programs: ship snapper

hosts/common/programs/assorted.nix

@@ -177,7 +177,7 @@ in
       "sane-secrets-unlock"
       "sane-sysload"
       "sc-im"
-      # "snapper"
+      "snapper"
       "sops"  # for manually viewing secrets; outside `sane-secrets` (TODO: improve sane-secrets!)
       "speedtest-cli"
       # "ssh-to-age"
@@ -1084,6 +1084,9 @@ in
 
     slurp.sandbox.whitelistWayland = true;
 
+    snapper.sandbox.tryKeepUsers = true;
+    snapper.sandbox.whitelistDbus.system = true;  #< all `snapper` does is speak to the daemon, via dbus
+
     # snapshot camera, based on libcamera
     # TODO: enable dma heaps for more efficient buffer sharing: <https://gitlab.com/postmarketOS/pmaports/-/issues/2789>
     snapshot.sandbox.method = null;  #< TODO: sandbox