feat: firefox hardening

SwarselSystems.org

@@ -179,6 +179,8 @@ Set in firefox `about:config > toolkit.legacyUserProfileCustomizations.styleshee
     userChrome = builtins.readFile ../../../programs/firefox/chrome/userChrome.css;
     extensions = with pkgs.nur.repos.rycee.firefox-addons; [
       tridactyl
+      tampermonkey
+      sidebery
       browserpass
       clearurls
       darkreader
@@ -196,9 +198,67 @@ Set in firefox `about:config > toolkit.legacyUserProfileCustomizations.styleshee
       unpaywall
       don-t-fuck-with-paste
       plasma-integration
+      (buildFirefoxXpiAddon {
+        pname = "shortkeys";
+        version = "4.0.2";
+        addonId = "Shortkeys@Shortkeys.com";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3673761/shortkeys-4.0.2.xpi";
+        sha256 = "c6fe12efdd7a871787ac4526eea79ecc1acda8a99724aa2a2a55c88a9acf467c";
+        meta = with lib;
+          {
+            description = "Easily customizable custom keyboard shortcuts for Firefox. To configure this addon go to Addons (ctrl+shift+a) ->Shortkeys ->Options. Report issues here (please specify that the issue is found in Firefox): https://github.com/mikecrittenden/shortkeys";
+            mozPermissions = [
+              "tabs"
+              "downloads"
+              "clipboardWrite"
+              "browsingData"
+              "storage"
+              "bookmarks"
+              "sessions"
+              "<all_urls>"
+            ];
+            platforms = platforms.all;
+          };
+      })
     ];
 
-  search.engines = {
+    settings =
+      {
+        "extensions.autoDisableScopes" = 0;
+        "browser.bookmarks.showMobileBookmarks" = lock-true;
+        "toolkit.legacyUserProfileCustomizations.stylesheets" = lock-true;
+        "browser.search.suggest.enabled" = lock-false;
+        "browser.search.suggest.enabled.private" = lock-false;
+        "browser.urlbar.suggest.searches" = lock-false;
+        "browser.urlbar.showSearchSuggestionsFirst" = lock-false;
+        "browser.topsites.contile.enabled" = lock-false;
+        "browser.newtabpage.activity-stream.feeds.section.topstories" = lock-false;
+        "browser.newtabpage.activity-stream.feeds.snippets" = lock-false;
+        "browser.newtabpage.activity-stream.section.highlights.includePocket" = lock-false;
+        "browser.newtabpage.activity-stream.section.highlights.includeBookmarks" = lock-false;
+        "browser.newtabpage.activity-stream.section.highlights.includeDownloads" = lock-false;
+        "browser.newtabpage.activity-stream.section.highlights.includeVisited" = lock-false;
+        "browser.newtabpage.activity-stream.showSponsored" = lock-false;
+        "browser.newtabpage.activity-stream.system.showSponsored" = lock-false;
+        "browser.newtabpage.activity-stream.showSponsoredTopSites" = lock-false;
+      };
+
+    search = {
+      default = "Kagi";
+      privateDefault = "Kagi";
+      engines = {
+        "Kagi" = {
+          urls = [{
+            template = "https://kagi.com/search";
+            params = [
+              { name = "q"; value = "{searchTerms}"; }
+            ];
+          }];
+          iconUpdateURL = "https://kagi.com/favicon.ico";
+          updateInterval = 24 * 60 * 60 * 1000; # every day
+          definedAliases = [ "@k" ];
+        };
+
         "Nix Packages" = {
           urls = [{
             template = "https://search.nixos.org/packages";
@@ -246,7 +306,8 @@ Set in firefox `about:config > toolkit.legacyUserProfileCustomizations.styleshee
 
         "Google".metaData.alias = "@g";
       };
-  search.force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+      force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+    };
 
