From 4c49e864b0b8d3685c8e53d415289806278955ea Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@amutable.com>
Date: Thu, 5 Mar 2026 10:39:28 +0100
Subject: [PATCH] firstboot: permit setting the static hostname via a system
 credential

For the IMDS case there's value in being able to set the static
hostname, instead of just the transient one. Let's introduce
firstboot.hostname, which only applies to first boot, and write the
static hostname. This is different from system.hostname which applies to
any boot, and writes the transient hostname.
---
 man/systemd-firstboot.xml          | 11 +++++++++++
 man/systemd.system-credentials.xml | 23 +++++++++++++++++++----
 src/firstboot/firstboot.c          | 13 +++++++++++++
 3 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/man/systemd-firstboot.xml b/man/systemd-firstboot.xml
index 86a85f0bf28..db6f2569a8d 100644
--- a/man/systemd-firstboot.xml
+++ b/man/systemd-firstboot.xml
@@ -447,6 +447,17 @@
 
         <xi:include href="version-info.xml" xpointer="v249"/></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>firstboot.hostname</varname></term>
+
+        <listitem><para>This credential specifies the static system hostname to set during first boot. The
+        user will not be prompted for the hostname. Note that this controls the static hostname, not the
+        transient hostname, and only has an effect on first boot, unlike
+        <varname>system.hostname</varname>.</para>
+
+        <xi:include href="version-info.xml" xpointer="v261"/></listitem>
+      </varlistentry>
     </variablelist>
 
     <para>Note that by default the <filename>systemd-firstboot.service</filename> unit file is set up to
diff --git a/man/systemd.system-credentials.xml b/man/systemd.system-credentials.xml
index e3e28872077..a302be236d4 100644
--- a/man/systemd.system-credentials.xml
+++ b/man/systemd.system-credentials.xml
@@ -44,7 +44,7 @@
       <varlistentry>
         <term><varname>firstboot.keymap</varname></term>
         <listitem>
-          <para>The console key mapping to set (e.g. <literal>de</literal>).  Read by
+          <para>The console key mapping to set (e.g. <literal>de</literal>). Read by
           <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
           and only honoured if no console keymap has been configured before.</para>
 
@@ -52,6 +52,20 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>firstboot.hostname</varname></term>
+
+        <listitem><para>This credential specifies the static system hostname to set during first boot. The
+        user will not be prompted for the hostname. Note that this controls the static hostname, not the transient
+        hostname, and only has an effect on first boot, unlike <varname>system.hostname</varname> (see
+        below). Read by
+        <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+        and only honoured if no static hostname has been configured before.</para>
+
+        <xi:include href="version-info.xml" xpointer="v261"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>firstboot.locale</varname></term>
         <term><varname>firstboot.locale-messages</varname></term>
@@ -398,9 +412,10 @@
         <term><varname>system.hostname</varname></term>
         <listitem>
           <para>Accepts a (transient) hostname to configure during early boot. The static hostname specified
-            in <filename>/etc/hostname</filename>, if configured, takes precedence over this setting.
-            Interpreted by the service manager (PID 1). For details see
-            <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
+          in <filename>/etc/hostname</filename>, if configured, takes precedence over this setting.
+          Interpreted by the service manager (PID 1). For details see
+          <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>. Also
+          see <varname>firstboot.hostname</varname> above.</para>
 
           <xi:include href="version-info.xml" xpointer="v254"/>
         </listitem>
diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index ae1899593cd..8cb81e7f06e 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -655,6 +655,19 @@ static int prompt_hostname(int rfd, sd_varlink **mute_console_link) {
         if (arg_hostname)
                 return 0;
 
+        _cleanup_free_ char *hn = NULL;
+        r = read_credential("firstboot.hostname", (void**) &hn, NULL);
+        if (r < 0)
+                log_debug_errno(r, "Failed to read credential firstboot.hostname, ignoring: %m");
+        else if (!hostname_is_valid(hn, VALID_HOSTNAME_TRAILING_DOT|VALID_HOSTNAME_QUESTION_MARK))
+                log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Hostname '%s' supplied via credential is not valid, ignoring.", hn);
+        else {
+                log_debug("Acquired hostname from credentials.");
+                arg_hostname = TAKE_PTR(hn);
+                hostname_cleanup(arg_hostname);
+                return 0;
+        }
+
         if (!arg_prompt_hostname) {
                 log_debug("Prompting for hostname was not requested.");
                 return 0;
-- 
2.47.3