Configure WireGuard

WireGuard is optional. Without it, the stick still boots, joins your WiFi and accepts your SSH keys – it is simply reachable only on whatever LAN it lands on, at whatever address DHCP gave it. That is perfectly workable when the target machine is sitting on your own network.

What the tunnel buys you is a fixed address that does not depend on which network the machine is plugged into. The stick answers at the same WireGuard address on every network and in every machine, so you can ssh arch-iso without discovering anything first, and you can install a machine that is nowhere near you.

Skipping it

To leave WireGuard out, just leave secrets/wireguard/wg0.conf as the template generated it. just provision prints a warning that there is no WireGuard and carries on.

If you do fill it in, it has to be complete: provision refuses a wg0.conf with no PrivateKey, or one with no PersistentKeepalive, rather than handing you a stick that cannot phone home.

Give the stick its own peer

The stick is a WireGuard client – a spoke – of a server you already run. Most VPN servers and routers will provision a client for you: you add a new peer on the server, and it hands you a ready-made config with the client’s private key, its address, and the server’s public key and endpoint.

If you do not have a server yet

Standing up the hub is out of scope for this book, and will eventually get a book of its own. In the meantime, my nixos-vm-template has a wireguard profile that does it: just wireguard <hub> mints the hub and a config for every peer, and WIREGUARD.md walks through the whole thing.

Add the stick there as an ordinary spoke, and treat it as the wizard’s “generic Linux client” case. The .conf it generates already carries the AllowedIPs and PersistentKeepalive = 25 lines the stick requires; the only difference is that it goes into secrets/wireguard/wg0.conf here, instead of straight into /etc/wireguard/wg0.conf on a running machine.

Give the stick a peer of its own – do not reuse your laptop’s – and paste that config in:

Edit this file: secrets/wireguard/wg0.conf

[Interface]
PrivateKey = 
Address = 10.0.0.2/32

[Peer]
PublicKey = 
Endpoint = vpn.example.com:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

If your server does not provision clients for you, just keygen makes a fresh key pair for the stick. Put the private key in wg0.conf, and add the public key to your server as a new peer, with AllowedIPs set to the stick’s address (10.0.0.2/32 here).

Why the keepalive matters

Check that the config has a PersistentKeepalive line, and add one if your server left it out. The stick is the one behind NAT, usually on some network you do not control, so it has to keep the tunnel open itself. Without the keepalive, the server cannot reach the stick until the stick happens to send it something – and you cannot SSH in.

The Endpoint may be a DNS name: the tunnel keeps retrying until it resolves, which helps when the stick boots before the network is fully up. If you want to resolve names through the VPN, a DNS line works too.

With the configuration written, Provision the stick copies it onto the stick itself.