feat: add support for embedding machine configuration (enterprise)

allow embedding machine configuration into Talos images.

Signed-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>

Author: Orzelius

cmd/image-factory/cmd/service.go

@@ -129,6 +129,7 @@ func RunFactory(ctx context.Context, logger *zap.Logger, opts Options) error {
 		artifactsManager,
 		secureBootService,
 		enterprise.NewChecksummer(),
+		enterprise.NewConfigurator(),
 		enterprisePlugins,
 		frontendOptions,
 	)

docs/api.md

@@ -65,6 +65,11 @@ customization:
        # optional, include well-known UEFI certificates into auto-enrollment database (SecureBoot ISO only)
       includeWellKnownCertificates: true
     bootloader: sd-boot # optional, defaults to auto (bootloader chosen by imager), other options: dual-boot, grub
+    embeddedMachineConfiguration: | # optional, embedded machine configuration (YAML-encoded) (Enterprise only)
+      apiVersion: v1alpha1
+      kind: HostnameConfig
+      hostname: my-custom-hostname
+      auto: off
 overlay: # optional
   image: ghcr.io/siderolabs/sbc-raspberry-pi # overlay image
   name: rpi_generic # overlay name

enterprise/config/config_embedder.go

@@ -0,0 +1,27 @@
+// Copyright (c) 2026 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build enterprise
+
+// Package config adds configuration related functionality.
+package config
+
+import (
+	"github.com/siderolabs/talos/pkg/imager/profile"
+
+	"github.com/siderolabs/image-factory/pkg/schematic"
+)
+
+type Configurator struct{}
+
+// EmbedConfigIntoSchematic embeds the machine config into the schematic.
+func (Configurator) EmbedConfigIntoSchematic(config string, schematic *schematic.Schematic) {
+	schematic.Customization.EmbeddedMachineConfiguration = config
+}
+
+// EmbedConfigIntoProfile embeds the machine config into the profile.
+func (Configurator) EmbedConfigIntoProfile(config string, profile *profile.Profile) {
+	profile.Customization.EmbeddedMachineConfiguration = config
+}

internal/frontend/http/configuration.go

@@ -15,6 +15,8 @@ import (
 	"github.com/siderolabs/gen/xerrors"
 
 	"github.com/siderolabs/image-factory/internal/schematic/storage"
+	"github.com/siderolabs/image-factory/pkg/enterprise"
+	enterrors "github.com/siderolabs/image-factory/pkg/enterprise/errors"
 	schematicpkg "github.com/siderolabs/image-factory/pkg/schematic"
 )
 
@@ -34,6 +36,10 @@ func (f *Frontend) handleSchematicCreate(ctx context.Context, w http.ResponseWri
 		return err
 	}
 
+	if schematic.Customization.EmbeddedMachineConfiguration != "" && !enterprise.Enabled() {
+		return xerrors.NewTaggedf[enterrors.NotEnabledTag]("enterprise not enabled: embedding machine configuration is not available")
+	}
+
 	if f.options.AuthProvider != nil {
 		if username, ok := f.options.AuthProvider.UsernameFromContext(ctx); ok {
 			if schematic.Owner != "" && schematic.Owner != username {

internal/frontend/http/css/output.css

@@ -50,6 +50,7 @@ type Frontend struct {
 	artifactsManager  *artifacts.Manager
 	secureBootService *secureboot.Service
 	checksummer       enterprise.Checksummer
+	configurator      enterprise.Configurator
 	logger            *zap.Logger
 	puller            remotewrap.Puller
 	pusher            remotewrap.Pusher
@@ -85,6 +86,7 @@ func NewFrontend(
 	artifactsManager *artifacts.Manager,
 	secureBootService *secureboot.Service,
 	checksummer enterprise.Checksummer,
+	configEmbedder enterprise.Configurator,
 	enterprisePlugins []enterprise.FrontendPlugin,
 	opts Options,
 ) (*Frontend, error) {
@@ -95,6 +97,7 @@ func NewFrontend(
 		artifactsManager:  artifactsManager,
 		secureBootService: secureBootService,
 		checksummer:       checksummer,
+		configurator:      configEmbedder,
 		logger:            logger.With(zap.String("frontend", "http")),
 		options:           opts,
 	}

internal/frontend/http/http.go

@@ -81,7 +81,7 @@ func (f *Frontend) handleImage(ctx context.Context, w http.ResponseWriter, r *ht
 		return fmt.Errorf("error parsing profile from path: %w", err)
 	}
 
-	prof, err = profile.EnhanceFromSchematic(ctx, prof, schematic, f.artifactsManager, f.secureBootService, versionTag)
+	prof, err = profile.EnhanceFromSchematic(ctx, prof, schematic, f.artifactsManager, f.secureBootService, f.configurator, versionTag)
 	if err != nil {
 		return fmt.Errorf("error enhancing profile from schematic: %w", err)
 	}

internal/frontend/http/image.go

@@ -184,6 +184,18 @@
 - id: customization.overlay.skip
   translation: "If unsure, you can skip this step."
 
+- id: customization.embedded_config
+  translation: "Embedded machine configuration:"
+
+- id: customization.embedded_config.description
+  translation: "This configuration will be embedded into the image. For more details see the  "
+
+- id: customization.embedded_config.reference
+  translation: "documentation"
+
+- id: customization.embedded_config.skip
+  translation: "Skip this step if unsure."
+
 - id: customization.bootloader.title
   translation: "Bootloader"
 

internal/frontend/http/locales/active.en.yaml

@@ -184,6 +184,18 @@
 - id: customization.overlay.skip
   translation: "En cas de doute, vous pouvez ignorer cette étape."
 
+- id: customization.embedded_config
+  translation: "Configuration machine intégrée :"
+
+- id: customization.embedded_config.description
+  translation: "Cette configuration sera intégrée à l'image. Pour plus de détails, consultez la "
+
+- id: customization.embedded_config.reference
+  translation: "documentation"
+
+- id: customization.embedded_config.skip
+  translation: "Ignorez cette étape en cas de doute."
+
 - id: customization.bootloader.title
   translation: "Chargeur d'amorçage"
 

internal/frontend/http/locales/active.fr.yaml

@@ -184,6 +184,18 @@
 - id: customization.overlay.skip
   translation: "Jeśli nie masz pewności - możesz pominąć ten krok."
 
+- id: customization.embedded_config
+  translation: "Wbudowana konfiguracja maszyny:"
+
+- id: customization.embedded_config.description
+  translation: "Ta konfiguracja zostanie wbudowana w obraz. Aby uzyskać więcej informacji, zobacz "
+
+- id: customization.embedded_config.reference
+  translation: "dokumentację"
+
+- id: customization.embedded_config.skip
+  translation: "Pomiń ten krok, jeśli nie masz pewności."
+
 - id: customization.bootloader.title
   translation: "Program rozruchowy"