BOOMSTICK (for Arch Linux)

Reinstalling Linux on a headless PC or a Raspberry Pi with the official installer can be a tedious affair. I would much rather drive the installation of a new workstation or server from the comfort of my existing workstation, where my editor is already set up the way I like it, and where I can safely keep notes and configs about the process. But before the target machine will accept a remote login, there is a handful of chores that have to be done by hand, every single time:

• Write the Arch Linux live ISO to a USB stick and plug it in.
• Borrow a monitor and keyboard for the target machine, just long enough to bootstrap it.
• Power on the machine and wait for the live system to boot.
• Configure the network, which for WiFi means typing a passphrase into iwctl on that borrowed keyboard.
• Configure SSH, by setting a root password with passwd or by adding your public key to /root/.ssh/authorized_keys.
• Get your workstation onto the same network as the target, or string together a series of SSH jump hosts so that you can reach it.
• Remove the machine’s old entry from ~/.ssh/known_hosts on your workstation, because the live system generated a brand new host key and SSH now thinks someone is impersonating it.

Only then can you put the borrowed keyboard away and get back to your desk. BOOMSTICK does all of these chores for you. You write the image to a USB stick once, drop your WiFi, WireGuard and SSH settings onto it, and from then on you just plug it in, power on, and SSH in from wherever you are.

It is the stock Arch Linux installer – archiso’s releng profile – with a few additions layered on top: iwd joins your WiFi networks automatically, wg-quick brings up a WireGuard tunnel to your own server, and sshd lets you in as root with your authorized_keys. Once it is up, an optional boot webhook sends you a notification (to ntfy, for example) with the stick’s LAN, public and WireGuard addresses, so you know it is ready and where to find it. One image boots both x86_64 PCs (UEFI) and the Raspberry Pi 5, so a single stick in your bag covers every machine you are likely to meet.

The image itself is generic and contains no secrets, so you can build it once, and so can anyone else. Your WiFi passwords, WireGuard key, SSH keys and webhook URL go into a boomstick/ directory on the stick’s FAT32 partition, which you fill in after writing the image. That partition is readable from any computer, so you edit those files with whatever editor you like, and the live system reads them again on every boot.

Where the instructions live

I have made the BOOMSTICK appendix of my Arch Workstation book the canonical home for the full walkthrough, so that it stays next to the install it feeds into, and so there is only one copy of it to keep correct. It covers:

• Build the image – the container build, and writing it to a stick.
• Configure WireGuard – giving the stick its own peer, and why the keepalive matters.
• SSH keys, WiFi and the webhook – the rest of the config files.
• Provision the stick – copying it all onto the stick, and changing it later.
• How it works under the hood – what happens at boot, and why the partition label matters.

From there, the book carries straight on into booting the target machine and connecting to it, and then into installing Arch on it.

The source is at github.com/EnigmaCurry/boomstick.

BOOMSTICK is an independent project, not affiliated with or endorsed by the Arch Linux project. Arch Linux is a trademark of the Arch Linux project.