 #+end_src
 
@@ -8321,6 +8382,7 @@ I used to build the firefox addon =bypass-paywalls-clean= myself here, but the m
         extensions = with pkgs.nur.repos.rycee.firefox-addons; [
           tridactyl
           tampermonkey
+          sidebery
           browserpass
           clearurls
           darkreader
@@ -9024,8 +9086,17 @@ The rest of the settings is at [[#h:fb3f3e01-7df4-4b06-9e91-aa9cac61a431][gaming
 The rest of the settings is at [[#h:bbf2ecb6-c8ff-4462-b5d5-d45b28604ddf][work]]. Here, I am setting up the different firefox profiles that I need for the SSO sites that I need to access at work as well as a few ssh shorthands.
 
 #+begin_src nix :tangle profiles/optional/home/work.nix :noweb yes
-  { pkgs, ... }:
+  { pkgs, lib, ... }:
-
+  let
+    lock-false = {
+      Value = false;
+      Status = "locked";
+    };
+    lock-true = {
+      Value = true;
+      Status = "locked";
+    };
+  in
   {
     home.packages = with pkgs; [
       stable.teams-for-linux

profiles/common/home/firefox.nix

@@ -149,6 +149,7 @@ in
       extensions = with pkgs.nur.repos.rycee.firefox-addons; [
         tridactyl
         tampermonkey
+        sidebery
         browserpass
         clearurls
         darkreader

profiles/optional/home/work.nix

@@ -1,5 +1,14 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
-
+let
+  lock-false = {
+    Value = false;
+    Status = "locked";
+  };
+  lock-true = {
+    Value = true;
+    Status = "locked";
+  };
+in
 {
   home.packages = with pkgs; [
     stable.teams-for-linux
@@ -62,6 +71,8 @@
           userChrome = builtins.readFile ../../../programs/firefox/chrome/userChrome.css;
           extensions = with pkgs.nur.repos.rycee.firefox-addons; [
             tridactyl
+            tampermonkey
+            sidebery
             browserpass
             clearurls
             darkreader
@@ -79,9 +90,67 @@
             unpaywall
             don-t-fuck-with-paste
             plasma-integration
+            (buildFirefoxXpiAddon {
+              pname = "shortkeys";
+              version = "4.0.2";
+              addonId = "Shortkeys@Shortkeys.com";
+              url = "https://addons.mozilla.org/firefox/downloads/file/3673761/shortkeys-4.0.2.xpi";
+              sha256 = "c6fe12efdd7a871787ac4526eea79ecc1acda8a99724aa2a2a55c88a9acf467c";
+              meta = with lib;
+                {
+                  description = "Easily customizable custom keyboard shortcuts for Firefox. To configure this addon go to Addons (ctrl+shift+a) ->Shortkeys ->Options. Report issues here (please specify that the issue is found in Firefox): https://github.com/mikecrittenden/shortkeys";
+                  mozPermissions = [
+                    "tabs"
+                    "downloads"
+                    "clipboardWrite"
+                    "browsingData"
+                    "storage"
+                    "bookmarks"
+                    "sessions"
+                    "<all_urls>"
+                  ];
+                  platforms = platforms.all;
+                };
+            })
           ];
 
