SSH keys, WiFi and the webhook

You can edit the configuration directly on the stick, but it is easier to keep it in the repo, next to the build, and copy it over. Running just config creates a secrets/ directory – git-ignored, and readable only by you – full of commented-out templates:

just config

created: secrets/ssh/authorized_keys  (edit it)
created: secrets/webhook.env  (edit it)
created: secrets/wifi/EXAMPLE.psk.example  (edit it)
created: secrets/wireguard/wg0.conf  (edit it)

Of those four files, only secrets/ssh/authorized_keys is required. The others are opt-in: leave any of them commented out and the stick simply boots without that feature.

SSH keys (required)

The only other file you must fill in is secrets/ssh/authorized_keys: put the public key or keys you will log in with, one per line, exactly as in any other authorized_keys file. Without at least one key, nobody can log in over SSH at all, because the stick never allows password logins.

If your keys are on GitHub, you can fetch them straight from your profile, since GitHub publishes every user’s public keys:

curl -fsSL https://github.com/YOUR_USERNAME.keys >> secrets/ssh/authorized_keys

Read the file afterwards to make sure you got the keys you expected, and remove any you do not want to have root on the stick.

WiFi (optional)

WiFi is optional; without it, the stick is wired-only. Add one file per network to secrets/wifi/, in iwd’s own format, named after the SSID:

[Security]
Passphrase=your wifi password

You can add as many networks as you like, and iwd joins whichever one is in range. An SSID with characters other than letters, digits, spaces, - and _ needs a hex-encoded filename; the EXAMPLE.psk.example template explains how.

The boot webhook (optional)

To get a notification when the stick boots, set a URL in secrets/webhook.env:

WEBHOOK_URL=https://ntfy.sh/a-long-random-topic

Once the network is up and WireGuard connects – or gives up after two minutes – the stick POSTs a plain-text message there, which works with ntfy or a matrix-hookshot generic webhook.

With those in place, the stick is already usable on a network you control. The next page adds WireGuard, which is what makes it usable on one you do not.