From 20cad3e12be1a91140c94e904c2e256547893a10 Mon Sep 17 00:00:00 2001
From: ckoch <ckoch@lazypug.net>
Date: Mon, 6 Jul 2026 19:48:22 -0400
Subject: [PATCH] Add ISO user config: unattended install needs baked accounts

VM smoke test of the first ISO reached GDM but no user existed
(bootc-image-builder ISOs install unattended; gnome-initial-setup is
not in the bazzite base). iso-config.toml creates parent (wheel) and
kid with placeholder passwords to change on first login.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 BUILD-CONSOLE.md | 11 ++++++++++-
 iso-config.toml  | 15 +++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 iso-config.toml

diff --git a/BUILD-CONSOLE.md b/BUILD-CONSOLE.md
index f28f352..a7f7b58 100644
--- a/BUILD-CONSOLE.md
+++ b/BUILD-CONSOLE.md
@@ -18,6 +18,7 @@ mkdir -p output
 sudo podman run --rm -it --privileged \
   --security-opt label=type:unconfined_t \
   -v ./output:/output \
+  -v ./iso-config.toml:/config.toml:ro \
   -v /var/lib/containers/storage:/var/lib/containers/storage \
   quay.io/centos-bootc/bootc-image-builder:latest \
   --type iso --rootfs btrfs \
@@ -66,17 +67,25 @@ cid=$(docker create localhost/bc250-console-gnome:latest true)
 docker cp "$cid":/etc/pki/rpm-gpg ./rpm-gpg-keys
 docker rm "$cid"
 
-# 5. Build the ISO (--rootfs required: the image sets no root-fs-type)
+# 5. Build the ISO (--rootfs required: the image sets no root-fs-type;
+#    iso-config.toml REQUIRED — the ISO installs unattended and the image has
+#    no first-boot account wizard, so without baked users the install is
+#    unloginable)
 mkdir -p iso-output
 docker run --rm --privileged --security-opt label=type:unconfined_t \
   -v "$PWD"/iso-output:/output \
   -v "$PWD"/rpm-gpg-keys:/etc/pki/rpm-gpg:ro \
+  -v "$PWD"/iso-config.toml:/config.toml:ro \
   -v bib-storage:/var/lib/containers/storage \
   quay.io/centos-bootc/bootc-image-builder:latest \
   --type iso --rootfs btrfs \
   localhost/bc250-console-gnome:latest
 ```
 
+**Heads-up: the ISO wipes and auto-installs to the first disk with no
+prompts.** Accounts come from `iso-config.toml` (placeholder passwords —
+change on first login: `passwd`, and `sudo passwd kid`).
+
 ISO lands at `iso-output/bootiso/install.iso` (~5 GB), owned by root — fix
 with `docker run --rm -v "$PWD"/iso-output:/o alpine chown -R 1000:1000 /o`.
 
diff --git a/iso-config.toml b/iso-config.toml
new file mode 100644
index 0000000..bef4496
--- /dev/null
+++ b/iso-config.toml
@@ -0,0 +1,15 @@
+# bootc-image-builder customizations for the installer ISO.
+# Mount as /config.toml on the bib container (see BUILD-CONSOLE.md).
+#
+# PLACEHOLDER PASSWORDS — change both on first login:
+#   passwd            (for the account you're logged into)
+#   sudo passwd kid   (parent can reset the kid's password)
+
+[[customizations.user]]
+name = "parent"
+password = "bc250console"
+groups = ["wheel"]
+
+[[customizations.user]]
+name = "kid"
+password = "bc250console"