From 1acb1455f0bbad09ac5abb87dcfde39cbaa5e575 Mon Sep 17 00:00:00 2001
From: Silas Schöffel <sils@sils.li>
Date: Fri, 7 Jun 2024 16:57:13 +0200
Subject: firejail: wrap firefox with firejail

---
 hm/packages/default.nix         |  1 -
 hm/zsh/default.nix              |  2 ++
 modules/nixos/sils/apparmor.nix | 14 ++++++++++++++
 modules/nixos/sils/default.nix  |  2 ++
 modules/nixos/sils/firejail.nix | 24 ++++++++++++++++++++++++
 modules/nixos/sils/roles.nix    |  2 ++
 6 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 modules/nixos/sils/apparmor.nix
 create mode 100644 modules/nixos/sils/firejail.nix

diff --git a/hm/packages/default.nix b/hm/packages/default.nix
index a3e3071..332c0cb 100644
--- a/hm/packages/default.nix
+++ b/hm/packages/default.nix
@@ -82,7 +82,6 @@ in {
 
     # Browser
     ungoogled-chromium # just in case
-    firefox # my browser
     tor-browser-bundle-bin # tor-browser
     brave # friendly chromium based browser
 
diff --git a/hm/zsh/default.nix b/hm/zsh/default.nix
index a8e5571..684493f 100644
--- a/hm/zsh/default.nix
+++ b/hm/zsh/default.nix
@@ -67,6 +67,8 @@
     # +
     initExtra =
       ''
+        rm -rf ~/.mozilla/firefox/default/containers.json.backup
+
         export ZSH=${pkgs.oh-my-zsh}/share/oh-my-zsh/
           export fpath=("$XDG_DATA_HOME/zsh/site-functions" $fpath)
           HISTFILE="$XDG_STATE_HOME/zsh/history"
diff --git a/modules/nixos/sils/apparmor.nix b/modules/nixos/sils/apparmor.nix
new file mode 100644
index 0000000..69cec21
--- /dev/null
+++ b/modules/nixos/sils/apparmor.nix
@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.sils.apparmor;
+in {
+  options.sils.apparmor.enable = lib.mkEnableOption "apparmor";
+  config = lib.mkIf cfg.enable {
+    security.apparmor = {
+      enable = true;
+    };
+  };
+}
diff --git a/modules/nixos/sils/default.nix b/modules/nixos/sils/default.nix
index a0fe1ac..922d706 100644
--- a/modules/nixos/sils/default.nix
+++ b/modules/nixos/sils/default.nix
@@ -1,8 +1,10 @@
 {...}: {
   imports = [
+    ./apparmor.nix
     ./basesystem.nix
     ./bluetooth.nix
     ./environment.nix
+    ./firejail.nix
     ./font.nix
     ./hyprland.nix
     ./impermanence.nix
diff --git a/modules/nixos/sils/firejail.nix b/modules/nixos/sils/firejail.nix
new file mode 100644
index 0000000..d5df71f
--- /dev/null
+++ b/modules/nixos/sils/firejail.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.sils.firejail;
+in {
+  options.sils.firejail.enable = lib.mkEnableOption "firejail";
+  config = lib.mkIf cfg.enable {
+    sils.apparmor.enable = true;
+    programs.firejail = {
+      enable = true;
+      wrappedBinaries = {
+        firefox = {
+          executable = "${lib.getExe pkgs.firefox}"; # config.home-manager.users.sils.programs.firefox.package}";
+          profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
+        };
+      };
+    };
+
+    home-manager.users.sils.programs.firefox.package = null;
+  };
+}
diff --git a/modules/nixos/sils/roles.nix b/modules/nixos/sils/roles.nix
index 94511b9..a6c1d36 100644
--- a/modules/nixos/sils/roles.nix
+++ b/modules/nixos/sils/roles.nix
@@ -4,9 +4,11 @@ in {
   config.sils =
     if roleCmp "laptop"
     then {
+      apparmor.enable = true;
       basesystem.enable = true;
       bluetooth.enable = true;
       environment.enable = true;
+      firejail.enable = true;
       font.enable = true;
       hyprland.enable = true;
       impermanence.enable = true;
-- 
cgit 1.4.1