modules/browsers: move all browsers to the container

hosts/asus-gl553vd/configs/imp.nix

@@ -46,6 +46,7 @@
         "/var/lib/nixos"
         "/var/lib/systemd/coredump"
         "/etc/NetworkManager/system-connections"
+        "/etc/ssh/per-machine"
       ];
       files = [
         "/etc/machine-id"
@@ -66,5 +67,11 @@
       ];
       files = [ "/var/lib/docker/engine-id" ];
     };
+    "/presistent/ollama" = lib.mkIf config.services.ollama.enable {
+      hideMounts = true;
+      directories  = [
+        "/var/lib/private/ollama"
+      ];
+    };
   };
 }

hosts/asus-gl553vd/configuration.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
   imports = [
@@ -27,4 +27,8 @@
   # Programs
   ################################################################################
   local.programs.browsers.tor-browser.enable = true;
+
+  environment.shellInit = ''
+    [ -n "$DISPLAY" ] && ${pkgs.xorg.xhost}/bin/xhost +si:localuser:$USER > /dev/null || true
+  '';
 }

modules/nixos/programs/browsers/default.nix

@@ -1,8 +1,126 @@
-{ ... }:
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.local.programs.browsers;
+
+  hostAddress = "192.168.7.10";
+  localAddress = "192.168.7.11";
+
+  hostRunBrowser = pkgs.writeScript "run-browser" ''
+    host=browsers.containers
+    if [ -z "$(ssh-keygen -F $host)" ]; then
+      ssh-keyscan -H $host >> ~/.ssh/known_hosts
+    fi
+    ssh -o PubkeyAuthentication=no kira@$host $@
+  '';
+
+  contPackages =
+    lib.optional cfg.tor-browser.enable cfg.tor-browser.package
+    ++ lib.optional cfg.librewolf.enable cfg.librewolf.package
+    ++ lib.optional cfg.mullvad-browser.enable cfg.mullvad-browser.package;
+
+  hostPackages = lib.flip map contPackages (p:
+    pkgs.writeScriptBin "${p.meta.mainProgram}" ''
+      ${hostRunBrowser} ${p.meta.mainProgram}
+    ''
+  );
+
+  isEnable = cfg.tor-browser.enable
+    or cfg.librewolf.enable
+    or cfg.mullvad-browser.enable;
+in
 {
   imports = [
     ./tor-browser.nix
     ./mullvad-browser.nix
     ./librewolf.nix
   ];
+
+  config = lib.mkIf isEnable {
+    environment.systemPackages = hostPackages;
+
+    hardware.pulseaudio = {
+      systemWide = true;
+      support32Bit = true;
+      tcp = {
+        enable = true;
+        anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
+      };
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 4713 ];
+        trustedInterfaces = [ "ve-*" ];
+      };
+      nat = {
+        enable = true;
+        internalInterfaces = [ "ve-browsers" ];
+        externalInterface = "wg0";
+      };
+    };
+
+    containers.browsers = {
+      autoStart = true;
+      ephemeral = true;
+
+      privateNetwork = true;
+      inherit hostAddress localAddress;
+
+      bindMounts = lib.mkMerge [
+        {
+          "/tmp/.X11-unix" = { };
+          "/etc/ssh/keys" = {
+            isReadOnly = false;
+            hostPath = "/etc/ssh/per-machine/browsers";
+          };
+          "/home/kira/Downloads" = {
+            isReadOnly = false;
+            hostPath = "/home/jan/downloads/browser";
+          };
+        }
+        (lib.mkIf cfg.librewolf.enable {
+          "/home/kira/.librewolf" = {
+            isReadOnly = false;
+            hostPath = "/home/jan/.librewolf";
+          };
+        })
+      ];
+
+      config = { pkgs, ... }: {
+        system.stateVersion = "23.11";
+
+        services.openssh = {
+          enable = true;
+          settings.PasswordAuthentication = true;
+          hostKeys = [
+            {
+              bits = 4096;
+              path = "/etc/ssh/keys/ssh_host_rsa_key";
+              type = "rsa";
+            }
+            {
+              path = "/etc/ssh/keys/ssh_host_ed25519_key";
+              type = "ed25519";
+            }
+          ];
+        };
+
+        users.users.kira = {
+          isNormalUser = true;
+          home = "/home/kira";
+          password = "hello";
+          extraGroups = [ "pulse-access" ];
+          packages = contPackages;
+        };
+
+        environment.sessionVariables = {
+          DISPLAY = ":0";
+          PULSE_SERVER = "tcp:${hostAddress}:4713";
+          XAUTHORITY = "/home/kira/.Xauthority";
+          DBUS_SESSION_BUS_ADDRESS = "";
+        };
+      };
+    };
+  };
 }

modules/nixos/programs/browsers/librewolf.nix

@@ -1,7 +1,6 @@
 { config, pkgs, lib, inputs, ... }:
 
 let
-  cfg = config.local.programs.browsers.librewolf;
   isPassEnabled = config.local.programs.pass.enable;
 
   policiesJson = pkgs.callPackage ./policies.nix {
@@ -20,9 +19,6 @@ in
 {
   options.local.programs.browsers.librewolf = with lib; {
     enable = mkEnableOption "librewolf";
-  };
+    package = mkPackageOption pkgs "librewolf" {} // { default = librewolf'; };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ librewolf' ];
   };
 }

