From 7678d614f93a16ad57dec39e5777edf5c286f22a Mon Sep 17 00:00:00 2001
From: eding <edin.grech@gmail.com>
Date: Mon, 20 Jul 2026 22:16:20 +0200
Subject: [PATCH] fix: generate talos config before bootstrap

---
 internal/bootstrap/bootstrap.go | 17 +++++++++++++++++
 internal/utils/helpers.go       | 12 ++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go
index ea49436..7b0f252 100644
--- a/internal/bootstrap/bootstrap.go
+++ b/internal/bootstrap/bootstrap.go
@@ -51,6 +51,9 @@ func (r Runner) Run() error {
 	if err := os.WriteFile(filepath.Join(terraformDir, r.Config.Talos.ConfigFileName), []byte(renderTerraformTFVars(r.Config)), 0644); err != nil {
 		return err
 	}
+	if err := ensureTalosConfig(generatedDir); err != nil {
+		return err
+	}
 
 	if r.Config.Talos.AutoRunTerraform {
 		if err := utils.RunCommandInDir(terraformDir, "terraform", "init"); err != nil {
@@ -86,6 +89,20 @@ func ensureRepo(dir, repoURL, ref string) error {
 	return utils.RunCommandInDir(dir, "git", "checkout", ref)
 }
 
+func ensureTalosConfig(generatedDir string) error {
+	secretPath := filepath.Join(generatedDir, "talsecret.sops.yaml")
+	if _, err := os.Stat(secretPath); os.IsNotExist(err) {
+		secrets, err := utils.RunCommandOutputInDir(generatedDir, "talhelper", "gensecret", "--from-configfile", "talconfig.yaml")
+		if err != nil {
+			return err
+		}
+		if err := os.WriteFile(secretPath, secrets, 0600); err != nil {
+			return err
+		}
+	}
+	return utils.RunCommandInDir(generatedDir, "talhelper", "genconfig")
+}
+
 func renderTerraformTFVars(cfg config.Config) string {
 	var builder strings.Builder
 	builder.WriteString(fmt.Sprintf("proxmox_api_url = %q\n", cfg.Talos.Proxmox.APIURL))
diff --git a/internal/utils/helpers.go b/internal/utils/helpers.go
index 1c2875e..c8b8e7c 100644
--- a/internal/utils/helpers.go
+++ b/internal/utils/helpers.go
@@ -55,6 +55,18 @@ func RunCommandOutput(name string, args ...string) ([]byte, error) {
 	return stdout.Bytes(), nil
 }
 
+func RunCommandOutputInDir(dir string, name string, args ...string) ([]byte, error) {
+	cmd := exec.Command(name, args...)
+	cmd.Dir = dir
+	var stdout bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		return nil, err
+	}
+	return stdout.Bytes(), nil
+}
+
 func RunCommandJSON(target any, name string, args ...string) error {
 	output, err := RunCommandOutput(name, args...)
 	if err != nil {