We need to create an mTLS enabled registry endpoint for flatpaks, without breaking registry access for existing customers.

A/C

• create flatpaks.registry.redhat.io registry
• create corresponding flatpaks.registry.stage.redhat.io
• we intend to dual-publish ~20 images there and to registry.redhat.io
• We don't want all images to be available from there - just the ones we publish there
• stage and prod registry should be mtls enabled but can also accept user / password.
• no anonymous access permitted
• separate content root is fine (doesn't need to overlap like registry.access and registry.redhat.io
  • using quay orgs:
  • rh-flatpaks-stage
  • rh-flatpaks-prod