modules/nixos/programs/browsers/mullvad-browser.nix

@@ -1,8 +1,6 @@
-{ config, pkgs, lib, inputs, ... }:
+{ pkgs, lib, inputs, ... }:
 
 let
-  cfg = config.local.programs.browsers.mullvad-browser;
-
   policiesJson = pkgs.callPackage ./policies.nix {
     firefoxAddons = inputs.firefox-addons.packages."${pkgs.system}";
     withRedirectorAddon = true;
@@ -21,9 +19,6 @@ in
 {
   options.local.programs.browsers.mullvad-browser = with lib; {
     enable = mkEnableOption "mullvad-browser";
-  };
+    package = mkPackageOption pkgs "mullvad-browser" {} // { default = mullvadBrowser; };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ mullvadBrowser ];
   };
 }

modules/nixos/programs/browsers/policies.nix

@@ -28,7 +28,7 @@ writeText "policies.json" (builtins.toJSON {
     SearchEngines = {
       Add = [
         {
-          Alias = "sx";
+          Alias = "@sx";
           Name = "SearXNG";
           Description = "SearXNG — a privacy-respecting, open metasearch engine";
           IconURL = "https://search.sapti.me/static/themes/simple/img/favicon.png";
@@ -36,28 +36,28 @@ writeText "policies.json" (builtins.toJSON {
         }
       ] ++ lib.optionals withAllSearchEngines [
         {
-          Alias = "np";
+          Alias = "@np";
           Name = "NixOS Packages";
           Description = "Search NixOS packages by name or description.";
           IconURL = "https://nixos.org/favicon.png";
           URLTemplate = "https://search.nixos.org/packages?query={searchTerms}";
         }
         {
-          Alias = "no";
+          Alias = "@no";
           Name = "NixOS Options";
           Description = "Search NixOS options by name or description.";
           IconURL = "https://nixos.org/favicon.png";
           URLTemplate = "https://search.nixos.org/options?query={searchTerms}";
         }
         {
-          Alias = "ng";
+          Alias = "@ng";
           Name = "Noogle";
           Description = "Search for nix functions by name.";
           IconURL = "https://noogle.dev/favicon.png";
           URLTemplate = "https://noogle.dev/q?term={searchTerms}";
         }
         {
-          Alias = "hg";
+          Alias = "@hg";
           Name = "Hoogle";
           Description = ''
               Hoogle is a Haskell API search engine, which allows you to

modules/nixos/programs/browsers/tor-browser.nix

@@ -1,8 +1,6 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
 let
-  cfg = config.local.programs.browsers.tor-browser;
-
   policiesJson = pkgs.callPackage ./policies.nix { };
 
   torBrowser = (pkgs.tor-browser-bundle-bin.override {
@@ -14,77 +12,10 @@ let
       install -Dvm644 ${policiesJson} $out/share/tor-browser/distribution/policies.json
     '';
   });
-
-  hostRunTorBrowser = pkgs.writeScriptBin "tor-browser" ''
-    ${pkgs.xorg.xhost}/bin/xhost +local:
-    ssh -X browser@${config.containers.browser.localAddress} tor-browser
-    ${pkgs.xorg.xhost}/bin/xhost -local:
-  '';
 in
 {
   options.local.programs.browsers.tor-browser = with lib; {
     enable = mkEnableOption "tor-browser";
-  };
+    package = mkPackageOption pkgs "tor-browser-bundle-bin" {} // { default = torBrowser; };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ hostRunTorBrowser ];
-
-    hardware.pulseaudio = {
-      systemWide = true;
-      support32Bit = true;
-      tcp = {
-        enable = true;
-        anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
-      };
-    };
-
-    /*
-        networking = {
-          firewall.allowedTCPPorts = [ 4713 6000 ];
-          nat = {
-            enable = true;
-            internalInterfaces = [ "ve-browser" ];
-            externalInterface = cfg.container.externalInterface;
-          };
-        };
-        */
-
-    containers.browser = {
-      autoStart = true;
-      privateNetwork = true;
-      hostAddress = "192.168.7.10";
-      localAddress = "192.168.7.11";
-
-      bindMounts = {
-        "/tmp/.X11-unix" = { };
-      };
-
-      config = { ... }: {
-        system.stateVersion = "23.11";
-
-        services.openssh = {
-          enable = true;
-          settings.X11Forwarding = true;
-          settings.PasswordAuthentication = true;
-        };
-
-        users.extraUsers.browser = {
-          isNormalUser = true;
-          home = "/home/browser";
-          password = "hello";
-          openssh.authorizedPrincipals = [ "jan@${config.containers.browser.hostAddress}" ];
-          # openssh.authorizedKeys.keys = cfg.container.sshAuthorizedKeys;
-          extraGroups = [ "pulse-access" ];
-          packages = [ torBrowser ];
-        };
-
-        environment.sessionVariables = {
-          DISPLAY = "${config.containers.browser.hostAddress}:0.0";
-          PULSE_SERVER = "tcp:${config.containers.browser.hostAddress}:4713";
-          XAUTHORITY = "/home/browser/.Xauthority";
-          DBUS_SESSION_BUS_ADDRESS = "";
-        };
-      };
-    };
   };
 }