Ok so the first run template above works if you need to do wifi etc. In my case the easy fix was to find the default images root password. So on a fresh image, I boot the device, watch it get an IP via DHCP and then login using the default root password and it lets me enter the information in the first launch script.