About#
Who makes this, the VyOS attribution in full, and where the corresponding source for the GPL parts of every image is published.
Who makes this#
Wheelhouse is a small project. The agent has over a thousand test functions, run race-clean in CI; the interface's tests render nearly every page and run in CI too, in jsdom rather than a browser.
Built on VyOS#
Wheelhouse OS is built on VyOS, which is GPL-licensed, and on Debian.
The kernel, nftables, tc, FRR, Kea, pdns-recursor, strongSwan, OpenVPN, Suricata,
Podman and the configuration tree itself are all upstream and unmodified. What Wheelhouse
adds is the control-plane agent, the web interface it serves, the installer, the app
catalogue and the packaging.
The agent and the interface are separate programs from every GPL component. The agent
drives the router over its documented HTTP API and operational-mode commands. It links
against no VyOS code and copies none: no file in the product is derived from vyos-1x,
FRR, Kea, pdns-recursor, nftables or the kernel.
Images are self-built from vyos-build and rebranded per upstream's trademark policy,
with attribution intact. The console banner carries the credit above every login — the
product and the host name on the first line, and Built on VyOS <version> beneath the
rule, above the line naming where the licences and the corresponding source are. The
interface's own About page says the same at more length, and the base version is
VYOS_VERSION in /etc/os-release on any installed system.
There is no affiliation. Wheelhouse is not affiliated with, endorsed by, certified by or supported by the VyOS project or Sentrium S.L. VyOS is their registered trademark, not ours. Support for this product comes from Wheelhouse; please do not ask the VyOS project about it.
Where the corresponding source is#
The complete corresponding source for every GPL and LGPL component of an image is published beside that image, on the same host it was downloaded from, at releases.rhymelikedi.me, and a copy of the build tooling's source travels on the image itself. That is GPLv2 section 3(a), taken deliberately: there is no three-year written offer, no address to write to and nothing to request, because the source is already in both places a customer can reach. The build fails if the licence document on the image ever starts reading like a section 3(b) offer instead.
Two files carry the record:
| File | What it names |
|---|---|
SOURCES-<version>-amd64.txt | the exact vyos-build commit the image was built from, and every package installed in it |
vyos-build-wheelhouse-<version>-amd64.patch | the changes Wheelhouse makes to VyOS' build tooling, published because that tooling is GPL |
A copy of the record travels on the image itself, under /usr/share/doc/wheelhouse/,
next to a tarball of the vyos-build tree at the exact commit the image came from with
Wheelhouse's changes already applied — so a customer holding only the box, with the
download host gone, still has the corresponding source in their hands. The base version a
given system was built from is VYOS_VERSION in /etc/os-release.
Third-party components#
The agent is one static Go binary, so its dependencies travel inside it: gorilla/websocket
(BSD-3), golang.org/x/crypto, oauth2, net and sys (BSD-3), coreos/go-oidc and
go-jose (Apache-2.0), and yaml.v3 (Apache-2.0 and MIT). Everything else is the Go
standard library.
The interface bundles React, React DOM and React Router (all MIT), and self-hosts Inter and JetBrains Mono under the SIL Open Font License 1.1 with their licence files beside them.
No runtime dependency is added for charts, icons, dates or state management, so the bundle is small enough to ship in the package and serve off the router.
Every notice is reproduced in full in the package's copyright file and on the installed system.
This website#
It loads nothing from any third party — no analytics, no tag manager, no hosted font, no
embedded video and no cookies — which is what lets its Content-Security-Policy be
default-src 'none' with 'self' and nothing else.
Every claim on this site is written against the code, and each page records the files it was written from. The build verifies that those files still exist, so one that moves breaks the build rather than leaving a claim behind that nothing supports.
The hostnames on both sites are placeholders held in one configuration file. A similarly
named .io domain is not ours, and it appears nowhere on this site.
Read what it is before you read who makes it
The image goes to licence holders, and the corresponding source for every GPL component is published beside it.
Read on#
- What you actually get — where the base ends and Wheelhouse begins.
- Legal — the two placeholders, and why they are placeholders.
- The wiki: built on VyOS, third-party licences, where the corresponding source is.