Add a web browser tab.

flake.nix

@@ -61,6 +61,19 @@
           # GTK4 + libadwaita, the same native UI stack Ghostty uses on Linux.
           gtk4
           libadwaita
+
+          # Powers the web panes. The 6.0 ABI is the GTK4 build of WebKitGTK;
+          # the 4.x ABIs are GTK3 and would pull in a second, conflicting GTK.
+          webkitgtk_6_0
+
+          # TLS for the web panes. GIO has no TLS backend built in — it loads
+          # one as a module — so without this every https:// page fails with
+          # "TLS support is not available" while http:// still works.
+          glib-networking
+
+          # The GPU stack WebKit's web process renders through. It has to be
+          # this mesa and not the host's — see the shellHook below.
+          mesa
           glib
           gobject-introspection
           pango
@@ -96,8 +109,37 @@
           export VTABS_GSETTINGS_SCHEMA_DIR="${pkgs.gtk4}/share/gsettings-schemas/${pkgs.gtk4.name}/glib-2.0/schemas"
           export VTABS_RUNTIME_DATA_DIRS="${pkgs.gtk4}/share/gsettings-schemas/${pkgs.gtk4.name}:${pkgs.adwaita-icon-theme}/share:${pkgs.hicolor-icon-theme}/share"
 
+          # The GIO module holding the TLS backend. Same story as the schemas:
+          # it is found by path at runtime, so the installer bakes it in too.
+          export VTABS_GIO_MODULE_DIR="${pkgs.glib-networking}/lib/gio/modules"
+
           export GSETTINGS_SCHEMA_DIR="$VTABS_GSETTINGS_SCHEMA_DIR"
           export XDG_DATA_DIRS="$VTABS_RUNTIME_DATA_DIRS:$XDG_DATA_DIRS"
+          export GIO_EXTRA_MODULES="$VTABS_GIO_MODULE_DIR''${GIO_EXTRA_MODULES:+:$GIO_EXTRA_MODULES}"
+
+          # WebKit's web process renders through mesa, and every piece of that
+          # path has to come from the *same* mesa. Two things go wrong on a
+          # non-NixOS host if we leave it alone, and both kill the web process
+          # at startup with "Could not create default EGL display:
+          # EGL_BAD_PARAMETER", leaving web panes permanently blank:
+          #
+          #  - libglvnd falls back to /usr/share/glvnd/egl_vendor.d and loads
+          #    the *host's* mesa as the EGL vendor, while WebKit is linked
+          #    against Nix's libgbm. A GBM device made by one mesa is rejected
+          #    by the other.
+          #  - Nix's libgbm looks for its backend in /run/opengl-driver/lib/gbm,
+          #    a path that only exists on NixOS.
+          #
+          # Pointing all three at this mesa keeps the stack self-consistent.
+          # It still uses the real GPU through /dev/dri; this is not a
+          # software-rendering fallback.
+          export VTABS_EGL_VENDOR_DIR="${pkgs.mesa}/share/glvnd/egl_vendor.d"
+          export VTABS_DRI_DRIVERS_PATH="${pkgs.mesa}/lib/dri"
+          export VTABS_GBM_BACKENDS_PATH="${pkgs.mesa}/lib/gbm"
+
+          export __EGL_VENDOR_LIBRARY_DIRS="$VTABS_EGL_VENDOR_DIR"
+          export LIBGL_DRIVERS_PATH="$VTABS_DRI_DRIVERS_PATH"
+          export GBM_BACKENDS_PATH="$VTABS_GBM_BACKENDS_PATH"
         '';
       };
     });