xdg-desktop-portal: ship Nautilus instead of gnome

hosts/common/programs/default.nix

@@ -209,6 +209,7 @@
     ./xdg-desktop-portal.nix
     ./xdg-desktop-portal-gnome
     ./xdg-desktop-portal-gtk.nix
+    ./xdg-desktop-portal-nautilus.nix
     ./xdg-desktop-portal-wlr.nix
     ./xdg-terminal-exec.nix
     ./xdg-utils.nix

hosts/common/programs/sway/default.nix

@@ -192,7 +192,7 @@ in
       # - org.freedesktop.impl.portal.Screenshot
       # - org.freedesktop.impl.portal.Settings
       # - org.freedesktop.impl.portal.Wallpaper
-      "xdg-desktop-portal-gnome"
+      # "xdg-desktop-portal-gnome"
       # xdg-desktop-portal-gtk provides portals for:
       # - org.freedesktop.impl.portal.Access
       # - org.freedesktop.impl.portal.Account
@@ -211,6 +211,9 @@ in
       # xdg-desktop-portal-wlr provides portals for:
       # - org.freedesktop.impl.portal.ScreenCast
       # - org.freedesktop.impl.portal.Screenshot
+      # xdg-desktop-portal-nautilus provides portals for:
+      # - org.freedesktop.impl.portal.FileChooser
+      "xdg-desktop-portal-nautilus"
       "xdg-desktop-portal-wlr"
       "xdg-terminal-exec"  # used by sway config
     ] ++ [
@@ -248,7 +251,7 @@ in
       # portals.conf docs: <https://flatpak.github.io/xdg-desktop-portal/docs/portals.conf.html>
       #
       # $interface=<impl list>
-      # impl_list=(gtk|gnome|wlr|*|none)
+      # impl_list=(gtk|gnome|wlr|...|*|none)
       #   where `none` means "don't provide an impl for this interface"
       #   where `*` means use the first impl found, in lexicographic order
       #
@@ -260,7 +263,8 @@ in
       # XXX(2024-12-04): gnome Access portal simply doesn't render on non-Gnome DEs
       org.freedesktop.impl.portal.Access=gtk
       # XXX(2024-12-04): the gnome file-chooser (libadwaita) is much more mobile-friendly than the gtk ones
-      org.freedesktop.impl.portal.FileChooser=gnome
+      #   it turns out xdg-desktop-portal-gnome is just a shim around nautilus, so we can just call that directly
+      org.freedesktop.impl.portal.FileChooser=nautilus
 
     '';
 

hosts/common/programs/xdg-desktop-portal-nautilus.nix

@@ -0,0 +1,66 @@
+{ pkgs, ... }:
+{
+  sane.programs.xdg-desktop-portal-nautilus = {
+    packageUnwrapped = pkgs.rmDbusServices (pkgs.nautilus.overrideAttrs (upstream: {
+      preConfigure = (upstream.preConfigure or "") + ''
+        cp data/icons/hicolor/scalable/apps/org.gnome.Nautilus.svg data/icons/hicolor/scalable/apps/org.gnome.NautilusPortal.svg
+      '';
+
+      postInstall = (upstream.postInstall or "") + ''
+        mkdir -p $out/share/xdg-desktop-portal/portals
+        cat > $out/share/xdg-desktop-portal/portals/nautilus.portal <<EOF
+        [portal]
+        DBusName=org.gnome.NautilusPortal
+        Interfaces=org.freedesktop.impl.portal.FileChooser
+        EOF
+      '';
+
+      # define a "profile", which changes the app id/dbus name so that we don't conflict with any other
+      # instances of Nautilus that happen to be running on the system
+      mesonFlags = (upstream.mesonFlags or []) ++ [
+        "-Dprofile=Portal"
+      ];
+    }));
+
+    sandbox.whitelistDbus = [ "user" ];  # to receive requests from xdg-desktop-portal
+    sandbox.whitelistWayland = true;
+
+    sandbox.extraHomePaths = [
+      # grant access to pretty much everything, except for secret keys.
+      "/"
+      ".persist/ephemeral"
+      ".persist/plaintext"
+      "Pictures/Photos"
+      "Pictures/Screenshots"
+      "Pictures/albums"
+      "Pictures/cat"
+      "Pictures/from"
+      "Videos/local"
+      "archive"
+      "knowledge"
+      "nixos"
+      "records"
+      "tmp"
+    ];
+    sandbox.extraPaths = [
+      "/boot"
+      "/mnt/desko"
+      "/mnt/lappy"
+      "/mnt/moby"
+      "/mnt/servo"
+      # "nix"
+      "/run/media"  # for mounted devices
+      "/tmp"
+      "/var"
+    ];
+
+    services.xdg-desktop-portal-nautilus = {
+      description = "xdg-desktop-portal-nautilus backend (provides file chooser for xdg-desktop-portal)";
+      dependencyOf = [ "xdg-desktop-portal" ];
+
+      # NAUTILUS_PERSIST, else --gapplication-service means nautilus exits after 10s of inactivity
+      command = "env NAUTILUS_PERSIST=1 nautilus --gapplication-service";
+      readiness.waitDbus = "org.gnome.NautilusPortal";
+    };
+  };
+}