A terminal UI (TUI) for ip, nft and wg on Linux: the read-only cockpit for a Linux router.
The read-only cockpit for a Linux router. One screen, one card per area — interfaces and their WAN/LAN roles, the firewall's posture, live traffic per interface, the DHCP server and its leases, the WireGuard peers, the self-hosted tailnet — read from cheap system probes and refreshed in place.
It changes nothing itself. Press ENTER on a card and tui-router suspends, hands the terminal to the tool that manages that area — tui-firewall, tui-network, tui-traffic, tui-wireguard, tui-tailscale — and resumes when you leave it. The overview is here; the change happens in the tool the card opens, behind that tool's own preview and confirm.
It also carries what no per-area tool can: tui-router export writes one integrity-checked .tuiback artifact with the router's identity — the WAN/LAN roles, the networkd units, the forwarding and resolver drop-ins, DHCP/DNS, the WireGuard configs with their keys stripped, the saved firewall ruleset and account names. tui-router restore puts it back behind a diff, a preview of every reload command, a typed confirmation and an atomic apply that rolls back unless you confirm you still have access (--keep skips that window for scripted restores).
| Key | Action |
|---|---|
| ↑/↓ | Select a card |
| enter | Open the tool that manages the selected card |
| w | Roles wizard: assign the WAN/LAN roles (router profile) |
| b | Backup: export an artifact, or restore one (typed confirm) |
| B | Reboot the router (typed confirm) |
| P | Power the router off (typed confirm) |
| r / ctrl+r | Read the router again now |
| ? | Help |
| q | Quit |
Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.
This tool is a face on the program below, so its version matters. Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as (untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.
ip5.0ip -Vjson-outputsince 4.13iproute2 <4.13ip -j (JSON output) is missing, so the interface and route cards cannot be read from this version
nft0.9nft -vwg1.0wg --versionMaintain iproute2, nftables or wireguard-tools? You are welcome to help shape this tool. About → maintainers
Once per machine, then every tool in the family is one pacman away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
sudo pacman-key --add /tmp/tui-tools.asc
sudo pacman-key --lsign-key \
"$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
| sudo tee -a /etc/pacman.conf
sudo pacman -Sy$ sudo pacman -S tui-routerAvailable once tui-router's first release lands in pkgs.tui.tools.
Once per machine, then every tool in the family is one apt away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://pkgs.tui.tools/pubkey.asc \
| sudo gpg --dearmor -o /etc/apt/keyrings/tui-tools.gpg
echo "deb [signed-by=/etc/apt/keyrings/tui-tools.gpg] https://pkgs.tui.tools/deb stable main" \
| sudo tee /etc/apt/sources.list.d/tui-tools.list
sudo apt update$ sudo apt install tui-routerAvailable once tui-router's first release lands in pkgs.tui.tools.
Once per machine, then every tool in the family is one dnf away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo rpm --import https://pkgs.tui.tools/pubkey.asc
sudo curl -fsSL -o /etc/yum.repos.d/tui-tools.repo https://pkgs.tui.tools/rpm/tui-tools.repo
sudo dnf makecache$ sudo dnf install tui-routerAvailable once tui-router's first release lands in pkgs.tui.tools.
$ curl -fsSL https://github.com/tui-tools/tui-router/releases/download/v0.4.0/tui-router_0.4.0_linux_amd64.tar.gz | tar -xz tui-router
sudo install -m0755 tui-router /usr/local/bin/tui-router$ curl -fsSL https://github.com/tui-tools/tui-router/releases/download/v0.4.0/tui-router_0.4.0_linux_arm64.tar.gz | tar -xz tui-router
sudo install -m0755 tui-router /usr/local/bin/tui-routerAvailable once tui-router is released.
$ git clone https://github.com/tui-tools/tui-router
cd tui-router && make demoOr run it against a sample router with `tui-router --demo`, which needs nothing installed.
Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.
