refactor: nixpak apps

hardening/nixpaks/firefox.nix

@@ -79,12 +79,6 @@ mkNixPak {
         wayland = true;
         pipewire = true;
       };
-      bind.dev = [
-        "/dev/shm" # Shared Memory
-      ];
-      tmpfs = [
-        "/tmp"
-      ];
     };
   };
 }

hardening/nixpaks/modules/gui-base.nix

@@ -72,6 +72,8 @@ in {
         "/etc/static/egl"
       ];
       bind.dev = [
+        "/dev/shm" # Shared Memory
+
         # seems required when using nvidia as primary gpu
         "/dev/nvidia0"
         "/dev/nvidiactl"
@@ -79,6 +81,10 @@ in {
         "/dev/nvidia-uvm"
       ];
 
+      tmpfs = [
+        "/tmp"
+      ];
+
       env = {
         XDG_DATA_DIRS = lib.mkForce (lib.makeSearchPath "share" [
           iconTheme

hardening/nixpaks/qq.nix

@@ -57,12 +57,6 @@ mkNixPak {
         wayland = true;
         pipewire = true;
       };
-      bind.dev = [
-        "/dev/shm" # Shared Memory
-      ];
-      tmpfs = [
-        "/tmp"
-      ];
     };
   };
 }

hardening/nixpaks/wechat-uos.nix

@@ -46,21 +46,17 @@ mkNixPak {
         # given the read write permission to the following directories.
         # NOTE: sloth.mkdir is used to create the directory if it does not exist!
         (sloth.mkdir (sloth.concat [sloth.homeDir "/.xwechat"]))
-        (sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/xwechat_files"]))
-        (sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/WeChat_Data/"]))
+
+        sloth.xdgDocumentsDir
         sloth.xdgDownloadDir
+        sloth.xdgMusicDir
+        sloth.xdgVideosDir
       ];
       sockets = {
         x11 = false;
         wayland = true;
         pipewire = true;
       };
-      bind.dev = [
-        "/dev/shm" # Shared Memory
-      ];
-      tmpfs = [
-        "/tmp"
-      ];
 
       env = {
         # Hidpi scale