Installing Flatpak applications on hosts

After you synchronize Flatpak repositories in orcharhino, you can install Flatpak applications on hosts from orcharhino Server or orcharhino Proxy Server. On each host, add a Flatpak remote, authenticate to the container registry, and install the applications you need.

Additional resources

Managing Flatpak repositories in orcharhino in Managing Content

Configuring Podman to trust the certificate authority

Configure Podman to trust the orcharhino certificate authority so that you can push and pull container images without disabling TLS verification.

Podman locates the CA file in the /etc/containers/certs.d/ path. Copy the root CA file to that path, with the exact path determined by the server hostname, and name the file ca.crt.

In the following examples, replace hostname.example.com with orcharhino.example.com or orcharhino-proxy.network2.example.com, depending on your use case.

Prerequisites

You have the root CA certificate file for orcharhino Server or orcharhino Proxy Server.
You have root or sudo access on the host where Podman is installed.

Procedure

Create the relevant directory:

$ mkdir --parents /etc/containers/certs.d/hostname.example.com

Copy the CA file to the directory:

$ cp My_Root_CA.pem /etc/containers/certs.d/hostname.example.com/ca.crt

Verification

Verify that you no longer need to use the --tls-verify=false option when logging in to the registry:
```
$ podman login hostname.example.com
```

Installing Flatpak applications on a host from orcharhino Server

Connect your host to the Flatpak remote on orcharhino Server, authenticate to the container registry, and install Flatpak applications published through your content views.

Prerequisites

Flatpak is installed on the host.
Flatpak application repositories are published through content views.
Flatpak runtime repositories are available to hosts alongside application repositories. Flatpak applications, such as rhel9/firefox-flatpak, depend on the runtime for installation.
Podman is installed on the host.
Podman is configured to trust the certificate authority of orcharhino Server. For more information, see Configuring podman to trust the certificate authority.
Your orcharhino account has the view_lifecycle_environments, view_products, and view_content_views permissions, unless the lifecycle environment allows unauthenticated pull.
Your orcharhino account has a role that grants the create_personal_access_tokens permission to generate an access token for authentication. orcharhino generates a token automatically when you run podman login.

Procedure

On the managed host, add your orcharhino Server as a Flatpak remote:

$ flatpak remote-add --authenticator-name=org.flatpak.Authenticator.Oci katello oci+https://orcharhino.example.com/

Log in the host to the container registry using one of the following methods:
- Certificate authentication
  - When registering a host to orcharhino or orcharhino Proxy, select the Set up container registry certs checkbox.
  - If the host is already registered, run the Flatpak - Login to registry via podman job template on the host. Set Set up certificate authentication to true and enter the URL of your orcharhino Proxy as the registry URL.
- Using Podman
  - Log in using Podman:
    
    $ podman login orcharhino.example.com
Install your application. For example, to install the Mozilla Firefox Flatpak:
```
$ flatpak install firefox
```

Installing Flatpak applications on a host from orcharhino Proxy Server

Connect your host to the Flatpak remote on orcharhino Proxy Server, authenticate to the container registry, and install Flatpak applications.

orcharhino Proxies synchronize Flatpaks and make them available to all hosts, but not organizations, content views, or lifecycle environments. Clients receive the latest Flatpaks synchronized on the orcharhino Proxy globally.

Prerequisites

Flatpak repositories are synchronized to orcharhino Proxy Server. For more information, see Adding lifecycle environments to orcharhino Proxy Servers by using orcharhino management UI in Managing Content.
Flatpak is installed on the host.
Flatpak runtime repositories are available to hosts alongside application repositories. Flatpak applications, such as rhel9/firefox-flatpak, depend on the runtime for installation.
Podman is installed on the host.
Podman is configured to trust the certificate authority of orcharhino Proxy Server. For more information, see Configuring podman to trust the certificate authority.

Procedure

On the managed host, add the orcharhino Proxy as a Flatpak remote:

$ flatpak remote-add --authenticator-name=org.flatpak.Authenticator.Oci katello oci+https://orcharhino-proxy.network2.example.com/

Log in the host to the container registry using one of the following methods:
- Certificate authentication
  - When registering a host to orcharhino Proxy, select the Set up container registry certs checkbox.
  - If the host is already registered, run the Flatpak - Login to registry via podman job template on the host. Set Set up certificate authentication to true and enter the URL of your orcharhino Proxy as the registry URL.
- Using Podman
  - Log in using Podman:
    
    $ podman login orcharhino-proxy.network2.example.com
    
    You might need to log in to the registry again if you have not saved your credentials.
Optional: Save your credentials permanently using one of the following options:
- To save the credentials for the current user:
  $ cp $XDG_RUNTIME_DIR/containers/auth.json $HOME/.config/flatpak/oci-auth.json
- To save the credentials system-wide:
  $ cp $XDG_RUNTIME_DIR/containers/auth.json /etc/flatpak/oci-auth.json
Install your application. For example, to install the Mozilla Firefox Flatpak:
```
$ flatpak install firefox
```

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").