add a nix package

the nix output includes a .xpi file which can be manually
linked into the Firefox addon directory.
this .xpi file lacks a META-INF directory. i don't know what that is
yet, so hopefully firefox won't care.

flake.nix

@@ -0,0 +1,54 @@
+{
+  description = "TODO";
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-22.05";
+    flake-utils.url = github:numtide/flake-utils;
+  };
+
+  outputs = { self, nixpkgs, flake-utils  }:
+  with flake-utils.lib; eachSystem allSystems (system:
+    let
+      pkgs = import nixpkgs { inherit system; };
+      lib = pkgs.lib;
+      nativeBuildInputs = with pkgs; [ ];
+    in rec {
+      packages = let
+        pname = "browserpass-extension";
+        version = "3.7.2-next-20221026";
+      in rec {
+        browserpass-extension-yarn-modules = pkgs.mkYarnModules {
+          inherit pname version;
+          packageJSON = ./src/package.json;
+          yarnLock = ./src/yarn.lock;
+        };
+        browserpass-extension = pkgs.stdenv.mkDerivation {
+          inherit pname version;
+          src = ./.;
+
+          patchPhase = ''
+            # dependencies are built externally: skip the yarn install
+            ${pkgs.gnused}/bin/sed -i /yarn\ install/d src/Makefile
+          '';
+
+          preBuild = ''
+            ln -s ${browserpass-extension-yarn-modules}/node_modules src/node_modules
+          '';
+          installPhase = ''
+            BASE=$out/share/mozilla/extensions/\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\}
+            mkdir -p $BASE
+            pushd firefox
+            ${pkgs.zip}/bin/zip -r $BASE/browserpass@maximbaz.com.xpi ./*
+            popd
+          '';
+        };
+      };
+      defaultPackage = packages.browserpass-extension;
+
+      devShells.default = with pkgs; mkShell {
+        buildInputs = nativeBuildInputs ++ [ nodejs yarn ];
+      };
+    }
+  );
+}
+
+