From 9706d4d95d07075da303a941884a6eb3b024c320 Mon Sep 17 00:00:00 2001 From: kenji Date: Sun, 5 Jul 2026 17:24:12 -0500 Subject: [PATCH] feat(firefox): softened non-proxy profiles and hardened proxy profiles --- apps/firefox/default.nix | 7 ++-- apps/firefox/profiles/vpn-proxy.nix | 51 +++++++++++++---------------- apps/firefox/profiles/web-app.nix | 2 +- config.nix | 4 +++ 4 files changed, 32 insertions(+), 32 deletions(-) diff --git a/apps/firefox/default.nix b/apps/firefox/default.nix index 6018a9b..55c60eb 100644 --- a/apps/firefox/default.nix +++ b/apps/firefox/default.nix @@ -11,6 +11,7 @@ bindd = [ "SUPER, W, Open Browser, exec, uwsm app -- firefox" + "SUPER ALT, P, Open Browser, exec, uwsm app -- firefox -P VPN" "SUPER, Y, Toggle YouTube, togglespecialworkspace, youtube" "SUPER SHIFT, Y, Move to YouTube Special Workspace, movetoworkspace, special:youtube" "SUPER, I, Toggle Jellyfin, togglespecialworkspace, jellyfin" @@ -88,7 +89,7 @@ }; vpn-proxy = import ./profiles/vpn-proxy.nix { inherit pkgs myConfig; - id = 2; + id = 4; name = "VPN"; url = "https://browserleaks.com/ip"; }; @@ -119,11 +120,11 @@ settings = { # --- Privacy & Hardening --- "browser.contentblocking.category" = "strict"; - "geo.enabled" = false; + "geo.enabled" = true; "media.peerconnection.enabled" = false; # Prevents WebRTC IP leaks "network.dns.disablePrefetch" = true; "network.prefetch-next" = false; - "privacy.resistFingerprinting" = true; # Note: Spoofs timezone and caps FPS to 60 + "privacy.resistFingerprinting" = false; # Note: Spoofs timezone and caps FPS to 60 "privacy.trackingprotection.enabled" = true; # --- NixOS / Hyprland Integration --- diff --git a/apps/firefox/profiles/vpn-proxy.nix b/apps/firefox/profiles/vpn-proxy.nix index 364adc4..6d4936d 100644 --- a/apps/firefox/profiles/vpn-proxy.nix +++ b/apps/firefox/profiles/vpn-proxy.nix @@ -4,9 +4,6 @@ id, name, url, - # Add default proxy parameters (can be overridden when imported) - proxyHost ? "192.168.68.70", - proxyPort ? 8888, ... }: { inherit id name; @@ -18,37 +15,32 @@ extensions.force = true; extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [ ublock-origin - bitwarden - tridactyl - new-tab-override - pywalfox ]; settings = { - # --- PROXY / VPN CONFIGURATION --- + # --- PROXY CONFIGURATION (HTTP & HTTPS) --- "network.proxy.type" = 1; # 1 = Manual proxy configuration (0 = Direct, 5 = System) - # SOCKS5 Proxy Settings (Recommended for VPN tunnels) - "network.proxy.socks" = proxyHost; - "network.proxy.socks_port" = proxyPort; - "network.proxy.socks_version" = 5; + # HTTP Proxy Settings + "network.proxy.http" = myConfig.proxy.ip; + "network.proxy.http_port" = myConfig.proxy.port; - # CRITICAL: Prevent DNS leaks by forcing DNS queries through the SOCKS proxy - "network.proxy.socks_remote_dns" = true; - "network.proxy.proxy_over_tls" = true; + # HTTPS / SSL Proxy Settings (Routing HTTPS through the same HTTP proxy) + "network.proxy.ssl" = myConfig.proxy.ip; + "network.proxy.ssl_port" = myConfig.proxy.port; - # Optional: If using an HTTP/HTTPS proxy instead of SOCKS5, uncomment these and comment out SOCKS above: - # "network.proxy.http" = proxyHost; - # "network.proxy.http_port" = proxyPort; - # "network.proxy.ssl" = proxyHost; - # "network.proxy.ssl_port" = proxyPort; + # Tell