-          search.engines = {
+          settings =
+            {
+              "extensions.autoDisableScopes" = 0;
+              "browser.bookmarks.showMobileBookmarks" = lock-true;
+              "toolkit.legacyUserProfileCustomizations.stylesheets" = lock-true;
+              "browser.search.suggest.enabled" = lock-false;
+              "browser.search.suggest.enabled.private" = lock-false;
+              "browser.urlbar.suggest.searches" = lock-false;
+              "browser.urlbar.showSearchSuggestionsFirst" = lock-false;
+              "browser.topsites.contile.enabled" = lock-false;
+              "browser.newtabpage.activity-stream.feeds.section.topstories" = lock-false;
+              "browser.newtabpage.activity-stream.feeds.snippets" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includePocket" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeBookmarks" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeDownloads" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeVisited" = lock-false;
+              "browser.newtabpage.activity-stream.showSponsored" = lock-false;
+              "browser.newtabpage.activity-stream.system.showSponsored" = lock-false;
+              "browser.newtabpage.activity-stream.showSponsoredTopSites" = lock-false;
+            };
+
+          search = {
+            default = "Kagi";
+            privateDefault = "Kagi";
+            engines = {
+              "Kagi" = {
+                urls = [{
+                  template = "https://kagi.com/search";
+                  params = [
+                    { name = "q"; value = "{searchTerms}"; }
+                  ];
+                }];
+                iconUpdateURL = "https://kagi.com/favicon.ico";
+                updateInterval = 24 * 60 * 60 * 1000; # every day
+                definedAliases = [ "@k" ];
+              };
+
               "Nix Packages" = {
                 urls = [{
                   template = "https://search.nixos.org/packages";
@@ -129,7 +198,8 @@
 
               "Google".metaData.alias = "@g";
             };
-          search.force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+            force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+          };
 
         };
         cl_adm = {
@@ -139,6 +209,8 @@
           userChrome = builtins.readFile ../../../programs/firefox/chrome/userChrome.css;
           extensions = with pkgs.nur.repos.rycee.firefox-addons; [
             tridactyl
+            tampermonkey
+            sidebery
             browserpass
             clearurls
             darkreader
@@ -156,9 +228,67 @@
             unpaywall
             don-t-fuck-with-paste
             plasma-integration
+            (buildFirefoxXpiAddon {
+              pname = "shortkeys";
+              version = "4.0.2";
+              addonId = "Shortkeys@Shortkeys.com";
+              url = "https://addons.mozilla.org/firefox/downloads/file/3673761/shortkeys-4.0.2.xpi";
+              sha256 = "c6fe12efdd7a871787ac4526eea79ecc1acda8a99724aa2a2a55c88a9acf467c";
+              meta = with lib;
+                {
+                  description = "Easily customizable custom keyboard shortcuts for Firefox. To configure this addon go to Addons (ctrl+shift+a) ->Shortkeys ->Options. Report issues here (please specify that the issue is found in Firefox): https://github.com/mikecrittenden/shortkeys";
+                  mozPermissions = [
+                    "tabs"
+                    "downloads"
+                    "clipboardWrite"
+                    "browsingData"
+                    "storage"
+                    "bookmarks"
+                    "sessions"
+                    "<all_urls>"
+                  ];
+                  platforms = platforms.all;
+                };
+            })
           ];
 
-          search.engines = {
+          settings =
+            {
+              "extensions.autoDisableScopes" = 0;
+              "browser.bookmarks.showMobileBookmarks" = lock-true;
+              "toolkit.legacyUserProfileCustomizations.stylesheets" = lock-true;
+              "browser.search.suggest.enabled" = lock-false;
+              "browser.search.suggest.enabled.private" = lock-false;
+              "browser.urlbar.suggest.searches" = lock-false;
+              "browser.urlbar.showSearchSuggestionsFirst" = lock-false;
+              "browser.topsites.contile.enabled" = lock-false;
+              "browser.newtabpage.activity-stream.feeds.section.topstories" = lock-false;
+              "browser.newtabpage.activity-stream.feeds.snippets" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includePocket" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeBookmarks" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeDownloads" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeVisited" = lock-false;
+              "browser.newtabpage.activity-stream.showSponsored" = lock-false;
+              "browser.newtabpage.activity-stream.system.showSponsored" = lock-false;
+              "browser.newtabpage.activity-stream.showSponsoredTopSites" = lock-false;
+            };
+
+          search = {
+            default = "Kagi";
+            privateDefault = "Kagi";
+            engines = {
+              "Kagi" = {
+                urls = [{
+                  template = "https://kagi.com/search";
+                  params = [
+                    { name = "q"; value = "{searchTerms}"; }
+                  ];
+                }];
+                iconUpdateURL = "https://kagi.com/favicon.ico";
+                updateInterval = 24 * 60 * 60 * 1000; # every day
+                definedAliases = [ "@k" ];
+              };
+
               "Nix Packages" = {
                 urls = [{
                   template = "https://search.nixos.org/packages";
@@ -206,7 +336,8 @@
 
               "Google".metaData.alias = "@g";
             };
-          search.force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+            force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+          };
 
         };
         ws_adm = {
@@ -216,6 +347,8 @@
           userChrome = builtins.readFile ../../../programs/firefox/chrome/userChrome.css;
           extensions = with pkgs.nur.repos.rycee.firefox-addons; [
             tridactyl
+            tampermonkey
+            sidebery
             browserpass
             clearurls
             darkreader
@@ -233,9 +366,67 @@
             unpaywall
             don-t-fuck-with-paste
             plasma-integration
+            (buildFirefoxXpiAddon {
+              pname = "shortkeys";
+              version = "4.0.2";
+              addonId = "Shortkeys@Shortkeys.com";
+              url = "https://addons.mozilla.org/firefox/downloads/file/3673761/shortkeys-4.0.2.xpi";
+              sha256 = "c6fe12efdd7a871787ac4526eea79ecc1acda8a99724aa2a2a55c88a9acf467c";
+              meta = with lib;
+                {
+                  description = "Easily customizable custom keyboard shortcuts for Firefox. To configure this addon go to Addons (ctrl+shift+a) ->Shortkeys ->Options. Report issues here (please specify that the issue is found in Firefox): https://github.com/mikecrittenden/shortkeys";
+                  mozPermissions = [
+                    "tabs"
+                    "downloads"
+                    "clipboardWrite"
+                    "browsingData"
+                    "storage"
+                    "bookmarks"
+                    "sessions"
+                    "<all_urls>"
+                  ];
+                  platforms = platforms.all;
+                };
+            })
           ];
 
-          search.engines = {
+          settings =
+            {
+              "extensions.autoDisableScopes" = 0;
+              "browser.bookmarks.showMobileBookmarks" = lock-true;
+              "toolkit.legacyUserProfileCustomizations.stylesheets" = lock-true;
+              "browser.search.suggest.enabled" = lock-false;
+              "browser.search.suggest.enabled.private" = lock-false;
+              "browser.urlbar.suggest.searches" = lock-false;
+              "browser.urlbar.showSearchSuggestionsFirst" = lock-false;
+              "browser.topsites.contile.enabled" = lock-false;
+              "browser.newtabpage.activity-stream.feeds.section.topstories" = lock-false;
+              "browser.newtabpage.activity-stream.feeds.snippets" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includePocket" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeBookmarks" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeDownloads" = lock-false;
+              "browser.newtabpage.activity-stream.section.highlights.includeVisited" = lock-false;
+              "browser.newtabpage.activity-stream.showSponsored" = lock-false;
+              "browser.newtabpage.activity-stream.system.showSponsored" = lock-false;
+              "browser.newtabpage.activity-stream.showSponsoredTopSites" = lock-false;
+            };
+
+          search = {
+            default = "Kagi";
+            privateDefault = "Kagi";
+            engines = {
+              "Kagi" = {
+                urls = [{
+                  template = "https://kagi.com/search";
+                  params = [
+                    { name = "q"; value = "{searchTerms}"; }
+                  ];
+                }];
+                iconUpdateURL = "https://kagi.com/favicon.ico";
+                updateInterval = 24 * 60 * 60 * 1000; # every day
+                definedAliases = [ "@k" ];
+              };
+
               "Nix Packages" = {
                 urls = [{
                   template = "https://search.nixos.org/packages";
@@ -283,7 +474,8 @@
 
               "Google".metaData.alias = "@g";
             };
-          search.force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+            force = true; # this is required because otherwise the search.json.mozlz4 symlink gets replaced on every firefox restart
+          };
 
         };
       };