Raspberry Pi image

For a Raspberry Pi 4 or later, the release page has a ready image, warda_<version>_raspberrypi-arm64.img.xz: Raspberry Pi OS Lite (64-bit) with Warda installed at the first start.

1. Install Raspberry Pi Imager 2.0.2 or later, download warda.rpi-imager-manifest from the same release page and open it (double-click): Imager starts with Warda <version> in its list of systems, downloads the image and checks it. Write it to a card of 16 GB or more. Imager 2.x only offers its customisation for an image listed in a manifest (not for "Use custom"): create your user and, for a shell on the Raspberry, turn SSH on with "Allow public-key authentication only" and your public key: the image refuses SSH passwords and root. The release job of the CI writes the manifest (.gitea/scripts/imager-manifest.sh, init_format cloudinit-rpi) and lists it in the signed SHA256SUMS.
2. Plug the Raspberry into your box with a network cable and power it on. The first start takes a few minutes (the system grows to the whole card, then installs Warda).
3. Give the Raspberry a fixed address in your box (DHCP reservation), then open http://ADDRESS-OF-THE-RASPBERRY within 60 minutes after it starts.

The image turns on the hardware watchdog of the Raspberry: a system that hangs restarts by itself. Its name on the network is warda. The system updates itself (unattended-upgrades, installed as soon as the network is up): security updates of Debian, and updates of Raspberry Pi OS (kernel, firmware), with a restart at 05:30 only when an update needs one. SSH takes keys only (/etc/ssh/sshd_config.d/10-warda.conf), and fail2ban bans the addresses that keep failing, longer each time: the SSH port can be opened on the box of a household you help from afar.