Support#

System → Support produces one archive that describes this router, and says what it did not put in it. It replaces the four curl calls and a journalctl that used to be the procedure.

The page reads GET /api/system for the five lines at the top and does nothing else on its own. Everything else on it is a button and an account of what pressing that button hands over.

This router#

Five values, which are the first question of every support conversation and are also the first file inside the bundle: host name, product, agent build, the base it was built on, and the architecture. The badge beside them says whether the version came from the box or from the build — an agent that cannot reach the router still answers with what it knows about itself.

Download support bundle#

The button in the page header. It is admin-only: a bundle carries the whole configuration and recent audit entries, so an operator sees the button disabled with the reason on hover.

GET /api/support/bundle collects and streams a tar.gz. Collecting it makes about a dozen read-only calls to the router, so it takes a few seconds. Nothing is staged and nothing is committed — producing a bundle cannot change this router.

The action is written to the audit log as support-bundle.

What is in it#

Nineteen entries, in this order:

Entry	What it is
`manifest.json`	Every item, its size, and the reason for anything missing. The authoritative statement.
`README.txt`	The same account in plain text.
`versions.json`	The product and its version, this agent's build, and the base platform.
`agent/`	The agent's status, its settings, licence state, the most recent 500 audit entries, its own log, and the journal when one was supplied.
`config/`	The running configuration, as `set` commands and in the router's own format.
`router/`	Services, interfaces, routes, uptime, memory, storage, CPU, and the last commits.

What it never carries#

Left out	Why
Private keys, pre-shared keys and passwords	Redacted wherever they appear — configuration, commands, audit entries, logs.
The router's API key and the break-glass token	Credentials for this router; nothing in the bundle reads the files they live in.
The licence key	The licence's state is included; the key itself is not.
`state.json`	Password hashes, TOTP secrets, API token hashes and live sessions.

Redaction is the same pass that hides secrets from a non-admin on the Config tree — one vocabulary of what counts as a secret, not a second one written for the bundle. The categorical exclusions above are listed inside manifest.json too, so the person handing the file over can see the promise and the person receiving it can check it.

Its bounds#

Bound	Value
One artefact	4 MiB. Anything longer is cut at a line boundary and marked truncated.
The whole bundle	16 MiB, uncompressed.
Time spent talking to the router	90 seconds. Reads that do not finish are recorded as excluded.
Audit entries	The most recent 500.

A bundle from a wedged router is the bundle worth having, so nothing here refuses to produce one: a read that failed becomes a row in the manifest with the reason in it.

From a console instead#

The console path works when this page does not, which is the point of having it.

bash

# the same bundle, plus the journal from before the agent restarted
wheelhouse-support                 # writes into the current directory
wheelhouse-support /tmp            # or into a directory you name

# the agent produces it; the wrapper above only adds the journal and the paths
wheelhouse-agent support-bundle -o /tmp/bundle.tar.gz

# or over the API, with an admin token
curl -sk -OJ -H "Authorization: Bearer wh_…" https://<router>:8443/api/support/bundle

Run it as root. The router's API key is readable by root alone, and without it the bundle can describe the agent but not the router — and its manifest will say so.

wheelhouse-support is POSIX sh so that it also runs in the installer's environment: a machine that failed to install can still produce one.

Where to send it#

The page says, in its own words, that there is no published support address yet and no public issue tracker. That is a real gap rather than an omission — the address is the owner's to set. Keep the bundle; it is the thing to attach when there is somewhere to attach it to.

A security flaw does not go to support. It has its own policy, scope and window — Security disclosure.

With the bundle, say what you did and what happened: the exact set or delete path the editor showed you, the router's own error text if it refused, and how to reproduce it. The bundle carries the versions, the configuration, the audit entries and the logs around the timestamp, so that is all that is left to write.

What this page will not do#

It does not upload anything. The bundle is downloaded to your browser, or written to a file at the console. Nothing leaves this router on its own.
It does not change the router. Every read behind the bundle is read-only, and no operation is staged.
It is not a log viewer. The journal is on Logs, and the router's own diagnostics are on Diagnostics.
It cannot open a ticket. There is nowhere to open one yet.