1{
  2  pkgs,
  3  lib,
  4  sloth,
  5  ...
  6}: {
  7  imports = [./common.nix];
  8
  9  config = {
 10    dbus = {
 11      policies = {
 12        "org.gtk.vfs" = "talk";
 13        "org.gtk.vfs.*" = "talk";
 14        "org.a11y.Bus" = "see";
 15        # Input methods talk to the daemon directly, fcitx5 exposes the fcitx4
 16        # compat name as org.fcitx.Fcitx-<n>, hence the prefix wildcard.
 17        "org.fcitx.*" = "talk";
 18        "org.freedesktop.portal.Fcitx" = "talk";
 19        "org.freedesktop.portal.Fcitx.*" = "talk";
 20        "org.freedesktop.portal.IBus" = "talk";
 21        "org.freedesktop.portal.IBus.*" = "talk";
 22      };
 23      rules.call = {
 24        "org.a11y.Bus" = [
 25          "org.a11y.Bus.GetAddress@/org/a11y/bus"
 26          "org.freedesktop.DBus.Properties.Get@/org/a11y/bus"
 27        ];
 28        "org.freedesktop.portal.Fcitx" = ["*"];
 29        "org.freedesktop.portal.Fcitx.*" = ["*"];
 30        "org.freedesktop.portal.IBus" = ["*"];
 31        "org.freedesktop.portal.IBus.*" = ["*"];
 32      };
 33    };
 34
 35    # `nixos` provider reuses the host's /run/opengl-driver
 36    gpu = {
 37      enable = lib.mkDefault true;
 38      provider = "nixos";
 39    };
 40
 41    # nixpak's bundled fontconfig has no CJK font
 42    fonts.enable = lib.mkDefault false;
 43
 44    bubblewrap = {
 45      sockets = {
 46        wayland = lib.mkDefault true;
 47        pipewire = true;
 48      };
 49
 50      bind.rw = [
 51        (sloth.concat' sloth.xdgCacheHome "/fontconfig")
 52        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache")
 53        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache_db")
 54        (sloth.concat' sloth.xdgCacheHome "/radv_builtin_shaders")
 55
 56        (sloth.concat' sloth.runtimeDir "/gvfsd")
 57
 58        (sloth.concat' sloth.runtimeDir "/pulse")
 59      ];
 60      bind.ro = [
 61        (sloth.concat' sloth.runtimeDir "/at-spi/bus")
 62        "/run/dbus"
 63
 64        "/etc/fonts"
 65
 66        # Without /etc/egl, libEGL warns: failed to create dri2 screen
 67        "/etc/egl"
 68        "/etc/static/egl"
 69
 70        # Cursor and icon themes come from the host, so the session's
 71        # XCURSOR_PATH resolves instead of the app keeping its own copy.
 72        (sloth.concat' sloth.xdgDataHome "/icons")
 73        (sloth.concat' sloth.homeDir "/.icons")
 74
 75        (sloth.concat' sloth.xdgConfigHome "/fontconfig")
 76        (sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
 77        (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
 78        (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
 79        (sloth.concat' sloth.xdgConfigHome "/kdeglobals")
 80      ];
 81      bind.dev =
 82        (map (id: "/dev/video${toString id}") (lib.lists.range 0 9))
 83        ++ [
 84          "/dev/shm" # Shared Memory
 85
 86          "/dev/nvidia0"
 87          "/dev/nvidiactl"
 88          "/dev/nvidia-modeset"
 89          "/dev/nvidia-uvm"
 90
 91          # nixpak mounts the X11 sockets before its own tmpfs /tmp, which would
 92          # hide them, and bind.dev is the only slot applied after that tmpfs.
 93          "/tmp/.X11-unix"
 94        ];
 95
 96      env = {
 97        XDG_DATA_DIRS = lib.makeSearchPath "share" [
 98          pkgs.shared-mime-info
 99        ];
100      };
101    };
102  };
103}