Extend browser config and setup automatic snapshots

5 files changed, 121 insertions, 33 deletions

diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix
index 5a6c587..006dd1c 100644
--- a/machines/xnet/default.nix
+++ b/machines/xnet/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 let
   inherit (lib) mkDefault;
 in
diff --git a/machines/xnet/desktop/default.nix b/machines/xnet/desktop/default.nix
index 1e37497..16c6873 100644
--- a/machines/xnet/desktop/default.nix
+++ b/machines/xnet/desktop/default.nix
@@ -2,6 +2,7 @@
 let
   cfg = config.xnet.desktop;
   inherit (lib) mkDefault mkOption mkIf types;
+  inherit (builtins) listToAttrs;
 in
 {
   options.xnet.desktop = {
@@ -28,6 +29,7 @@ in
         gtk = true;
         base = true;
       };
+      xwayland.enable = true;
       extraPackages = with pkgs; [
         foot
         fuzzel
@@ -43,7 +45,6 @@ in
         tigervnc
         waybar
         wl-clipboard
-        xwayland
         zathura
       ];
       extraSessionCommands = ''
@@ -55,8 +56,6 @@ in
       '';
     };
 
-    programs.light.enable = mkDefault true;
-
     qt = {
       enable = true;
       style = "adwaita-dark";
@@ -79,9 +78,60 @@ in
       ];
     };
 
+    programs = {
+      fish.enable = true;
+      light.enable = mkDefault true;
+      direnv = {
+        enable = true;
+        nix-direnv.enable = true;
+      };
+
+      # GTK settings
+      dconf = {
+        enable = true;
+        profiles.user.databases = [{
+          lockAll = true;
+          settings = {
+            "org/gnome/desktop/interface" = {
+              color-scheme = "prefer-dark";
+              gtk-font-name = "System-ui 10";
+              icon-theme = "Pop";
+              theme-name = "Adwaita-dark";
+            };
+          };
+        }];
+      };
+    };
+
+    # Helper for managing dotfiles
+    environment.shellAliases.dots =
+      "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME";
+
+    # Enable yubikey for SSH and more
+    services = {
+      yubikey-agent.enable = true;
+      pcscd.enable = true;
+      udev.packages = with pkgs; [ yubikey-personalization ];
+    };
+
     programs.firefox = {
       enable = true;
+      preferences = {
+        # Enable hardware transcoding
+        "media.ffmpeg.vaapi.enabled" = true;
+
+        # Enable legacy compact mode
+        "browser.compactmode.show" = true;
+        "browser.uidensity" = 1;
+
+        # Disable ctrl+q closing browser
+        "browser.quitShortcut.disabled" = true;
+
+        # Hardcode theme to dark mode
+        "ui.systemUsesDarkTheme" = 1;
+      };
       policies = {
+        DefaultDownloadDirectory = "/tmp/firefox";
         DisableTelemetry = true;
         DisableFirefoxStudies = true;
         EnableTrackingProtection = {
@@ -90,34 +140,40 @@ in
           Cryptomining = true;
           Fingerprinting = true;
         };
-        DisablePocket = true;
-        DisableFirefoxAccounts = true;
         DisableAccounts = true;
+        DisableFirefoxAccounts = true;
         DisableFirefoxScreenshots = true;
-        OverrideFirstRunPage = "";
-        OverridePostUpdatePage = "";
-        DontCheckDefaultBrowser = true;
+        DisablePocket = true;
         DisplayBookmarksToolbar = "never";
         DisplayMenuBar = "default-off";
-        SearchBar = "unified";
-        ExtensionSettings = {
-          "*".installation_mode = "blocked"; # blocks all addons except the ones specified below
-          # uBlock Origin:
-          "uBlock0@raymondhill.net" = {
-            install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
-            installation_mode = "force_installed";
-          };
-          # Bitwarden:
-          "{446900e4-71c2-419f-a6a7-df9c091e268b}" = {
-            install_url = "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
-            installation_mode = "force_installed";
-          };
-          # Dark Reader:
-          "addon@darkreader.org" = {
-            install_url = "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
-            installation_mode = "force_installed";
-          };
+        DontCheckDefaultBrowser = true;
+        Homepage = {
+          URL = "about:blank";
+          StartPage = "homepage";
         };
+        HttpsOnlyMode = "enabled";
+        DNSOverHTTPS = false;
+        NewTabPage = false;
+        OfferToSaveLogins = false;
+        PasswordManagerEnabled = false;
+        SearchBar = "unified";
+        SearchEngines.Default = "DuckDuckGo";
+        SearchSuggestEnabled = false;
+        ExtensionSettings =
+          let
+            extension = shortId: uuid: {
+              name = uuid;
+              value = {
+                install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
+                installation_mode = "force_installed";
+              };
+            };
+          in
+          listToAttrs [
+            (extension "ublock-origin" "uBlock0@raymondhill.net")
+            (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}")
+            (extension "darkreader" "addon@darkreader.org")
+          ];
       };
     };
   };
diff --git a/machines/xnet/disk.nix b/machines/xnet/disk.nix
index caef61d..26b6909 100644
--- a/machines/xnet/disk.nix
+++ b/machines/xnet/disk.nix
@@ -47,7 +47,7 @@ in
     boot = {
       kernelParams = [ "nohibernate" "elevator=none" ];
       supportedFilesystems = [ "vfat" "zfs" ];
-      zfs.devNodes = "/dev/disk/by-partuuid";
+      zfs.devNodes = mkDefault "/dev/disk/by-partuuid";
       loader = {
         systemd-boot.enable = true;
         efi.canTouchEfiVariables = true;
@@ -135,5 +135,20 @@ in
         };
       };
     };
+
+    services.sanoid = {
+      enable = true;
+      templates.default = {
+        autosnap = true;
+        autoprune = true;
+        hourly = 24;
+        daily = 14;
+        monthly = 1;
+      };
+      datasets."zroot/persist" = {
+        useTemplate = [ "default" ];
+        recursive = true;
+      };
+    };
   };
 }
diff --git a/machines/xnet/nginx.nix b/machines/xnet/nginx.nix
index 64c1d65..eadd794 100644
--- a/machines/xnet/nginx.nix
+++ b/machines/xnet/nginx.nix
@@ -5,7 +5,6 @@ let
   inherit (lib) mkOption mkIf types;
 in
 {
-
   options.xnet.nginx = {
     enable = mkOption {
       type = types.bool;
diff --git a/machines/xnet/users.nix b/machines/xnet/users.nix
index 53aa15b..384cb8c 100644
--- a/machines/xnet/users.nix
+++ b/machines/xnet/users.nix
@@ -2,6 +2,11 @@
 let
   cfg = config.xnet.users;
   inherit (lib) mkOption mkIf types;
+
+  gitKeys = builtins.fetchurl {
+    url = "https://github.com/kbujari.keys";
+    sha256 = "0fpa679zkrpx77vangzf3gnidwvmky8ifivn8411xx6albrikaqx";
+  };
 in
 {
 
