Separate policy into smaller modules

2 files changed, 135 insertions, 0 deletions

diff --git a/profiles/addons/default.nix b/profiles/addons/default.nix
new file mode 100644
index 0000000..0e1827f
--- /dev/null
+++ b/profiles/addons/default.nix
@@ -0,0 +1,51 @@
+{ lib, fetchurl }:
+
+let
+  # Extension IDs are used as keys, see .applications.gecko.id in manifest.json
+  addon = { id, url, sha256, settings ? null }: {
+    policies = {
+      ExtensionSettings.${id} = {
+        installation_mode = "force_installed";
+        install_url = "file://${fetchurl { inherit url sha256; }}";
+      };
+    } // (lib.optionalAttrs (settings != null) {
+      "3rdparty".Extensions.${id} = settings;
+    });
+  };
+in {
+  # This can be safe-ish, if extension installation is also disabled
+  disableExtensionSignatureChecking.preferences = {
+    xpinstall.signatures.required = false;
+  };
+
+  privacybadger = addon {
+    id = "jid1-MnnxcxisBPnSXQ@jetpack";
+    url = "https://addons.mozilla.org/firefox/downloads/file/3509922/privacy_badger-2020.2.19-an+fx.xpi";
+    sha256 = "1issggv5wl5x3a4p3q8hrhbkhgsdx9f2qzbscg6y6f75yazswc20";
+    settings = {
+      showIntroPage = false;
+    };
+  };
+
+  noscript = addon {
+    id = "{73a6fe31-595d-460b-a920-fcc0f8843232}";
+    url = "https://addons.mozilla.org/firefox/downloads/file/3517653/noscript_security_suite-11.0.15-an+fx.xpi";
+    sha256 = "0gb0a6pp0rj9jpg1094arqvcwxh1rd2m47ijawlidybm29qmyyay";
+  };
+
+  ublock = addon {
+    id = "uBlock0@raymondhill.net";
+    url = "https://addons.mozilla.org/firefox/downloads/file/3509800/ublock_origin-1.25.0-an+fx.xpi";
+    sha256 = "0pyna4c2b2ffh8ifjj4c8ga9b73g37pk432nyinf8majyb1fq6rc";
+    settings.adminSettings = builtins.readFile ./ublock/config.json;
+  };
+
+/*
+  borderify.policies = {
+    ExtensionSettings."borderify@example.com" = {
+      installation_mode = "force_installed";
+      install_url = "file://${../../borderify.xpi}";
+    };
+  };
+*/
+}
diff --git a/profiles/addons/ublock/config.json b/profiles/addons/ublock/config.json
new file mode 100644
index 0000000..67ba236
--- /dev/null
+++ b/profiles/addons/ublock/config.json
@@ -0,0 +1,84 @@
+{
+  "timeStamp": 1583409728051,
+  "version": "1.25.0",
+  "userSettings": {
+    "advancedUserEnabled": true,
+    "alwaysDetachLogger": true,
+    "autoUpdate": true,
+    "cloudStorageEnabled": false,
+    "collapseBlocked": true,
+    "colorBlindFriendly": false,
+    "contextMenuEnabled": true,
+    "dynamicFilteringEnabled": true,
+    "externalLists": "",
+    "firewallPaneMinimized": true,
+    "hyperlinkAuditingDisabled": true,
+    "ignoreGenericCosmeticFilters": false,
+    "largeMediaSize": 50,
+    "parseAllABPHideFilters": true,
+    "prefetchingDisabled": true,
+    "requestLogMaxEntries": 1000,
+    "showIconBadge": true,
+    "tooltipsDisabled": false,
+    "webrtcIPAddressHidden": false
+  },
+  "selectedFilterLists": [
+    "user-filters",
+    "easylist",
+    "easyprivacy",
+    "malware-0",
+    "malware-1",
+    "plowe-0"
+  ],
+  "hiddenSettings": {
+    "allowGenericProceduralFilters": false,
+    "assetFetchTimeout": 30,
+    "autoCommentFilterTemplate": "{{date}} {{origin}}",
+    "autoUpdateAssetFetchPeriod": 120,
+    "autoUpdateDelayAfterLaunch": 180,
+    "autoUpdatePeriod": 7,
+    "blockingProfiles": "11111/#F00 11011/#C0F 11001/#00F 00001",
+    "cacheStorageAPI": "unset",
+    "cacheStorageCompression": true,
+    "cacheControlForFirefox1376932": "no-cache, no-store, must-revalidate",
+    "cnameIgnoreList": "unset",
+    "cnameIgnore1stParty": true,
+    "cnameIgnoreExceptions": true,
+    "cnameIgnoreRootDocument": true,
+    "cnameMaxTTL": 120,
+    "cnameReplayFullURL": false,
+    "cnameUncloak": true,
+    "consoleLogLevel": "unset",
+    "debugScriptlets": false,
+    "debugScriptletInjector": false,
+    "disableWebAssembly": false,
+    "extensionUpdateForceReload": false,
+    "ignoreRedirectFilters": false,
+    "ignoreScriptInjectFilters": false,
+    "filterAuthorMode": false,
+    "loggerPopupType": "popup",
+    "manualUpdateAssetFetchPeriod": 500,
+    "popupFontSize": "unset",
+    "requestJournalProcessPeriod": 1000,
+    "selfieAfter": 3,
+    "strictBlockingBypassDuration": 120,
+    "suspendTabsUntilReady": "unset",
+    "uiFlavor": "unset",
+    "updateAssetBypassBrowserCache": false,
+    "userResourcesLocation": "unset"
+  },
+  "whitelist": [
+    "about-scheme",
+    "chrome-extension-scheme",
+    "chrome-scheme",
+    "moz-extension-scheme",
+    "opera-scheme",
+    "vivaldi-scheme",
+    "wyciwyg-scheme"
+  ],
+  "netWhitelist": "about-scheme\nchrome-extension-scheme\nchrome-scheme\nmoz-extension-scheme\nopera-scheme\nvivaldi-scheme\nwyciwyg-scheme",
+  "dynamicFilteringString": "behind-the-scene * * noop\nbehind-the-scene * inline-script noop\nbehind-the-scene * 1p-script noop\nbehind-the-scene * 3p-script noop\nbehind-the-scene * 3p-frame noop\nbehind-the-scene * image noop\nbehind-the-scene * 3p noop",
+  "urlFilteringString": "",
+  "hostnameSwitchesString": "no-large-media: behind-the-scene false",
+  "userFilters": ""
+}
\ No newline at end of file