anchor.diff:  in
     mkShell {
       name = "${user}-${name}";
  -    buildInputs = [ bwrap iproute2 shadow slirp4netns curl fakeroot which sysctl procps kmod openvpn pstree utillinux fontconfig coreutils libcap strace ] ++ packages;
  +    buildInputs = [
  +      bwrap iproute2 shadow slirp4netns curl fakeroot which sysctl procps kmod
  +      openvpn pstree utillinux fontconfig coreutils libcap strace nixGL.nixGLDefault
  +    ] ++ packages;
       shellHook = ''
  -      set -e
  -
  -      ${concatMapStringsSep "\n" (m: "[ -f ${m.from} ] || mkdir -p ${m.from}") mounts}
  -
  -      echo 'root:!:0:0::/root:${interactiveShell}' > /home/${user}/.vpn/${name}/passwd
  -      echo '${user}:!:${uid}:${gid}::/home/${user}:${interactiveShell}' >> /home/${user}/.vpn/${name}/passwd
  -      echo > /home/${user}/.vpn/${name}/pid
  -      echo "127.0.0.1 RESTRICTED" > /home/${user}/.vpn/${name}/hosts
  -
  -      bwrap --ro-bind /nix /nix \
  -          --bind /tmp/.X11-unix/X0 /tmp/.X11-unix/X0 --setenv DISPLAY :0 \
  -          --ro-bind /etc/machine-id /etc/machine-id \
  -          --dir /run/user/${uid} \
  -          --ro-bind /run/user/${uid}/pulse /run/user/${uid}/pulse \
  -          --ro-bind /run/user/${uid}/wayland-0 /run/user/${uid}/wayland-0 \
  -          --dev /dev \
  -          --dev-bind /dev/dri /dev/dri \
  -          --dev-bind /dev/net/tun /dev/net/tun \
  -          --ro-bind /sys/dev/char /sys/dev/char \
  -          --proc /proc \
  -          --tmpfs /tmp \
  -          --bind /home/${user}/.vpn/${name}/pid /home/${user}/.pid \
  -          ${concatMapStringsSep " " (m: "--bind ${m.from} ${m.to}") mounts} \
  -          --ro-bind /home/${user}/.vpn/${name}/hosts /etc/hosts \
  -          --ro-bind /home/${user}/.vpn/${name}/passwd /etc/passwd \
  -          --unshare-all \
  -          --share-net \
  -          --hostname RESTRICTED \
  -          --setenv HOME /home/${user} \
  -          --setenv MOZ_ENABLE_WAYLAND 1 \
  -          --setenv FAKEROOTDONTTRYCHOWN 1 \
  -          --setenv FONTCONFIG_FILE ${fontconfig.out}/etc/fonts/fonts.conf \
  -          --setenv XCURSOR_PATH ${gnome.adwaita-icon-theme}/share/icons \
  -          --die-with-parent \
  -          --new-session \
  -          ${script}
  +      ${script}
         exit $?
       '';
     }
  
positive.code: 
      echo $$ >/home/${user}/.pid
  
      sysctl net.ipv6.conf.all.disable_ipv6=1
  
      sleep 1
  
      trap "${stopCmd}" EXIT
  
  
negative.code: , stopCmds ? [ "fakeroot protonvpn disconnect" ]
  , runCmds ? [
    "transmission-daemon --no-portmap --foreground --no-dht -g /home/${user}/.transmission -w /home/${user}/Downloads &"
    "nixGL chromium --no-sandbox --incognito --enable-features=UseOzonePlatform --ozone-platform=wayland http://localhost:9091/transmission/web/"
  ]
  , packages ? [ pkgs.protonvpn-cli pkgs.transmission pkgs.chromium ]
  , mounts ? [
    { from = "/home/${user}/.vpn/${name}/chromium"; to = "/home/${user}/.config/chromium"; }
    { from = "/home/${user}/.vpn/${name}/transmission"; to = "/home/${user}/.config/transmission"; }
    { from = "/home/${user}/.vpn/${name}/Downloads"; to = "/home/${user}/Downloads"; }
    { from = "/home/${user}/.vpn/${name}/.pvpn-cli"; to = "/home/${user}/.pvpn-cli"; }
  