From 8ba75c5128b29f9ce9dc04de17a50efe44db787f Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Thu, 19 Jun 2025 00:03:21 +0800
Subject: [PATCH] fix: nixpaks.firefox - browserpass extension

---
 hardening/nixpaks/firefox.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hardening/nixpaks/firefox.nix b/hardening/nixpaks/firefox.nix
index 974d694e..4c8589a9 100644
--- a/hardening/nixpaks/firefox.nix
+++ b/hardening/nixpaks/firefox.nix
@@ -45,9 +45,6 @@ mkNixPak {
         # NOTE: sloth.mkdir is used to create the directory if it does not exist!
         (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
 
-        # ================ for externsions ===============================
-        # required by https://github.com/browserpass/browserpass-extension
-        (sloth.concat' sloth.homeDir "/.local/share/password-store") # pass
         sloth.xdgDownloadDir
         sloth.xdgDocumentsDir
       ];
@@ -56,6 +53,12 @@ mkNixPak {
         "/sys/bus/pci"
         ["${config.app.package}/lib/firefox" "/app/etc/firefox"]
 
+        # ================ for browserpass extension ===============================
+        "/etc/gnupg"
+        (sloth.concat' sloth.homeDir "/.gnupg") # gpg's config
+        (sloth.concat' sloth.homeDir "/.local/share/password-store") # my secrets
+        (sloth.concat' sloth.runtimeDir "/gnupg") # for access gpg-agent socket
+
         # Unsure
         (sloth.concat' sloth.xdgConfigHome "/dconf")
       ];