diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 7e38e205..ada984c7 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -18,6 +18,7 @@ let ]; privateModules = [ ./profiles/archiving.nix + ./profiles/browsers.nix ./profiles/desktop.nix ./profiles/dev.nix ./profiles/filesystem.nix diff --git a/modules/nixos/profiles/browsers.nix b/modules/nixos/profiles/browsers.nix new file mode 100644 index 00000000..ac215b06 --- /dev/null +++ b/modules/nixos/profiles/browsers.nix @@ -0,0 +1,141 @@ +# Browsers for your enterprise needs (seriously though, they're configured +# differently and typically for "enterprise" use cases in mind and what I mean +# "enterprise" is for all of the users which is me, myself, and I). +{ config, options, lib, pkgs, ... }: + +let + cfg = config.profiles.browsers; +in +{ + options.profiles.browsers = { + firefox.enable = lib.mkEnableOption "Firefox and its fixed configuration"; + chromium.enable = lib.mkEnableOption "Chromium and its fixed configuration"; + }; + + config = lib.mkMerge [ + (lib.mkIf cfg.chromium.enable { + programs.chromium = { + enable = true; + + # Unlike the user-specific browser configuration, we're just + # considering the bare minimum set of preferred extensions. + extensions = [ + "dbepggeogbaibhgnhhndojpepiihcmeb" # Vimium + "jfnifeihccihocjbfcfhicmmgpjicaec" # GSConnect + "aapbdbdomjkkjkaonfhkkikfgjllcleb" # Google Translate + "fpnmgdkabkmnadcjpehmlllkndpkmiak" # Wayback Machine + ]; + + extraOpts = { + AutofillAddressEnabled = false; + AutofillCreditCardEnabled = false; + BrowserSignIn = 0; + ColorCorrectionEnabled = true; + CursorHighlightEnabled = true; + PasswordManagerEnabled = false; + }; + }; + }) + + (lib.mkIf cfg.firefox.enable { + programs.firefox = { + enable = true; + + policies = { + AppAutoUpdate = false; + DisableAppUpdate = true; + DisableMasterPasswordCreation = true; + DisablePocket = true; + DisableSetDesktopBackground = true; + DontCheckDefaultBrowser = true; + + ExtensionSettings = + let + mozillaAddon = id: "https://addons.mozilla.org/firefox/downloads/latest/${id}/latest.xpi"; + + # Unlike the user-specific browser configuration, we're just + # considering the bare minimum set of preferred extensions. + extensions = { + "@contain-facebook".install_url = mozillaAddon "facebook-container"; + "@testpilot-containers".install_url = mozillaAddon "multi-account-containers"; + "firefox-translations-addon@mozilla.org".install_url = mozillaAddon "firefox-translations"; + "jid1-MnnxcxisBPnSXQ@jetpack".install_url = mozillaAddon "privacy-badger17"; + "uBlock0@raymondhill.net".install_url = mozillaAddon "ublock-origin"; + "wayback_machine@mozilla.org" = { + install_url = mozillaAddon "wayback-machine_new"; + default_area = "navbar"; + }; + }; + + applyInstallationMode = name: value: + lib.nameValuePair name (value // + (lib.optionalAttrs (value.installation_mode != "") { + installation_mode = "normal_installed"; + })); + in + lib.mapAttrs' applyInstallationMode extensions; + + FirefoxHome = { + Highlights = false; + Pocket = false; + Snippets = false; + SponsporedPocket = false; + SponsporedTopSites = false; + }; + NoDefaultBookmarks = true; + OfferToSaveLoginsDefault = false; + PasswordManagerEnabled = false; + SanitizeOnShutdown = { + FormData = true; + }; + UseSystemPrintDialog = true; + UserMessaging = { + ExtensionRecommendations = false; + SkipOnboarding = true; + }; + }; + + # These are the more situational but we'll consider the most likely to + # be used. + nativeMessagingHosts = { + ff2mpv = true; + fxCast = true; + tridactyl = true; + }; + + preferences = { + # Disable the UI tour. + "browser.uitour.enabled" = false; + + # Don't tease me with the updates, man. + "apps.update.auto" = false; + + # Some inconveniences of life (at least for me). + "extensions.pocket.enabled" = false; + "signon.rememberSignons" = false; + + # Some quality of lifes. + "browser.search.widget.inNavBar" = true; + "browser.search.openintab" = true; + + # Some privacy settings... + "privacy.donottrackheader.enabled" = true; + "privacy.trackingprotection.enabled" = true; + + # Burn our own fingers. + "privacy.resistFingerprinting" = true; + "privacy.fingerprintingProtection" = true; + "privacy.fingerprintingProtection.pbmode" = true; + + "privacy.query_stripping.enabled" = true; + "privacy.query_stripping.enabled.pbmode" = true; + + "dom.security.https_first" = true; + "dom.security.https_first_pbm" = true; + + "privacy.firstparty.isolate" = true; + }; + }; + }) + ]; +}