Firefox to share these settings across all protocols + "network.proxy.share_proxy_settings" = true; - # Define what should NOT go through the proxy (local addresses) + # Define what should NOT go through the proxy (local network addresses) "network.proxy.no_proxies_on" = "localhost, 127.0.0.1, ::1, 192.168.0.0/16, 10.0.0.0/8"; - # Fail closed: Do NOT fall back to direct connection if the proxy fails + # Fail closed: Do NOT fall back to direct connection if the proxy fails or times out "network.proxy.failover_timeout" = 1800; + # Optional: If your HTTP proxy itself is encrypted over TLS (HTTPS proxying to the server), uncomment: + # "network.proxy.proxy_over_tls" = true; + # --- New Tab Override --- "extensions.newtaboverride@agenedia.com.url" = url; "extensions.newtaboverride@agenedia.com.type" = 1; # URL mode @@ -56,9 +48,9 @@ # --- Privacy & Hardening --- "browser.contentblocking.category" = "strict"; "privacy.trackingprotection.enabled" = true; - "privacy.resistFingerprinting" = false; # Note: Spoofs timezone and caps FPS to 60 + "privacy.resistFingerprinting" = true; # Note: Spoofs timezone and caps FPS to 60 "geo.enabled" = false; - "media.peerconnection.enabled" = false; # Prevents WebRTC IP leaks (Essential for VPN use) + "media.peerconnection.enabled" = false; # Prevents WebRTC IP leaks "network.dns.disablePrefetch" = true; "network.prefetch-next" = false; @@ -97,11 +89,14 @@ "browser.sessionstore.max_tabs_undo" = 0; # Disable undo close tab # --- DNS over HTTPS --- - # Note: When using SOCKS5 remote DNS, Trr (DoH) can conflict or bypass your VPN's internal DNS. - # Mode 5 disables DoH explicitly so the SOCKS proxy handles all DNS resolution cleanly. + # Mode 5 disables native DoH explicitly. When using an HTTP proxy, standard HTTP requests + # send the full URI and HTTPS requests use the CONNECT method with domain names, meaning + # DNS resolution is handled directly by the proxy server without local DNS leaks. "network.trr.mode" = 5; + # --- private --- + "browser.privatebrowsing.autostart" = true; + "extensions.allowPrivateBrowsingByDefault" = true; }; - # Optional: Keep your userChrome block here if you want the autohide UI applied to this profile too - # userChrome = '' ... ''; + # Optional: Append your userChrome = '' ... ''; block here if needed } diff --git a/apps/firefox/profiles/web-app.nix b/apps/firefox/profiles/web-app.nix index f2183b8..d46feb4 100644 --- a/apps/firefox/profiles/web-app.nix +++ b/apps/firefox/profiles/web-app.nix @@ -29,7 +29,7 @@ "browser.contentblocking.category" = "strict"; "privacy.trackingprotection.enabled" = true; "privacy.resistFingerprinting" = false; # Note: Spoofs timezone and caps FPS to 60 - "geo.enabled" = false; + "geo.enabled" = true; "media.peerconnection.enabled" = false; # Prevents WebRTC IP leaks "network.dns.disablePrefetch" = true; "network.prefetch-next" = false; diff --git a/config.nix b/config.nix index 153e057..a72f1a7 100644 --- a/config.nix +++ b/config.nix @@ -1,6 +1,10 @@ { hakase = { myConfig = { + proxy = { + ip = "192.168.68.70"; + port = "8634"; + }; font = { monospace = "MonoLisa"; monospaceScript = "MonoLisa Italic @ss02=1";