sway: lift waybar to own file and sandbox it

hosts/common/programs/default.nix

@@ -86,6 +86,7 @@
     ./tor-browser.nix
     ./tuba.nix
     ./vlc.nix
+    ./waybar.nix
     ./waylock.nix
     ./wike.nix
     ./wine.nix

hosts/common/programs/waybar.nix

@@ -0,0 +1,25 @@
+{ config, ... }:
+let
+  cfg = config.sane.programs.waybar;
+in
+{
+  sane.programs.waybar = {
+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.net = "all";  #< to show net connection status and BW
+    sandbox.whitelistDbus = [ "user" ];
+    sandbox.whitelistWayland = true;
+    sandbox.extraRuntimePaths = [ "/" ];  #< needs to talk to sway IPC. TODO: give the sway IPC a predictable name.
+    sandbox.extraHomePaths = [ ".config/waybar" ];  #< TODO: migrate config files to this file and then safe to remove
+
+    services.waybar = {
+      description = "sway header bar";
+      wantedBy = [ "graphical-session.target" ];
+      serviceConfig.ExecStart = "${cfg.package}/bin/waybar";
+      serviceConfig.Type = "simple";
+      serviceConfig.Restart = "on-failure";
+      serviceConfig.RestartSec = "10s";
+      # environment.G_MESSAGES_DEBUG = "all";
+    };
+  };
+}

hosts/modules/gui/sway/default.nix

@@ -121,6 +121,7 @@ in
         description = "command to run when user wants to take a screenshot";
       };
     };
+    # TODO: move to hosts/common/programs/waybar.nix
     sane.gui.sway.waybar.extra_style = mkOption {
       type = types.lines;
       default = ''

hosts/modules/gui/sway/sway-config

@@ -141,10 +141,6 @@ mode "resize" {
   bindsym l resize grow width 30 px
 }
 
-bar {
-  swaybar_command waybar
-}
-
 ### application-specific settings
 #### to obtain app-id's run `swaymsg -t get_tree`
 for_window [app_id="pinentry-.*"] floating true