{ lib, config, pkgs, ... }:

let cfg = config.custom.misc.firejail;
in {
  options.custom.misc.firejail = {
    enable = lib.mkEnableOption "Enables firejail";
    package = lib.mkOption {
      type = lib.types.package;
      default = pkgs.firejail;
      description = "Firejail package used";
      readOnly = true; # is a constant from the upstream NixOS module for now
    };
    mk = lib.mkOption {
      readOnly = true;
      description = "Utility function to make a wrappedBinaries entry";
      default = name:
        { pkg, profile ? name, bin ? name }: {
          ${bin} = {
            executable = "${lib.getBin pkg}/bin/${bin}";
            profile =
              "${config.custom.misc.firejail.package}/etc/firejail/${profile}.profile";
          };
        };
    };
  };

  config = lib.mkIf cfg.enable { programs.firejail.enable = true; };
}
