A terminal UI (TUI) for ip, nft and wg on Linux: the read-only cockpit for a Linux router.
The read-only cockpit for a Linux router. One screen, one card per area — interfaces and their WAN/LAN roles, the firewall's posture, live traffic per interface, the DHCP server and its leases, the WireGuard peers — read from cheap system probes and refreshed in place.
It changes nothing itself. Press ENTER on a card and tui-router suspends, hands the terminal to the tool that manages that area — tui-firewall, tui-network, tui-traffic, tui-vpn — and resumes when you leave it, the same handoff the family launcher uses. The overview is here; the change happens in the tool the card opens, behind that tool's own preview and confirm.
It also carries what no per-area tool can: tui-router export writes one integrity-checked .tuiback artifact with the router's identity — the WAN/LAN roles, the networkd units, the forwarding and resolver drop-ins, DHCP/DNS, the WireGuard configs with their keys stripped, the saved firewall ruleset and the account names. tui-router restore puts it back behind a diff, a preview of every reload command, a typed confirmation and an atomic apply that rolls back unless you confirm you still have access (--keep skips that window for scripted restores).
| Key | Action |
|---|---|
| ↑/↓ | Select a card |
| enter | Open the tool that manages the selected card |
| w | Roles wizard: assign the WAN/LAN roles (router profile) |
| b | Backup: export an artifact, or restore one (typed confirm) |
| B | Reboot the router (typed confirm) |
| P | Power the router off (typed confirm) |
| r / ctrl+r | Read the router again now |
| ? | Help |
| q | Quit |
Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.
This tool is a face on the program below, so its version matters.Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as(untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.
ip5.0ip -Vjson-outputsince 4.13iproute2 <4.13ip -j (JSON output) is missing, so the interface and route cards cannot be read from this version
nft0.9nft -vwg1.0wg --versionOnce per machine, then every tool in the family is one pacman away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
sudo pacman-key --add /tmp/tui-tools.asc
sudo pacman-key --lsign-key \
"$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
| sudo tee -a /etc/pacman.conf
sudo pacman -Sy$ sudo pacman -S tui-routerAvailable once tui-router's first release lands in pkgs.tui.tools.
Once per machine, then every tool in the family is one apt away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://pkgs.tui.tools/pubkey.asc \
| sudo gpg --dearmor -o /etc/apt/keyrings/tui-tools.gpg
echo "deb [signed-by=/etc/apt/keyrings/tui-tools.gpg] https://pkgs.tui.tools/deb stable main" \
| sudo tee /etc/apt/sources.list.d/tui-tools.list
sudo apt update$ sudo apt install tui-routerAvailable once tui-router's first release lands in pkgs.tui.tools.
Once per machine, then every tool in the family is one dnf away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo rpm --import https://pkgs.tui.tools/pubkey.asc
sudo curl -fsSL -o /etc/yum.repos.d/tui-tools.repo https://pkgs.tui.tools/rpm/tui-tools.repo
sudo dnf makecache$ sudo dnf install tui-routerAvailable once tui-router's first release lands in pkgs.tui.tools.
$ curl -fsSL https://github.com/tui-tools/tui-router/releases/download/v0.3.2/tui-router_0.3.2_linux_amd64.tar.gz | tar -xz tui-router
sudo install -m0755 tui-router /usr/local/bin/tui-router$ curl -fsSL https://github.com/tui-tools/tui-router/releases/download/v0.3.2/tui-router_0.3.2_linux_arm64.tar.gz | tar -xz tui-router
sudo install -m0755 tui-router /usr/local/bin/tui-routerAvailable once tui-router is released.
$ git clone https://github.com/tui-tools/tui-router
cd tui-router && make demoOr run it against a sample router with `tui-router --demo`, which needs nothing installed.
Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.
The cards only read; the reads that need root (the nftables ruleset, ufw status, the WireGuard dump) escalate with sudo -n, which never prompts. The four mutations — roles wizard, reboot, poweroff, restore — escalate the same way, each behind its literal command and a confirmation.
Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.
The tool opens no network connection of its own. No telemetry, no update check, no phone home.
