Which page writes which subtree#
Every editor in the web UI stages set and delete operations against one part of the
router's configuration tree, and each page says which part in its own header. This table
is that mapping, both ways: from a screen to the tree, and from a node you found on the
command line to the screen that owns it.
Nothing here is a Wheelhouse-specific schema. These are the router's own configuration paths.
By page#
| Nav label | Path | Subtree it owns | Notes |
|---|---|---|---|
| Dashboard | / | — | Reads only. |
| Interfaces | /interfaces | interfaces | Every interface kind, and their live kernel state beside the configuration. |
| Static routes | /routes | protocols static | The page title is Routes. It also shows the kernel forwarding table, which nothing writes. |
| BGP / OSPF | /routing | protocols | Reads protocols bgp and protocols ospf. |
| High availability | /ha | high-availability, service conntrack-sync, protocols failover, load-balancing wan, policy route | The header changes with the tab: the VRRP and conntrack tabs own the first two, the uplink tabs the last three. |
| QoS | /qos | qos | |
| Firewall | /firewall | firewall ipv4 or firewall ipv6 | The header follows the family tab. |
| NAT | /nat | nat | |
| IDS | /ids | service suricata | Hidden unless the suricata feature module is enabled. |
| WireGuard | /wireguard | interfaces wireguard | Hidden unless the wireguard feature module is enabled. |
| IPsec | /ipsec | vpn ipsec | |
| OpenVPN | /openvpn | interfaces openvpn | |
| DHCP | /dhcp | service dhcp-server | |
| DNS | /dns | service dns | Forwarding, local zones and dynamic DNS. |
| Apps | /apps | container | |
| — | /apps/<name> | container name <name> | One app's detail page. |
| Companions | /daemons | service | The page's own title is Daemons. It reports the configuration state of service upnp, service dns and service dhcp-server. |
| Sessions | /sessions | conntrack | Reads only. |
| Diagnostics | /diagnostics | — | Reads, plus traceroute and lookups, which are commands rather than configuration. |
| Logs | /logs | system syslog | |
| System | /system | system | Host name, resolvers, time zone, NTP, SSH, revisions, power and boot images. |
| Certificates | /certificates | pki | |
| Config tree | /config | / — the whole tree | The escape hatch: search any node, render it as commands. |
| Reconcile | /reconcile | agent.yaml | Not a subtree: the desired-state file in the agent's data directory. |
| Fleet | /fleet | fleet | Not a subtree either: the routers in --fleet-config. Hidden unless the licence carries the fleet feature. |
| About | /about | — | |
| Users | /users | — | The agent's own state, not the router's configuration. Admin only. |
| API tokens | /tokens | — | Same. Admin only. |
| Agent settings | /settings | — | Same. The page's own title is Settings. Admin only. |
| Licence | /license | — | Same. Admin only. |
| Account | /account | — | Your own password, single sign-on link, second factor and sessions. |
/wan is kept as a redirect to /ha; the two used to be separate pages.
By subtree#
| Node | Page |
|---|---|
container | Apps |
conntrack (operational) | Sessions |
firewall | Firewall |
high-availability | High availability |
interfaces | Interfaces |
interfaces openvpn | OpenVPN |
interfaces wireguard | WireGuard |
load-balancing wan | High availability |
nat | NAT |
pki | Certificates |
policy route | High availability |
protocols | BGP / OSPF |
protocols failover | High availability |
protocols static | Static routes |
qos | QoS |
service conntrack-sync | High availability |
service dhcp-server | DHCP |
service dns | DNS |
service ntp | System |
service ssh | System |
service suricata | IDS |
service upnp | Companions (read-only) |
system | System |
system syslog | Logs |
vpn ipsec | IPsec |
| anything else | Config tree |
Three pages hide themselves#
| Page | Hidden until |
|---|---|
| IDS | the suricata feature module is enabled — or service suricata exists in the configuration |
| WireGuard | the wireguard feature module is enabled — or interfaces wireguard exists |
| Fleet | the licence carries the fleet feature |
The "or" matters: a page is never hidden while the configuration it edits is live on the
router. A feature module's catalogue entry declares the config_path that decides it —
see Catalogue schema.
Four pages are admin-only and simply absent otherwise: Users, API tokens, Agent settings and Licence.
Everything goes through one door#
No page commits. Every editor stages operations into the working set, and
the Commit Bar is the only thing that commits — which is why every change, whatever
page it came from, appears as the same set and delete lines before it is applied, and
why the audit log records commits rather than clicks.
If a page will not write the node you want, the Config tree page will: it renders any node as commands and stages them the same way.
Re-deriving this table#
grep -rn '<PageHeader' ui/src/pages/*.tsx -A 4 | grep -E 'title=|path='
grep -n 'to:' ui/src/components/nav.tsSee also#
- The commands Wheelhouse runs — the reads behind each page.
- Endpoint index — the endpoint each page calls.
- Catalogue schema — feature modules and
config_path. - Role matrix — who sees the admin pages.
- The desired-state file — what the Reconcile page reads.
- The configuration tree
- The Commit Bar
Checked against#
ui/src/components/nav.ts,
ui/src/App.tsx,
ui/src/pages/Interfaces.tsx,
ui/src/pages/Firewall.tsx,
ui/src/pages/Ha.tsx,
ui/src/pages/Nat.tsx,
ui/src/pages/Qos.tsx,
ui/src/pages/Dns.tsx,
ui/src/pages/Dhcp.tsx,
ui/src/pages/Apps.tsx,
ui/src/pages/AppDetail.tsx,
ui/src/pages/Daemons.tsx,
ui/src/pages/ConfigTree.tsx,
ui/src/pages/Reconcile.tsx,
ui/src/pages/System.tsx,
agent/catalog.json,
docs/ui.md.