Provision the stick

With the files filled in, plug in the stick you wrote earlier and copy them onto it:

just provision

just provision finds the stick by its ARCH_CONFIG partition label, mounts it if it has to, writes archiso-config/, and unmounts it again so it is ready to pull.

Before copying anything, it checks the files for the mistakes that would leave a headless machine unreachable, and fails here, at your desk, instead of later on the other side of the room. An authorized_keys with no keys in it is refused outright, since nobody could log in. A wg0.conf that is filled in but missing its PrivateKey or PersistentKeepalive is refused too. A wg0.conf left untouched is fine – that is just a stick without WireGuard, and it says so.

Editing the stick by hand instead

If you would rather skip secrets/ and edit the stick directly, mount its partition with udisksctl rather than sudo mount:

udisksctl mount -b /dev/sdX1

FAT stores no file ownership, so a plain sudo mount makes every file look like it belongs to root, and you cannot edit them as yourself. udisksctl mounts it as your own user, at /run/media/$USER/ARCH_CONFIG.

Changing it later

Everything that makes the stick yours lives in a handful of plain files. When you move to a new WiFi network, rotate a WireGuard key, or add someone’s SSH key, you edit a file on the stick – or in secrets/, then run just provision again – and you are done, with nothing to rebuild.

The stick is now ready. Go to Boot the stick and connect to use it – or, if you would rather know what the stick does at boot before you trust it with a machine, read How it works under the hood first.