Released statically linked, with no runtime dependencies to install.
checksums.txt carries a keyless cosign signature from this repository's release workflow, every archive has a CycloneDX SBOM, and every archive, package and the checksum file carry SLSA build provenance. The security page shows the three commands that check it.
Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.
| File | Size | SHA-256 |
|---|---|---|
| checksums.txt | 1 KB | — |
| checksums.txt.sigstore.json | 10 KB | — |
| provenance.intoto.jsonl | 12 KB | — |
| tui-router-0.3.2-1-aarch64.pkg.tar.zst | 1.9 MB | 0a6dd24fb9c091b42a9794c0b53cb90744cedcc996553852090ebc328e8abfc8 |
| tui-router-0.3.2-1-x86_64.pkg.tar.zst | 2.1 MB | 60f2c592ccd0023f843aa54cfdc5bc421710b47527cb5388b0fb6d0253a0c9b4 |
| tui-router-0.3.2-1.aarch64.rpm | 1.9 MB | 690fa4193dd772bb36c04d384ff124196abecdeb096c98e08e70580d4a45f72f |
| tui-router-0.3.2-1.x86_64.rpm | 2.1 MB | e422378e26314165fd5e15171b5a353ca46f99e6b928e3f8fbdcd19922c344cb |
| tui-router_0.3.2_amd64.deb | 2.1 MB | 506ded313578d11592a1a21e104038f35e7c674b473908e9aef3ff83854b34be |
| tui-router_0.3.2_arm64.deb | 1.9 MB | 5d25e4699ccfd8c3fe533fc2a5f1969545f3b884e2c7438d69d55ee95aa1ecfd |
| tui-router_0.3.2_linux_amd64.tar.gz | 2.1 MB | 2e2b6b89d7b8cbf4aa772ec391c5f53a1ec7d84739a09019aff3fae437d8bf14 |
| tui-router_0.3.2_linux_amd64.tar.gz.cyclonedx.json | 23 KB | 3e4b8b576b2a86215ce68b30aa16edbd4b26e6760a989393889aa1955fbdeb3c |
| tui-router_0.3.2_linux_arm64.tar.gz | 1.9 MB | bdc1ee4b40db0effb613cdee653fe86c2cb9f1a1b94d4c5f393cb278eb2a9f5e |
| tui-router_0.3.2_linux_arm64.tar.gz.cyclonedx.json | 23 KB | 6e66c34bd53dde0bdeb3d0d2dc3f6e825ab2b4b8a0a056aa8cb6ad6c07ac2432 |
Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.
## tui-router v0.3.2 DHCP card reads systemd-networkd's own server, and the wizard states its own verdict Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 8f35ac18d8dbd18335d16a69eb0e704323911f0d DHCP card: read systemd-networkd's own server (#8)
## tui-router v0.3.1 Roles wizard: cancel the revert without reporting a false failure. Also: tui-kit v0.3.0 — dialogs wrap and scroll instead of clipping the command preview, and the picker filters as you type. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * c0ecf66571db67f267345cf7383e974481bd58c1 Bump tui-kit to v0.3.0 (#7) * b9cc8ab53514aad503b520c6bccaa3c5461cbad4 Roles wizard: cancel the revert without a false failure (#6)
## tui-router v0.3.0 Manage, not view (wave 2): apply what it diagnoses, author what it manages; lab-validated. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 9c4f5a04e0f11d0666e42c1ad3a8ddaa341964e2 Single-artifact backup/restore (item 15, complete) (#3) * 691d94562e551636878bee8e5ba4c58a34b3aacc tool.json: released (#5)
## tui-router v0.2.0 Manage, not view: create and edit from the TUI (wave 1), lab-validated on the router image. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 0fe4b2d86b92763a7f068d0b04d05d677e2c6a50 Roles wizard, updates card, reboot — the cockpit learns to manage (#4)
## tui-router v0.1.0 First validated release: the router-1.0 lab ran this tool against real VMs (tui-lab router topology). Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 2aa8ab1295eaca0915c657c2f8599e4f74bf38e5 Bump anchore/sbom-action/download-syft (#1) * 79dfff77175a8c5909dcdc00ce87036e1536a7af Initial commit * 23a230435e1388b2d9a8755bf51a672d3065e067 tui-router phase 1: the read-only router cockpit (#2)