About#

Who makes this#

What can be said: Wheelhouse is a small project. The agent has 214 test functions and the interface has none, which tells you something about how many people are working on it. The status page tells you the rest.

Built on VyOS#

Wheelhouse OS is built on VyOS, which is GPL-licensed, and on Debian.

The kernel, nftables, tc, FRR, Kea, pdns-recursor, strongSwan, OpenVPN, Suricata, Podman and the configuration tree itself are all upstream and unmodified. What Wheelhouse adds is the control-plane agent, the web interface it serves, the installer, the app catalogue and the packaging.

The agent and the interface are separate programs from every GPL component. The agent drives the router over its documented HTTP API and operational-mode commands. It links against no VyOS code and copies none: no file in the repository is derived from vyos-1x, FRR, Kea, pdns-recursor, nftables or the kernel. The boundary and the rules that keep it are recorded in docs/licenses.md.

Images are self-built from vyos-build and rebranded per upstream's trademark policy, with attribution intact. The console banner prints Wheelhouse <version> on VyOS <version> above every login, and the interface's own About page says the same.

There is no affiliation. Wheelhouse is not affiliated with, endorsed by, certified by or supported by the VyOS project or Sentrium S.L. VyOS is their registered trademark, not ours. Support for this product comes from Wheelhouse; please do not ask the VyOS project about it.

The source offer#

The complete corresponding source for every GPL and LGPL component of an image is published beside that image, on the same host it was downloaded from, at releases.rhymelikedi.me. That is how this product satisfies GPLv2 section 3(a), and it is why there is no written offer to send away for: the source is already there, for as long as the release is.

Two files carry the record:

A copy of the record travels on the image itself, under /usr/share/doc/wheelhouse/, so a customer holding only the box can still get back to the source. The base version a given system was built from is VYOS_VERSION in /etc/os-release.

Third-party components#

The agent is one static Go binary, so its dependencies travel inside it: gorilla/websocket (BSD-3), golang.org/x/crypto, oauth2, net and sys (BSD-3), coreos/go-oidc and go-jose (Apache-2.0), and yaml.v3 (Apache-2.0 and MIT). Everything else is the Go standard library.

The interface bundles React, React DOM and React Router (all MIT), and self-hosts Inter and JetBrains Mono under the SIL Open Font License 1.1 with their licence files beside them.

No runtime dependency is added for charts, icons, dates or state management. That is what keeps the bundle small enough to embed in the agent binary, and the licence list short enough to audit.

Every notice is reproduced in full in the package's copyright file and on the installed system; none of it is summarised away.

This website#

Two static sites generated by a Python script that uses only the standard library — no package manager, no framework, no build toolchain. They load nothing from any third party, which is what makes their Content-Security-Policy default-src 'none' with 'self' and nothing else.

Every factual claim on the product site is meant to be checkable in the source. Where a claim links a file, the link is verified when the site is built: a file that moves breaks the build rather than quietly leaving a lie behind.

The hostnames on both sites are placeholders held in one configuration file. A similarly named .io domain is not ours; it appears nowhere in this tree, and a test asserts that it does not.

Read on#

• What you actually get — where the base ends and Wheelhouse begins.
• Legal — the two placeholders, and why they are placeholders.
• The wiki: built on VyOS, third-party licences, the source offer.