firejail: wrap firefox with firejail

4 files changed, 42 insertions, 0 deletions

diff --git a/modules/nixos/sils/apparmor.nix b/modules/nixos/sils/apparmor.nix
new file mode 100644
index 0000000..69cec21
--- /dev/null
+++ b/modules/nixos/sils/apparmor.nix
@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.sils.apparmor;
+in {
+  options.sils.apparmor.enable = lib.mkEnableOption "apparmor";
+  config = lib.mkIf cfg.enable {
+    security.apparmor = {
+      enable = true;
+    };
+  };
+}
diff --git a/modules/nixos/sils/default.nix b/modules/nixos/sils/default.nix
index a0fe1ac..922d706 100644
--- a/modules/nixos/sils/default.nix
+++ b/modules/nixos/sils/default.nix
@@ -1,8 +1,10 @@
 {...}: {
   imports = [
+    ./apparmor.nix
     ./basesystem.nix
     ./bluetooth.nix
     ./environment.nix
+    ./firejail.nix
     ./font.nix
     ./hyprland.nix
     ./impermanence.nix
diff --git a/modules/nixos/sils/firejail.nix b/modules/nixos/sils/firejail.nix
new file mode 100644
index 0000000..d5df71f
--- /dev/null
+++ b/modules/nixos/sils/firejail.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.sils.firejail;
+in {
+  options.sils.firejail.enable = lib.mkEnableOption "firejail";
+  config = lib.mkIf cfg.enable {
+    sils.apparmor.enable = true;
+    programs.firejail = {
+      enable = true;
+      wrappedBinaries = {
+        firefox = {
+          executable = "${lib.getExe pkgs.firefox}"; # config.home-manager.users.sils.programs.firefox.package}";
+          profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
+        };
+      };
+    };
+
+    home-manager.users.sils.programs.firefox.package = null;
+  };
+}
diff --git a/modules/nixos/sils/roles.nix b/modules/nixos/sils/roles.nix
index 94511b9..a6c1d36 100644
--- a/modules/nixos/sils/roles.nix
+++ b/modules/nixos/sils/roles.nix
@@ -4,9 +4,11 @@ in {
   config.sils =
     if roleCmp "laptop"
     then {
+      apparmor.enable = true;
       basesystem.enable = true;
       bluetooth.enable = true;
       environment.enable = true;
+      firejail.enable = true;
       font.enable = true;
       hyprland.enable = true;
       impermanence.enable = true;