feat(firefox): softened non-proxy profiles and hardened proxy profiles

apps/firefox/profiles/vpn-proxy.nix

@@ -4,9 +4,6 @@
   id,
   name,
   url,
-  # Add default proxy parameters (can be overridden when imported)
-  proxyHost ? "192.168.68.70",
-  proxyPort ? 8888,
   ...
 }: {
   inherit id name;
@@ -18,37 +15,32 @@
   extensions.force = true;
   extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
     ublock-origin
-    bitwarden
-    tridactyl
-    new-tab-override
-    pywalfox
   ];
 
   settings = {
-    # --- PROXY / VPN CONFIGURATION ---
+    # --- PROXY CONFIGURATION (HTTP & HTTPS) ---
     "network.proxy.type" = 1; # 1 = Manual proxy configuration (0 = Direct, 5 = System)
 
-    # SOCKS5 Proxy Settings (Recommended for VPN tunnels)
-    "network.proxy.socks" = proxyHost;
-    "network.proxy.socks_port" = proxyPort;
-    "network.proxy.socks_version" = 5;
+    # HTTP Proxy Settings
+    "network.proxy.http" = myConfig.proxy.ip;
+    "network.proxy.http_port" = myConfig.proxy.port;
 
-    # CRITICAL: Prevent DNS leaks by forcing DNS queries through the SOCKS proxy
-    "network.proxy.socks_remote_dns" = true;
-    "network.proxy.proxy_over_tls" = true;
+    # HTTPS / SSL Proxy Settings (Routing HTTPS through the same HTTP proxy)
+    "network.proxy.ssl" = myConfig.proxy.ip;
+    "network.proxy.ssl_port" = myConfig.proxy.port;
 
-    # Optional: If using an HTTP/HTTPS proxy instead of SOCKS5, uncomment these and comment out SOCKS above:
-    # "network.proxy.http" = proxyHost;
-    # "network.proxy.http_port" = proxyPort;
-    # "network.proxy.ssl" = proxyHost;
-    # "network.proxy.ssl_port" = proxyPort;
+    # Tell Firefox to share these settings across all protocols
+    "network.proxy.share_proxy_settings" = true;
 
-    # Define what should NOT go through the proxy (local addresses)
+    # Define what should NOT go through the proxy (local network addresses)
     "network.proxy.no_proxies_on" = "localhost, 127.0.0.1, ::1, 192.168.0.0/16, 10.0.0.0/8";
 
-    # Fail closed: Do NOT fall back to direct connection if the proxy fails
+    # Fail closed: Do NOT fall back to direct connection if the proxy fails or times out
     "network.proxy.failover_timeout" = 1800;
 
+    # Optional: If your HTTP proxy itself is encrypted over TLS (HTTPS proxying to the server), uncomment:
+    # "network.proxy.proxy_over_tls" = true;
+
     # --- New Tab Override ---
     "extensions.newtaboverride@agenedia.com.url" = url;
     "extensions.newtaboverride@agenedia.com.type" = 1; # URL mode
@@ -56,9 +48,9 @@
     # --- Privacy & Hardening ---
     "browser.contentblocking.category" = "strict";
     "privacy.trackingprotection.enabled" = true;
-    "privacy.resistFingerprinting" = false; # Note: Spoofs timezone and caps FPS to 60
+    "privacy.resistFingerprinting" = true; # Note: Spoofs timezone and caps FPS to 60
     "geo.enabled" = false;
-    "media.peerconnection.enabled" = false; # Prevents WebRTC IP leaks (Essential for VPN use)
+    "media.peerconnection.enabled" = false; # Prevents WebRTC IP leaks
     "network.dns.disablePrefetch" = true;
     "network.prefetch-next" = false;
 
@@ -97,11 +89,14 @@
     "browser.sessionstore.max_tabs_undo" = 0; # Disable undo close tab
 
     # --- DNS over HTTPS ---
-    # Note: When using SOCKS5 remote DNS, Trr (DoH) can conflict or bypass your VPN's internal DNS.
-    # Mode 5 disables DoH explicitly so the SOCKS proxy handles all DNS resolution cleanly.
+    # Mode 5 disables native DoH explicitly. When using an HTTP proxy, standard HTTP requests
+    # send the full URI and HTTPS requests use the CONNECT method with domain names, meaning
+    # DNS resolution is handled directly by the proxy server without local DNS leaks.
     "network.trr.mode" = 5;
+    # --- private ---
+    "browser.privatebrowsing.autostart" = true;
+    "extensions.allowPrivateBrowsingByDefault" = true;
   };
 
-  # Optional: Keep your userChrome block here if you want the autohide UI applied to this profile too
-  # userChrome = '' ... '';
+  # Optional: Append your userChrome = '' ... ''; block here if needed
 }

apps/firefox/profiles/web-app.nix

@@ -29,7 +29,7 @@
     "browser.contentblocking.category" = "strict";
     "privacy.trackingprotection.enabled" = true;
     "privacy.resistFingerprinting" = false; # Note: Spoofs timezone and caps FPS to 60
-    "geo.enabled" = false;
+    "geo.enabled" = true;
     "media.peerconnection.enabled" = false; # Prevents WebRTC IP leaks
     "network.dns.disablePrefetch" = true;
     "network.prefetch-next" = false;