[Service]
# Force snx-rs to use the flatpak ungoogled-chromium as its SAML browser.
# snx-rs calls `xdg-open <url>` via the `opener` crate. Prepending a private
# PATH dir that contains an `xdg-open` shim makes the daemon find our shim
# first, without affecting xdg-open for any other user process.
#
# Why not the system default browser?  LibreWolf force-upgrades loopback to
# HTTPS and enables LNA blocking, both of which break snx-rs's plain-HTTP
# 127.0.0.1:7779 SAML callback. See firefox/user-overrides.js comments.
Environment=PATH=%h/.local/share/snx-rs/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin