Wheelhouse docs

Which page writes which subtree#

Every editor in the web interface changes one part of the router's configuration tree, and with Advanced mode on, each page names that part beside its title. The tables below map it both ways: screen to tree, and node to the screen that edits it. These are the router's own configuration paths, not a Wheelhouse schema.

By page#

Nav labelPathSubtree it ownsNotes
Overview/—Reads only.
Interfaces/interfacesinterfacesEvery interface kind, and their live kernel state beside the configuration.
Static routes/routesprotocols staticIPv4 and IPv6. It also shows both forwarding tables, which nothing writes.
IPv6/ipv6interfaces, service router-advertThe header follows the tab: addressing and prefix delegation are set on each interface, router advertisements under service router-advert. The status tab reads only.
BGP / OSPF/routingprotocols bgp or protocols ospfThe header follows the protocol tab.
VRF/vrfvrfAlso binds interfaces to a VRF (their vrf leaf) and edits each VRF's static routes under vrf name <name> protocols static.
High availability/hahigh-availability, service conntrack-sync, protocols failover, load-balancing wan, policy routeThe header changes with the tab: the VRRP and conntrack tabs own the first two, the uplink tabs the last three.
QoS/qosqos
Firewall/firewallfirewall ipv4 or firewall ipv6The header follows the family tab.
NAT/natnat
IDS/idsservice suricataHidden unless the suricata feature module is enabled.
WireGuard/wireguardinterfaces wireguardHidden unless the wireguard feature module is enabled.
IPsec/ipsecvpn ipsec
OpenVPN/openvpninterfaces openvpn
DHCP/dhcpservice dhcp-server
DNS/dnsservice dnsForwarding, local zones and dynamic DNS.
Apps/appscontainer
—/apps/<name>container name <name>One app's detail page.
Companions/daemonsserviceThe page's own title is Daemons. It reports the configuration state of service upnp, service dns and service dhcp-server.
Sessions/sessionsconntrackReads only.
Diagnostics/diagnostics—Reads, plus traceroute and lookups, which are commands rather than configuration.
Logs/logssystem syslogReads the system journal. Remote log servers are set on System → Settings.
System/systemsystem, service ntp, service ssh, service snmpThe Settings tab edits the host name, domain, time zone, DNS servers, time synchronisation, SSH, router accounts (system login), remote logging (system syslog), SNMP, kernel parameters (system sysctl) and scheduled tasks (system task-scheduler). The other tabs hold revisions, the audit log, power, updates and system images.
Certificates/certificatespkiCertificate authorities and certificates: import, generate, or request from an ACME server.
Configuration tree/config/ — the whole treeAdvanced mode only, and read only: search any setting and render it as the commands that recreate it.
Reconcile/reconcileagent.yamlAdvanced mode only. Not a subtree: the desired-state file in the agent's data directory.
Fleet/fleetfleetNot a subtree either: the routers in --fleet-config. Hidden unless the licence carries the fleet feature.
About/about—
Users/users—The agent's own state, not the router's configuration. Admin only.
API tokens/tokens—Same. Admin only.
Agent settings/settings—Same. The page's own title is Settings. Admin only.
Licence/license—Same. Admin only.
Account/account—Your own password, single sign-on link, second factor, sessions and the Advanced mode preference.

/wan redirects to /ha.

By subtree#

NodePage
containerApps
conntrack (operational)Sessions
firewallFirewall
high-availabilityHigh availability
interfacesInterfaces
interfaces openvpnOpenVPN
interfaces wireguardWireGuard
load-balancing wanHigh availability
natNAT
pkiCertificates
policy routeHigh availability
protocols bgpBGP / OSPF
protocols failoverHigh availability
protocols ospfBGP / OSPF
protocols staticStatic routes
qosQoS
service conntrack-syncHigh availability
service dhcp-serverDHCP
service dnsDNS
service ntpSystem
service router-advertIPv6
service snmpSystem
service sshSystem
service suricataIDS
service upnpCompanions (this platform has no such node)
systemSystem
system syslogSystem (the Logs page reads the journal)
vpn ipsecIPsec
vrfVRF
anything elseNo page edits it; the Configuration tree page shows it

Three pages hide themselves#

PageHidden until
IDSthe suricata feature module is enabled — or service suricata exists in the configuration
WireGuardthe wireguard feature module is enabled — or interfaces wireguard exists
Fleetthe licence carries the fleet feature

A page is never hidden while the configuration it edits is live on the router. A feature module's catalogue entry declares the config_path that decides it — see Catalogue schema.

Four pages are admin-only and absent otherwise: Users, API tokens, Agent settings and Licence.

Every page adds to the pending changes; only the Commit Bar applies#

Every editor adds its changes to the pending changes, and only the Commit Bar applies them. Whatever page a change came from, it appears in the Commit Bar's list before it is applied, as a sentence or, in Advanced mode, as the same set and delete lines, and the audit log records who applied it.

The Configuration tree page changes nothing. It renders any setting as the commands that recreate it, and adds nothing to the pending changes. A setting that no page edits is changed through the API (POST /api/stage), a desired-state file that the Reconcile page compares with the router, or the router's console.

Re-deriving this table#

bash
grep -rn '<PageHeader' ui/src/pages/*.tsx -A 4 | grep -E 'title=|path='
grep -n 'to:' ui/src/components/nav.ts

See also#

Updated 2026-09-18 ui config-tree mapping