#!/bin/sh

set -euo pipefail

bwrap \
  --symlink usr/lib /lib \
  --symlink usr/lib64 /lib64 \
  --symlink usr/bin /bin \
  --symlink usr/bin /sbin \
  --ro-bind /usr/lib /usr/lib \
  --ro-bind /usr/lib64 /usr/lib64 \
  --ro-bind /usr/bin /usr/bin \
  --ro-bind /usr/lib/firefox /usr/lib/firefox \
  --ro-bind /usr/share/gtk-3.0 /usr/share/gtk-3.0 \
  --ro-bind /usr/share/fontconfig /usr/share/fontconfig \
  --ro-bind /usr/share/fonts /usr/share/fonts \
  --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
  --ro-bind /usr/share/icons /usr/share/icons \
  --ro-bind /usr/share/libdrm /usr/share/libdr \
  --ro-bind /usr/share/icu /usr/share/icu \
  --ro-bind /usr/share/drirc.d /usr/share/drirc.d \
  --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
  --ro-bind /usr/share/glvnd /usr/share/glvnd \
  --ro-bind /usr/share/mime /usr/share/mime \
  --ro-bind /etc/fonts /etc/fonts \
  --ro-bind /etc/localtime /etc/localtime \
  --ro-bind /etc/nsswitch.conf /etc/nsswitch.conf \
  --ro-bind-try /etc/resolv.conf /etc/resolv.conf \
  --ro-bind-try /etc/pipewire /etc/pipewire \
  --ro-bind-try /etc/pulse /etc/pulse \
  --ro-bind-try /etc/xdg /etc/xdg \
  --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
  --ro-bind /etc/ssl /etc/ssl \
  --ro-bind /etc/ca-certificates /etc/ca-certificates \
  --tmpfs /run \
  --ro-bind /run/user/"$(id -u)"/wayland-0 /run/user/"$(id -u)"/wayland-0 \
  --ro-bind /run/user/"$(id -u)"/pipewire-0 /run/user/"$(id -u)"/pipewire-0 \
  --ro-bind /run/user/"$(id -u)"/pulse /run/user/"$(id -u)"/pulse \
  --dev /dev \
  --dev-bind /dev/dri /dev/dri \
  --ro-bind /sys/bus/pci /sys/bus/pci \
  --ro-bind /sys/dev/char /sys/dev/char \
  --ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \
  --proc /proc \
  --tmpfs /tmp \
  --bind /home/tslil/.mozilla /home/tslil/.mozilla \
  --bind /home/tslil/store/downloads /home/tslil/Downloads \
  --unsetenv DBUS_SESSION_BUS_ADDRESS \
  --setenv HOME /home/tslil \
  --setenv GTK_THEME Adwaita:dark \
  --setenv MOZ_ENABLE_WAYLAND 1 \
  --setenv GBM_BACKEND nvidia-drm \
  --setenv __GLX_VENDOR_LIBRARY_NAME nvidia \
  --setenv LIBVA_DRIVER_NAME nvidia \
  --setenv WLR_RENDERER vulkan \
  --setenv PATH /usr/bin \
  --hostname RESTRICTED \
  --unshare-all \
  --share-net \
  --die-with-parent \
  --new-session \
  /usr/bin/firefox