From 137091b402829dc697f838b8b5090972190e76c1 Mon Sep 17 00:00:00 2001
From: Wesley van Tilburg <justwesley@protonmail.com>
Date: Wed, 30 Sep 2026 19:37:03 +0200
Subject: [PATCH] fedora-remote: install Flatpaks system-wide on first boot

Per-user Flatpaks are only visible to the account that logged in first (and
consumed space per user). Install them into the system installation instead, so
every user including Kanidm accounts sees Firefox.
---
 images/fedora-remote/custom.yaml              | 10 +++----
 .../files/50-flatpak-system-firstboot.preset  |  1 +
 .../files/flatpak-system-firstboot            | 26 +++++++++++++++++++
 .../files/flatpak-system-firstboot.service    | 14 ++++++++++
 images/fedora-remote/files/flatpaks.list      |  2 +-
 5 files changed, 47 insertions(+), 6 deletions(-)
 create mode 100644 images/fedora-remote/files/50-flatpak-system-firstboot.preset
 create mode 100644 images/fedora-remote/files/flatpak-system-firstboot
 create mode 100644 images/fedora-remote/files/flatpak-system-firstboot.service

diff --git a/images/fedora-remote/custom.yaml b/images/fedora-remote/custom.yaml
index d337f23..2f106bb 100644
--- a/images/fedora-remote/custom.yaml
+++ b/images/fedora-remote/custom.yaml
@@ -41,10 +41,10 @@ exclude-packages:
   - firefox
 
 add-files:
-  # Per-user Flatpaks on first login (Firefox).
-  - ["flatpak-user-firstboot", "/usr/libexec/flatpak-user-firstboot"]
-  - ["flatpak-user-firstboot.service", "/usr/lib/systemd/user/flatpak-user-firstboot.service"]
-  - ["60-flatpak-user-firstboot.preset", "/usr/lib/systemd/user-preset/60-flatpak-user-firstboot.preset"]
+  # System-wide Flatpaks on first boot (Firefox), visible to every user.
+  - ["flatpak-system-firstboot", "/usr/libexec/flatpak-system-firstboot"]
+  - ["flatpak-system-firstboot.service", "/usr/lib/systemd/system/flatpak-system-firstboot.service"]
+  - ["50-flatpak-system-firstboot.preset", "/usr/lib/systemd/system-preset/50-flatpak-system-firstboot.preset"]
   - ["flatpaks.list", "/usr/share/flatpak/flatpaks.list"]
   # Kanidm client config + authselect profile sources.
   - ["kanidm-config", "/etc/kanidm/config"]
@@ -107,5 +107,5 @@ postprocess:
   - |
     #!/usr/bin/env bash
     set -xeuo pipefail
-    chmod 0755 /usr/libexec/flatpak-user-firstboot /usr/libexec/grd-firstboot
+    chmod 0755 /usr/libexec/flatpak-system-firstboot /usr/libexec/grd-firstboot
     systemctl --user --global preset-all
diff --git a/images/fedora-remote/files/50-flatpak-system-firstboot.preset b/images/fedora-remote/files/50-flatpak-system-firstboot.preset
new file mode 100644
index 0000000..66f21eb
--- /dev/null
+++ b/images/fedora-remote/files/50-flatpak-system-firstboot.preset
@@ -0,0 +1 @@
+enable flatpak-system-firstboot.service
diff --git a/images/fedora-remote/files/flatpak-system-firstboot b/images/fedora-remote/files/flatpak-system-firstboot
new file mode 100644
index 0000000..04e6c05
--- /dev/null
+++ b/images/fedora-remote/files/flatpak-system-firstboot
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Install the Flatpaks listed in /usr/share/flatpak/flatpaks.list into the
+# system-wide installation on first boot, so every user (including Kanidm
+# accounts) sees them.
+set -euo pipefail
+
+LIST="/usr/share/flatpak/flatpaks.list"
+MARKER="/var/lib/flatpak/.system-firstboot-done"
+
+[[ -f "${LIST}" ]] || exit 0
+[[ -f "${MARKER}" ]] && exit 0
+
+# Make Flathub available system-wide.
+flatpak remote-add --system --if-not-exists flathub \
+  https://flathub.org/repo/flathub.flatpakrepo
+
+mapfile -t apps < <(
+  sed -e 's/#.*//' -e 's/[[:space:]]//g' "${LIST}" | grep -v '^$' || true
+)
+
+if [[ ${#apps[@]} -gt 0 ]]; then
+  flatpak install --system --noninteractive --assumeyes "${apps[@]}"
+fi
+
+install -d "$(dirname "${MARKER}")"
+touch "${MARKER}"
diff --git a/images/fedora-remote/files/flatpak-system-firstboot.service b/images/fedora-remote/files/flatpak-system-firstboot.service
new file mode 100644
index 0000000..659014b
--- /dev/null
+++ b/images/fedora-remote/files/flatpak-system-firstboot.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Install system-wide Flatpak applications on first boot
+Documentation=https://docs.flatpak.org/en/latest/flatpak-command-reference.html
+ConditionPathExists=!/var/lib/flatpak/.system-firstboot-done
+After=network-online.target flatpak-add-fedora-repos.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/flatpak-system-firstboot
+
+[Install]
+WantedBy=multi-user.target
diff --git a/images/fedora-remote/files/flatpaks.list b/images/fedora-remote/files/flatpaks.list
index acdccea..025c4f5 100644
--- a/images/fedora-remote/files/flatpaks.list
+++ b/images/fedora-remote/files/flatpaks.list
@@ -1,3 +1,3 @@
-# Flatpaks installed into each user's per-user installation on first login.
+# Flatpaks installed system-wide on first boot (visible to all users).
 # foot is installed as an RPM (no Flathub build), so only Firefox here.
 org.mozilla.firefox