The cards only read; the reads that need root (the nftables ruleset, ufw status, the WireGuard dump) escalate with sudo -n, which never prompts. The four mutations — roles wizard, reboot, poweroff, restore — escalate the same way, each behind its literal command and a confirmation.
Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.
The tool opens no network connection of its own. No telemetry, no update check, no phone home.
Released statically linked, with no runtime dependencies to install.
checksums.txt carries a keyless cosign signature from this repository's release workflow, every archive has a CycloneDX SBOM, and every archive, package and the checksum file carry SLSA build provenance. The security page shows the three commands that check it.
Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.
| File | Size | SHA-256 |
|---|---|---|
| checksums.txt | 1 KB | — |
| checksums.txt.sigstore.json | 10 KB | — |
| provenance.intoto.jsonl | 12 KB | — |
| tui-router-0.4.0-1-aarch64.pkg.tar.zst | 1.9 MB | 8752cde3976574d0708745a529e16de2ba37a506b435f23670c4b2f52b9a0e1d |
| tui-router-0.4.0-1-x86_64.pkg.tar.zst | 2.1 MB | 327202399a2d23efbdf0582063dee6e67bd54b6c8abfb28f3ce20a92572a9f01 |
| tui-router-0.4.0-1.aarch64.rpm | 1.9 MB | 3eb2327ed4469e0e1a1c6f162f1472b6cf23e5cd5f3c7b96b3dabf4f277eeca8 |
| tui-router-0.4.0-1.x86_64.rpm | 2.1 MB | e1b952b3c2cdeb9ddd694a24f05aecaed8f878bdce15b82d2cdcfc5f19a05676 |
| tui-router_0.4.0_amd64.deb | 2.1 MB | 80a0fb3884f4d99c57828a1ebf523abc07967e6f4eab86172fa3c089e18dd4c7 |
| tui-router_0.4.0_arm64.deb | 1.9 MB | 9924764e995cd865dc772b78772af82a8fb33ae01f77c3ca1c002a8cc86d5f82 |
| tui-router_0.4.0_linux_amd64.tar.gz | 2.1 MB | 1fa143e5e60dbfa819d906b7669fa86637a696a9ebb1e1edb66cd18a050688ce |
| tui-router_0.4.0_linux_amd64.tar.gz.cyclonedx.json | 23 KB | a3c9fa4007dcd298d0ebf21277eb181a62cfdbc8e66538f491d9876d0f664e81 |
| tui-router_0.4.0_linux_arm64.tar.gz | 1.9 MB | a7ebcb29f51e9644f50222fd65c3c9c797c9bb034f4a2300a292ba3593ba449c |
| tui-router_0.4.0_linux_arm64.tar.gz.cyclonedx.json | 23 KB | 71e94684269d07895410464738a234f6c2192180a37f99cd7aac00c729958460 |
Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.
## tui-router v0.4.0 tui-router 0.4.0 - **New Tailnet card**, between VPN and Updates, managed by tui-tailscale. ENTER hands the terminal to `tui-tailscale` (resolved absolute path, no arguments), like every other card. - The card's summary comes from `tui-tailscale --check`, run unprivileged through the router's exec site and cached for a minute: whether this host's node is online and how many peers it sees, whether this host runs the headscale control plane, its node count, and the first step it still lacks (tui-tailscale's readiness `next`, with the step in words in the detail). Examples: `node online · headscale: unit`, `node online · 3 of 4 peers`, `headscale ready · 5 nodes`. - Without the binary the card reads `tui-tailscale (not installed)` with the family hint that it comes from pkgs.tui.tools. A document of the wrong shape (not JSON, another tool's, missing halves, negative counts) is refused with a reason and the card reads unknown. - **Grid for seven cards**: the column count no longer reserves a gap after the last column (104 columns now fit three cards), a short last row stretches across the grid, and a screen too short for every row at full height moves the tool foot onto the title row, so all seven cards fit 80x24 even with the roles banner up. A card with room for one body line now keeps its summary instead of showing only an ellipsis. - `--check` gains the `tailnet` card and `snapshot.tailnet` (additive; no field removed or renamed). - `--report` lists every card's managing tool, now including tui-tailscale and tui-update. - `--demo` shows a node that also runs headscale one step short of ready, the same state `tui-tailscale --demo --check` reports. - README (cards table, intro, demo paragraph, install snippet at 0.4.0), tool.json description, screenshots re-rendered (the selected-card frame now selects the Tailnet card), smoke test asserts the card. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 987ee27bc11942202eb79c3dab185d166d528088 0.4.0: a Tailnet card that hands off to tui-tailscale (#14) (#16)
## tui-router v0.3.4 tui-router 0.3.4 tui-router 0.3.4 follows the tui-vpn rename: ENTER on the VPN card now opens tui-wireguard (0.5.0 and later), where 0.3.3 looked for the old tui-vpn binary and reported the tool as not installed once the new package was in. A machine that still carries only the old `tui-vpn` binary keeps working: the card hands off to it and the status line says it was renamed and the package should be upgraded; `--check` carries the same hint as `toolHint`, and `--report` lists the old binary when it is present. The headscale control plane the card detects is now managed by tui-tailscale, which you run directly for now (a way into it from the cockpit is tracked in #14). Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 41997329e2ccd30f75626ffcbdc38fa7be0fe182 0.3.4: the VPN card hands off to tui-wireguard (#15)
## tui-router v0.3.3 tui-router 0.3.3: tui-kit v0.4.4 tui-router 0.3.3 moves to tui-kit v0.4.4: every probe now runs in its own session without a controlling terminal, so nothing can wait on a prompt hidden behind the cockpit, while the hand-off to the managing tool keeps going through tea.Exec and keeps the terminal. The README screenshots are re-rendered with continuous box borders, and the beta banner now sits between the kit's stability markers and carries the family's standard wording. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 7ee100b4ecd9b14287cbecf3d3781d510b65ed20 0.3.3: tui-kit v0.4.4 (#13) * 64103bd68da4e068db5a7284f83d2ee21d290fec Bump the github-actions group with 4 updates (#11) * f2d072cd067fe963ee3e9e0fc5eda0ea4654b9e0 README: link the tool's page on tui.tools (#10) * 5bd2df340cf40a73ef0fa70ba6379fa15cde5437 README: point the install snippet at the current release (#9)
## tui-router v0.3.2 DHCP card reads systemd-networkd's own server, and the wizard states its own verdict Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 8f35ac18d8dbd18335d16a69eb0e704323911f0d DHCP card: read systemd-networkd's own server (#8)
## tui-router v0.3.1 Roles wizard: cancel the revert without reporting a false failure. Also: tui-kit v0.3.0 — dialogs wrap and scroll instead of clipping the command preview, and the picker filters as you type. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * c0ecf66571db67f267345cf7383e974481bd58c1 Bump tui-kit to v0.3.0 (#7) * b9cc8ab53514aad503b520c6bccaa3c5461cbad4 Roles wizard: cancel the revert without a false failure (#6)
## tui-router v0.3.0 Manage, not view (wave 2): apply what it diagnoses, author what it manages; lab-validated. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 9c4f5a04e0f11d0666e42c1ad3a8ddaa341964e2 Single-artifact backup/restore (item 15, complete) (#3) * 691d94562e551636878bee8e5ba4c58a34b3aacc tool.json: released (#5)
## tui-router v0.2.0 Manage, not view: create and edit from the TUI (wave 1), lab-validated on the router image. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 0fe4b2d86b92763a7f068d0b04d05d677e2c6a50 Roles wizard, updates card, reboot — the cockpit learns to manage (#4)
## tui-router v0.1.0 First validated release: the router-1.0 lab ran this tool against real VMs (tui-lab router topology). Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 2aa8ab1295eaca0915c657c2f8599e4f74bf38e5 Bump anchore/sbom-action/download-syft (#1) * 79dfff77175a8c5909dcdc00ce87036e1536a7af Initial commit * 23a230435e1388b2d9a8755bf51a672d3065e067 tui-router phase 1: the read-only router cockpit (#2)