system/modules/nixos/programs/browsers/default.nix

{ config, pkgs, lib, ... }:

let
  cfg = config.local.programs.browsers;

  hostAddress = "192.168.7.10";
  localAddress = "192.168.7.11";

  contPackages =
    lib.optional cfg.tor-browser.enable cfg.tor-browser.package
    ++ lib.optional cfg.librewolf.enable cfg.librewolf.package
    ++ lib.optional cfg.mullvad-browser.enable cfg.mullvad-browser.package;

  hostPackages = lib.flip map contPackages (p:
    let
      hostRunBrowser = pkgs.writeScript "cont-run-browser" ''
        host=browsers.containers
        if [ -z "$(ssh-keygen -F $host)" ]; then
          ssh-keyscan -H $host >> ~/.ssh/known_hosts
        fi
        ssh -o PubkeyAuthentication=no kira@$host $@
      '';

      hostBrowserScript = pkgs.writeScriptBin "${p.meta.mainProgram}" ''
        ${hostRunBrowser} ${p.meta.mainProgram} $@
      '';
    in
    pkgs.runCommand "${p.meta.mainProgram}" { } ''
      mkdir $out
      cp -r ${hostBrowserScript}/bin $out/bin
      cp -r ${p}/share $out/share
    ''
  );

  isEnable = cfg.tor-browser.enable
    or cfg.librewolf.enable
    or cfg.mullvad-browser.enable;
in
{
  imports = [
    ./tor-browser.nix
    ./mullvad-browser.nix
    ./librewolf.nix
  ];

  config = lib.mkIf isEnable {
    environment.systemPackages = hostPackages;

    hardware.pulseaudio = {
      systemWide = true;
      support32Bit = true;
      tcp = {
        enable = true;
        anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
      };
    };

    networking = {
      firewall = {
        allowedTCPPorts = [ 4713 ];
        allowedTCPPortRanges = [
          { from = 3000; to = 3999; }
          { from = 5000; to = 5999; }
          { from = 8000; to = 9999; }
          { from = 32000; to = 33999; }
        ];
        trustedInterfaces = [ "ve-*" ];
      };
      nat = {
        enable = true;
        internalInterfaces = [ "ve-browsers" ];
        externalInterface = "wg0";
      };
    };

    containers.browsers = {
      autoStart = true;
      ephemeral = true;

      privateNetwork = true;
      inherit hostAddress localAddress;

      bindMounts = lib.mkMerge [
        {
          "/tmp/.X11-unix" = {};
          "/etc/ssh/keys" = {
            isReadOnly = false;
            hostPath = "/persistent/per-machine/browsers/etc/ssh/keys";
          };
          "/home/kira/Downloads" = {
            isReadOnly = false;
            hostPath = "/home/jan/downloads/browser";
          };
        }
        (lib.mkIf config.hardware.graphics.enable {
          "/run/opengl-driver/lib" = { };
        })
        (lib.mkIf config.hardware.graphics.enable32Bit {
          "/run/opengl-driver-32/lib" = { };
        })
        (lib.mkIf cfg.librewolf.enable {
          "/home/kira/.librewolf" = {
            isReadOnly = false;
            hostPath = "/persistent/per-machine/browsers/home/kira/.librewolf";
          };
        })
      ];

      config = { pkgs, ... }: {
        system.stateVersion = "23.11";

        # Inherit configs from host
        networking.hosts = lib.mkMerge [
          config.networking.hosts
          { "${hostAddress}" = [ "host" ]; }
        ];
        fonts = {
          inherit (config.fonts) enableDefaultPackages packages;
          fontconfig = { inherit (config.fonts.fontconfig) defaultFonts; };
        };

        services.openssh = {
          enable = true;
          settings = {
            PasswordAuthentication = true;
            MaxAuthTries = 2;
          };
          hostKeys = [
            {
              bits = 4096;
              path = "/etc/ssh/keys/ssh_host_rsa_key";
              type = "rsa";
            }
            {
              path = "/etc/ssh/keys/ssh_host_ed25519_key";
              type = "ed25519";
            }
          ];
        };

        users.users.kira = {
          isNormalUser = true;
          home = "/home/kira";
          password = "hello";
          extraGroups = [ "pulse-access" ];
          packages = contPackages;
        };

        environment.sessionVariables = {
          DISPLAY = ":0";
          PULSE_SERVER = "tcp:${hostAddress}:4713";
        };
      };
    };
  };
}