Which page writes which subtree#
Every editor in the web interface changes one part of the router's configuration tree, and with Advanced mode on, each page names that part beside its title. The tables below map it both ways: screen to tree, and node to the screen that edits it. These are the router's own configuration paths, not a Wheelhouse schema.
By page#
| Nav label | Path | Subtree it owns | Notes |
|---|---|---|---|
| Overview | / | — | Reads only. |
| Interfaces | /interfaces | interfaces | Every interface kind, and their live kernel state beside the configuration. |
| Static routes | /routes | protocols static | IPv4 and IPv6. It also shows both forwarding tables, which nothing writes. |
| IPv6 | /ipv6 | interfaces, service router-advert | The header follows the tab: addressing and prefix delegation are set on each interface, router advertisements under service router-advert. The status tab reads only. |
| BGP / OSPF | /routing | protocols bgp or protocols ospf | The header follows the protocol tab. |
| VRF | /vrf | vrf | Also binds interfaces to a VRF (their vrf leaf) and edits each VRF's static routes under vrf name <name> protocols static. |
| High availability | /ha | high-availability, service conntrack-sync, protocols failover, load-balancing wan, policy route | The header changes with the tab: the VRRP and conntrack tabs own the first two, the uplink tabs the last three. |
| QoS | /qos | qos | |
| Firewall | /firewall | firewall ipv4 or firewall ipv6 | The header follows the family tab. |
| NAT | /nat | nat | |
| IDS | /ids | service suricata | Hidden unless the suricata feature module is enabled. |
| WireGuard | /wireguard | interfaces wireguard | Hidden unless the wireguard feature module is enabled. |
| IPsec | /ipsec | vpn ipsec | |
| OpenVPN | /openvpn | interfaces openvpn | |
| DHCP | /dhcp | service dhcp-server | |
| DNS | /dns | service dns | Forwarding, local zones and dynamic DNS. |
| Apps | /apps | container | |
| — | /apps/<name> | container name <name> | One app's detail page. |
| Companions | /daemons | service | The page's own title is Daemons. It reports the configuration state of service upnp, service dns and service dhcp-server. |
| Sessions | /sessions | conntrack | Reads only. |
| Diagnostics | /diagnostics | — | Reads, plus traceroute and lookups, which are commands rather than configuration. |
| Logs | /logs | system syslog | Reads the system journal. Remote log servers are set on System → Settings. |
| System | /system | system, service ntp, service ssh, service snmp | The Settings tab edits the host name, domain, time zone, DNS servers, time synchronisation, SSH, router accounts (system login), remote logging (system syslog), SNMP, kernel parameters (system sysctl) and scheduled tasks (system task-scheduler). The other tabs hold revisions, the audit log, power, updates and system images. |
| Certificates | /certificates | pki | Certificate authorities and certificates: import, generate, or request from an ACME server. |
| Configuration tree | /config | / — the whole tree | Advanced mode only, and read only: search any setting and render it as the commands that recreate it. |
| Reconcile | /reconcile | agent.yaml | Advanced mode only. Not a subtree: the desired-state file in the agent's data directory. |
| Fleet | /fleet | fleet | Not a subtree either: the routers in --fleet-config. Hidden unless the licence carries the fleet feature. |
| About | /about | — | |
| Users | /users | — | The agent's own state, not the router's configuration. Admin only. |
| API tokens | /tokens | — | Same. Admin only. |
| Agent settings | /settings | — | Same. The page's own title is Settings. Admin only. |
| Licence | /license | — | Same. Admin only. |
| Account | /account | — | Your own password, single sign-on link, second factor, sessions and the Advanced mode preference. |
/wan redirects to /ha.
By subtree#
| Node | Page |
|---|---|
container | Apps |
conntrack (operational) | Sessions |
firewall | Firewall |
high-availability | High availability |
interfaces | Interfaces |
interfaces openvpn | OpenVPN |
interfaces wireguard | WireGuard |
load-balancing wan | High availability |
nat | NAT |
pki | Certificates |
policy route | High availability |
protocols bgp | BGP / OSPF |
protocols failover | High availability |
protocols ospf | BGP / OSPF |
protocols static | Static routes |
qos | QoS |
service conntrack-sync | High availability |
service dhcp-server | DHCP |
service dns | DNS |
service ntp | System |
service router-advert | IPv6 |
service snmp | System |
service ssh | System |
service suricata | IDS |
service upnp | Companions (this platform has no such node) |
system | System |
system syslog | System (the Logs page reads the journal) |
vpn ipsec | IPsec |
vrf | VRF |
| anything else | No page edits it; the Configuration tree page shows it |
Three pages hide themselves#
| Page | Hidden until |
|---|---|
| IDS | the suricata feature module is enabled — or service suricata exists in the configuration |
| WireGuard | the wireguard feature module is enabled — or interfaces wireguard exists |
| Fleet | the licence carries the fleet feature |
A page is never hidden while the configuration it edits is live on the router. A feature
module's catalogue entry declares the config_path that decides it — see
Catalogue schema.
Four pages are admin-only and absent otherwise: Users, API tokens, Agent settings and Licence.
Every page adds to the pending changes; only the Commit Bar applies#
Every editor adds its changes to the pending changes, and
only the Commit Bar applies them. Whatever page a change came from, it appears in the
Commit Bar's list before it is applied, as a sentence or, in Advanced mode, as the same
set and delete lines, and the audit log records who applied it.
The Configuration tree page changes nothing. It renders any setting as the commands
that recreate it, and adds nothing to the pending changes. A setting that no page edits is
changed through the API (POST /api/stage), a desired-state file
that the Reconcile page compares with the router, or the router's console.
Re-deriving this table#
grep -rn '<PageHeader' ui/src/pages/*.tsx -A 4 | grep -E 'title=|path='
grep -n 'to:' ui/src/components/nav.tsSee also#
- The commands Wheelhouse runs — the reads behind each page.
- Endpoint index — the endpoint each page calls.
- Catalogue schema — feature modules and
config_path. - Role matrix — who sees the admin pages.
- The desired-state file — what the Reconcile page reads.
- The configuration tree
- The Commit Bar