Accounts and access#
Five jobs. The first thing to get straight is that there are two kinds of account on a Wheelhouse router, and they have nothing to do with each other.
| Kind | Signs in to | Kept in | Managed on | Guide |
|---|---|---|---|---|
| A Wheelhouse account | The web interface and the API | The agent's own store, state.json | Admin → Users | Add an operator |
| A router account | The console, and SSH | The router's configuration | System → Settings tab → Router accounts | The console account and its SSH keys |
Changing one does not change the other. A person who needs both needs both.
| Guide | The job |
|---|---|
| Add an operator | A Wheelhouse account with the lowest role that works |
| Enrol a second factor | Two-factor authentication, the ten recovery codes it ends with, and the ways back from a lost device |
| Issue a token for automation | One token per script or system, with its own role and an expiry |
| Single sign-on with an OIDC provider | Sign-in through your identity provider, with its groups deciding roles |
| The console account and its SSH keys | The router's own console and SSH accounts: keys, passwords, adding and removing them |
The four roles#
The agent checks the role on every request. The web interface disables what your role cannot do, but that is a convenience: a refused request is still recorded in the audit log, as a failed entry naming who made it.
| Role | May do |
|---|---|
| Viewer | See everything, change nothing. |
| Approver | Everything a viewer can, plus apply, keep and revert changes somebody else prepared, and restore an earlier configuration. Cannot prepare or discard changes, and sees the secrets in pending changes hidden. |
| Operator | Everything an approver can, plus prepare changes, discard pending changes, reconcile and install apps. |
| Admin | Everything an operator can, plus users, API tokens, agent settings, the licence, restarting and shutting down the router, system images, backups, and the configuration download with its secrets. |
Below Admin, the secrets in the router's configuration — private keys, pre-shared secrets, password hashes, SNMP communities — are hidden wherever the configuration is shown.
What a licence does and does not gate#
Reads never need a licence. Without one, the router's configuration cannot be changed: adding to the pending changes, applying, discarding and restoring an earlier configuration are refused with the reason, and so are backups, snapshots, agent updates and app installs. Signing in, two-factor enrolment, the audit log, the configuration download, users, API tokens and the agent settings do not need one.