{ mkNixPak, ungoogled-chromium }:

mkNixPak {
  config = { config, sloth, ... }: {
    app.package = ungoogled-chromium;
    flatpak = {
      appId = "org.chromium.Chromium";
      desktopFile = "chromium-browser.desktop";
    };
    imports = [
      ../modules/gui-base.nix
      ../modules/network.nix
      ../modules/mpris2-player.nix
    ];
    # chromium doesn't use the expected MPRIS2 name format
    dbus.policies = {
      "org.mpris.MediaPlayer2.chromium.*" = "own";
    };
    bubblewrap = {
      # for hidraw access (WebAuthn keys)
      bind.dev = [ "/dev" ];
      bind.rw = [
        [
          (sloth.mkdir (sloth.concat [
            sloth.appCacheDir
            "/nixpak-app-shared-tmp"
          ]))
          "/tmp"
        ]
        [
          (sloth.mkdir (sloth.concat' sloth.appCacheDir "/chromium"))
          (sloth.concat' sloth.xdgCacheHome "/chromium")
        ]
        [
          # home-manager does some funny things
          (sloth.concat [
            sloth.xdgConfigHome
            "/nixpak-ungoogled-chromium"
          ])
          (sloth.concat [
            sloth.xdgConfigHome
            "/chromium"
          ])
        ]
        (sloth.concat' sloth.homeDir "/Downloads")
        "/tmp/.X11-unix"
        (sloth.envOr "XAUTHORITY" "/no-xauth")
      ];
    };
  };
}