firefox wrapper

firefox.nix

        firefox = super.writeScriptBin "firefox" ''
          #! ${pkgs.stdenv.shell}
          # FIXME: why even bother with wayland when I have to provide blanket access to /run/user/1000 ?!?
          # I just hope /dev/dri is sane and doesn't leak other processes... but I guess I am wrong
          deviceMounts=""
          for file in /dev/dri/*; do deviceMounts="$deviceMounts --dev-bind $file $file"; done
          exec ${super.bubblewrap}/bin/bwrap \
            --proc /proc \
            --dev /dev \
            --bind /home/andi/Downloads /home/andi/Downloads \
            --bind /home/andi/.mozilla/ /home/andi/.mozilla \
            --ro-bind /nix/store /nix/store \
            --ro-bind /run /run \
            --tmpfs /tmp --chdir /tmp \
            --ro-bind /home/andi/.Xauthority /home/andi/.Xauthority \
            --ro-bind /etc/hosts /etc/hosts \
            --ro-bind /etc/localtime /etc/localtime \
            $deviceMounts \
            --bind /tmp/.X11-unix/X0 /tmp/.X11-unix/X0 \
            --bind /run/user/1000 /run/user/1000 \
            --setenv DISPLAY :0 \
            ${pkgs.writeScript "run-firefox" ''
              #! ${pkgs.stdenv.shell}
              # wrapper script that is executed within the standbox, useful to debug what is available/missing/etc..
              ls -la /dev/dri
              id
              exec ${super.firefox-wayland}/bin/firefox $@
            ''} $@
        '';