@@ -16,9 +21,15 @@ in
   config = {
     users = {
       mutableUsers = false;
+      users.root = {
+        initialHashedPassword = "$y$j9T$eGwGb5tZwhk/.K0Lezsx4/$dJ4AODPBo0RBkVoCh1MVZTtkkDRn/C6A/XQIKt2YBNA";
+        openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile gitKeys);
+      };
       users.kle = mkIf (builtins.elem "kle" cfg.enable) {
-        hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
+        initialHashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
         isNormalUser = true;
+        shell = pkgs.fish;
+        home = "/persist/usr/kle";
         createHome = true;
         extraGroups = [ "wheel" "users" "networkmanager" "video" ];
         packages = with pkgs; [
@@ -29,14 +40,13 @@ in
           lynx
           neovim
           ranger
+          ripgrep
           rsync
           sshfs
           tree
           zip
         ];
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
-        ];
+        openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile gitKeys);
       };
     };
 
@@ -48,16 +58,24 @@ in
     programs.ssh = {
       knownHosts = {
         "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+        "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
+        "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
+        "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
       };
       extraConfig = ''
         Host github
           HostName github.com
           User git
           PreferredAuthentications publickey
+
+        Host ee
+          HostName pascal.ee.ryerson.ca
+          User kbujari
       '';
     };
 
     programs.git = {
+      enable = true;
       config = {
         init.defaultBranch = "master";
         fetch.prune = true;