system/modules/nixos/programs/browsers/default.nix

153 lines
3.9 KiB
Nix
Raw Normal View History

{ config, pkgs, lib, ... }:
let
cfg = config.local.programs.browsers;
hostAddress = "192.168.7.10";
localAddress = "192.168.7.11";
contPackages =
lib.optional cfg.tor-browser.enable cfg.tor-browser.package
++ lib.optional cfg.librewolf.enable cfg.librewolf.package
++ lib.optional cfg.mullvad-browser.enable cfg.mullvad-browser.package;
hostPackages = lib.flip map contPackages (p:
2024-08-28 18:06:29 +03:00
let
hostRunBrowser = pkgs.writeScript "cont-run-browser" ''
host=browsers.containers
if [ -z "$(ssh-keygen -F $host)" ]; then
ssh-keyscan -H $host >> ~/.ssh/known_hosts
fi
ssh -o PubkeyAuthentication=no kira@$host $@
2024-08-28 18:06:29 +03:00
'';
hostBrowserScript = pkgs.writeScriptBin "${p.meta.mainProgram}" ''
${hostRunBrowser} ${p.meta.mainProgram} $@
'';
in
pkgs.runCommand "${p.meta.mainProgram}" { } ''
mkdir $out
cp -r ${hostBrowserScript}/bin $out/bin
cp -r ${p}/share $out/share
''
);
isEnable = cfg.tor-browser.enable
or cfg.librewolf.enable
or cfg.mullvad-browser.enable;
in
2024-04-16 02:51:46 +03:00
{
imports = [
./tor-browser.nix
./mullvad-browser.nix
./librewolf.nix
];
config = lib.mkIf isEnable {
environment.systemPackages = hostPackages;
hardware.pulseaudio = {
systemWide = true;
support32Bit = true;
tcp = {
enable = true;
anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
};
};
networking = {
firewall = {
allowedTCPPorts = [ 4713 ];
2024-08-28 18:06:29 +03:00
allowedTCPPortRanges = [
{ from = 3000; to = 3999; }
{ from = 5000; to = 5999; }
{ from = 8000; to = 9999; }
2024-08-28 18:06:29 +03:00
{ from = 32000; to = 33999; }
];
trustedInterfaces = [ "ve-*" ];
};
nat = {
enable = true;
internalInterfaces = [ "ve-browsers" ];
externalInterface = "wg0";
};
};
containers.browsers = {
autoStart = true;
ephemeral = true;
privateNetwork = true;
inherit hostAddress localAddress;
bindMounts = lib.mkMerge [
{
"/tmp/.X11-unix" = {};
"/etc/ssh/keys" = {
isReadOnly = false;
hostPath = "/persistent/per-machine/browsers/etc/ssh/keys";
};
"/home/kira/Downloads" = {
isReadOnly = false;
hostPath = "/home/jan/downloads/browser";
};
"/run/opengl-driver/lib" = { };
"/run/opengl-driver-32/lib" = { };
}
(lib.mkIf cfg.librewolf.enable {
"/home/kira/.librewolf" = {
isReadOnly = false;
hostPath = "/persistent/per-machine/browsers/home/kira/.librewolf";
};
})
];
config = { pkgs, ... }: {
system.stateVersion = "23.11";
# Inherit configs from host
2024-08-28 18:06:29 +03:00
networking.hosts = lib.mkMerge [
config.networking.hosts
{ "${hostAddress}" = [ "host" ]; }
];
fonts = {
inherit (config.fonts) enableDefaultPackages packages;
fontconfig = { inherit (config.fonts.fontconfig) defaultFonts; };
};
services.openssh = {
enable = true;
2024-08-28 19:57:02 +03:00
settings = {
PasswordAuthentication = true;
2024-09-05 18:47:51 +03:00
MaxAuthTries = 2;
2024-08-28 19:57:02 +03:00
};
hostKeys = [
{
bits = 4096;
path = "/etc/ssh/keys/ssh_host_rsa_key";
type = "rsa";
}
{
path = "/etc/ssh/keys/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
users.users.kira = {
isNormalUser = true;
home = "/home/kira";
password = "hello";
extraGroups = [ "pulse-access" ];
packages = contPackages;
};
environment.sessionVariables = {
DISPLAY = ":0";
PULSE_SERVER = "tcp:${hostAddress}:4713";
};
};
};
};
2024-04-16 02:51:46 +03:00
}