The console account and its SSH keys | The router's own shell accounts |
The three roles#
Enforced server-side on every route. The UI greys out what your role cannot do, but that is
a courtesy — a denied request is recorded in the audit log as denied <method> <path> with
the actor.
| Role | May do |
|---|---|
viewer | Read operational and configuration state. Configuration reads are redacted: private keys, pre-shared secrets and password hashes come back as [redacted]. |
operator | Everything a viewer can, plus stage, commit, commit-confirm, roll back, reconcile, install apps |
admin | Everything an operator can, plus accounts, API tokens, agent settings, the licence, power and boot images, and the unredacted configuration download |
What a licence does and does not gate#
Reads never need a licence. Every mutating route answers 402 without one, with the reason. That includes creating an account — but not signing in, not reading the audit log, and not downloading the configuration.
Checked against agent/admin.go ·
agent/auth.go ·
agent/main.go ·
docs/security.md