System — settings#

The Settings tab of the System page is eight panels covering everything about the box itself that is not a protocol: who it says it is, what time it thinks it is, who can reach its shell, where its logs go, and what it runs on a schedule.

Everything here stages. Every control writes set or delete operations into the Commit Bar and nothing takes effect until you commit. The controls need the operator role; a viewer sees the panels read-only.

Four configuration reads back the page, all refetched after a commit: system, service ntp, service ssh and service snmp.

Identity#

Host name, domain name, time zone, and the router's own resolvers.

set system host-name edge
set system domain-name example.com
set system time-zone Europe/London
set system name-server 192.0.2.53

Each of the three text fields shows the current value as its hint ("now edge") and its placeholder, and stages only when you type something different — the plan is computed by comparing your input against the configuration, so pressing Stage changes with an unmodified field stages nothing for it.

The time-zone field is free text with a datalist of 20 common zones (UTC, six European, five North and South American, six Asian and Pacific). Any tz database name is accepted; the list is a convenience, not a constraint.

Name servers is a list editor: each existing value is a badge with a remove cross, and the add box stages one set per value. The label says what it is for — "the router's own resolvers, or an interface name to use its DHCP-supplied ones". Removing one stages delete system name-server <value>.

Time synchronisation#

Each configured server appears with badges for the flags it carries — pool, preferred, NTS — and a remove link that stages the deletion.

Adding a server stages the base node plus a line per checkbox you ticked:

set service ntp server time.example.com
set service ntp server time.example.com pool
set service ntp server time.example.com prefer
set service ntp server time.example.com nts

With no servers the panel says the consequence, not the fact: "No NTP servers; the clock drifts and certificates start failing."

Two list editors below turn the router into a time server for its own clients:

set service ntp listen-address 192.0.2.1
set service ntp allow-client address 192.0.2.0/24

What the daemon is actually doing with all this is on Diagnostics — time.

SSH#

A badge (enabled / disabled) and one button that stages the whole service:

set service ssh
delete service ssh

Beside the button, in grey: "changes here are flagged in the Commit Bar: they can lock you out".

When SSH is enabled, three more controls appear:

Router accounts#

These are the router's own shell and SSH users — system login user — and the panel says so: "separate from Wheelhouse accounts". A Wheelhouse account signs into the web UI; a router account signs into the console and SSH. Managing the first is on the Users page; this panel manages the second.

Each user is listed with badges for whether it has a password and whether it has an OTP secret, plus its public keys as removable badges labelled <name> · <type>.

To add a key, paste the whole line from id_ed25519.pub. The panel parses it into three parts — the type, the key, and the comment — and derives a key name from the comment when you do not supply one, sanitised to letters, digits and _.@-:

set system login user vyos authentication public-keys laptop type ssh-ed25519
set system login user vyos authentication public-keys laptop key AAAAC3Nza…

A line that does not start with ssh-, ecdsa- or sk- and carry at least two fields is refused with "Expected: <type> <base64 key> [comment]" before anything can be staged.

Removing a key stages delete system login user <user> authentication public-keys <name>.

The panel's own advice is one line: "Keys only is the safe setting for SSH."

Remote logging#

Ship the journal to a collector. Existing entries show as <host>:<port> with a protocol badge and the facility/level pairs the configuration carries.

set system syslog remote 192.0.2.50 facility all level info
set system syslog remote 192.0.2.50 port 514
set system syslog remote 192.0.2.50 protocol tcp

The port line is staged only when you fill the field, and the protocol line only when you choose tcp — udp is the default and is not written. The level list is emerg, alert, crit, err, warning, notice, info, debug, all, defaulting to info.

With nothing configured the panel says "Logs stay on the router only."

SNMP#

Read-only communities for a monitoring system, plus the location and contact strings.

set service snmp community monitoring authorization ro
set service snmp community monitoring network 192.0.2.0/24
set service snmp location "rack 2"

The Allowed from field splits on whitespace or commas and stages one network line per prefix. Location and contact are staged only when they differ from what is already configured.

Existing communities are listed with an ro/rw badge — rw is amber — and the networks they are limited to, or any client when there are none. Turn SNMP off stages delete service snmp.

Kernel tunables#

system sysctl parameter. Existing overrides are listed as name = value with a remove link; the add row takes a parameter and a value:

set system sysctl parameter net.netfilter.nf_conntrack_acct value 1

The empty state is the advice: "No sysctl overrides. The platform sets sane defaults; add one only for a documented reason."

The two most likely to be wanted here are the connection-tracking ones named on Diagnostics — health: net.netfilter.nf_conntrack_acct to get byte accounting, and net.netfilter.nf_conntrack_max to size the table.

Scheduled tasks#

system task-scheduler task. Each task is listed with its schedule as a badge (every 30m, or cron 0 3 * * *, or no schedule) and its executable with arguments.

set system task-scheduler task backup-config interval 1d
set system task-scheduler task backup-config executable path /config/scripts/backup.sh
set system task-scheduler task backup-config executable arguments --quiet

The schedule selector switches between interval (30m, 6h, 1d) and crontab-spec (0 3 * * *), staging interval or crontab-spec accordingly. The arguments line is staged only when the field is non-empty. Task names are restricted to letters, digits, _ and - as you type.

The empty state carries the operational advice: "Scripts live in /config/scripts so they survive image upgrades." That is the same reasoning as everything else under /config — it is the persistent partition, and an image upgrade replaces /usr.

What this tab will not do#

• It does not manage Wheelhouse accounts. Web UI users, roles, two-factor and API tokens are elsewhere.
• It does not configure the agent. Session lifetime, mandatory two-factor, the commit-confirm default and audit retention are on Agent settings; the listen address, TLS certificate and router API endpoint are start-up flags.
• It shows no SNMP v3. The editor writes communities, which are v1/v2c.
• It does not read the current sysctl values from the kernel. It lists the overrides the configuration declares.

See also#

• Diagnostics — time — whether the NTP configuration is working.
• Diagnostics — health — the two tunables worth setting.
• Logs — the journal the syslog panel ships.
• Agent settings — the settings that are the agent's, not the router's.
• Backup and restore — before you change any of this on a production box.
• Users — the other kind of account, and the difference.

Checked against ui/src/pages/SystemSettings.tsx, ui/src/pages/System.tsx, ui/src/lib/format.ts, agent/main.go, docs/backup-restore.md.