hosts/asus-gl553vd/configs/imp.nix

@@ -46,7 +46,6 @@
         "/var/lib/nixos"
         "/var/lib/systemd/coredump"
         "/etc/NetworkManager/system-connections"
-        "/etc/ssh/per-machine"
       ];
       files = [
         "/etc/machine-id"
@@ -67,11 +66,5 @@
       ];
       files = [ "/var/lib/docker/engine-id" ];
     };
-    "/presistent/ollama" = lib.mkIf config.services.ollama.enable {
-      hideMounts = true;
-      directories  = [
-        "/var/lib/private/ollama"
-      ];
-    };
   };
 }

hosts/asus-gl553vd/configuration.nix

@@ -26,14 +26,17 @@
   ################################################################################
   # Programs
   ################################################################################
+  local.programs.browsers.tor-browser = {
+    enable = true;
+    container = {
+      enable = true;
+      externalInterface = "wg0";
+      sshAuthorizedKeys = globalData.publicKeys.users.jan;
+    };
+  };
+
   services.ollama = {
     enable = true;
     package = pkgs.unstable.ollama;
   };
-
-  local.programs.browsers.tor-browser.enable = true;
-
-  environment.shellInit = ''
-    [ -n "$DISPLAY" ] && ${pkgs.xorg.xhost}/bin/xhost +si:localuser:$USER > /dev/null || true
-  '';
 }

hosts/home/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, globalData, pkgs, ... }:
 
 {
   imports = [
@@ -12,7 +12,14 @@
   ################################################################################
   # Programs
   ################################################################################
-  local.programs.browsers.tor-browser.enable = true;
+  local.programs.browsers.tor-browser = {
+    enable = true;
+    container = {
+      enable = true;
+      externalInterface = "wg0";
+      sshAuthorizedKeys = globalData.publicKeys.users.jan;
+    };
+  };
 
   ################################################################################
   # Services
@@ -81,7 +88,6 @@
       environment.sessionVariables = {
         DISPLAY = ":0";
         PULSE_SERVER = "tcp:127.0.0.1:4713";
-        XAUTHORITY = "/home/john/.Xauthority";
 
         WINEPREFIX = "/home/john/.wine";
         WINEARCH = "win32";

modules/home-manager/configs/window-manager/xmonad/default.nix

@@ -65,8 +65,6 @@ in
       nitrogen # wallpaper manager
     ];
 
-    programs.rofi.pass.enable = true;
-
     xsession = {
       enable = true;
 

modules/home-manager/configs/window-manager/xmonad/xmonad_config.hs

@@ -277,13 +277,10 @@ myKeys conf =
         ("M-S-<Return>", spawn $ XMonad.terminal conf),
         -- launch a 'flameshot' to screenshot
         ("M-S-s", safeSpawn "flameshot" ["gui"]),
-        -- launch browsers
-        ("M-S-b", spawn "cont-librewolf"),
-        ("M-S-t", spawn "cont-tor-browser"),
+        -- launch 'librewolf' browser
+        ("M-S-b", spawn "librewolf"),
         -- launch 'dmenu_run' to choose applications
-        ("M-r", spawn "dmenu_run"),
-        -- launch 'rofi-pass' to use password manager
-        ("M-p", spawn "rofi-pass")
+        ("M-p", spawn "dmenu_run")
         -- Open calculator
         -- ("<XF86Calculator>", spawn "gnome-calculator"),
       ]

modules/nixos/programs/browsers/default.nix

@@ -1,134 +1,8 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.local.programs.browsers;
-
-  hostAddress = "192.168.7.10";
-  localAddress = "192.168.7.11";
-
-  hostRunBrowser = pkgs.writeScript "run-browser" ''
-    host=browsers.containers
-    if [ -z "$(ssh-keygen -F $host)" ]; then
-      ssh-keyscan -H $host >> ~/.ssh/known_hosts
-    fi
-    ssh -o PubkeyAuthentication=no kira@$host $@
-  '';
-
-  contPackages =
-    lib.optional cfg.tor-browser.enable cfg.tor-browser.package
-    ++ lib.optional cfg.librewolf.enable cfg.librewolf.package
-    ++ lib.optional cfg.mullvad-browser.enable cfg.mullvad-browser.package;
-
-  hostPackages = lib.flip map contPackages (p:
-    pkgs.writeScriptBin "cont-${p.meta.mainProgram}" ''
-      ${hostRunBrowser} ${p.meta.mainProgram}
-    ''
-  );
-
-  isEnable = cfg.tor-browser.enable
-    or cfg.librewolf.enable
-    or cfg.mullvad-browser.enable;
-in
+{ ... }:
 {
   imports = [
     ./tor-browser.nix
     ./mullvad-browser.nix
     ./librewolf.nix
   ];
-
-  config = lib.mkIf isEnable {
-    environment.systemPackages = hostPackages
-      ++ lib.optional cfg.librewolf.enable cfg.librewolf.package;
-
-    hardware.pulseaudio = {
-      systemWide = true;
-      support32Bit = true;
-      tcp = {
-        enable = true;
-        anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
-      };
-    };
-
-    networking = {
-      firewall = {
-        allowedTCPPorts = [ 4713 ];
-        trustedInterfaces = [ "ve-*" ];
-      };
-      nat = {
-        enable = true;
-        internalInterfaces = [ "ve-browsers" ];
-        externalInterface = "wg0";
-      };
-    };
-
-    containers.browsers = {
-      autoStart = true;
-      ephemeral = true;
-
-      privateNetwork = true;
-      inherit hostAddress localAddress;
-
-      bindMounts = lib.mkMerge [
-        {
-          "/tmp/.X11-unix" = { };
-          "/etc/ssh/keys" = {
-            isReadOnly = false;
-            hostPath = "/etc/ssh/per-machine/browsers";
-          };
-          "/home/kira/Downloads" = {
-            isReadOnly = false;
-            hostPath = "/home/jan/downloads/browser";
-          };
-        }
-        (lib.mkIf cfg.librewolf.enable {
-          "/home/kira/.librewolf" = {
-            isReadOnly = false;
-            hostPath = "/home/jan/.librewolf";
-          };
-        })
-      ];
-
-      config = { pkgs, ... }: {
-        system.stateVersion = "23.11";
-
-        # Inherit configs from host
-        networking.hosts = config.networking.hosts;
-        fonts = {
-          inherit (config.fonts) enableDefaultPackages packages;
-          fontconfig = { inherit (config.fonts.fontconfig) defaultFonts; };
-        };
-
-        services.openssh = {
-          enable = true;
-          settings.PasswordAuthentication = true;
-          hostKeys = [
-            {
-              bits = 4096;
-              path = "/etc/ssh/keys/ssh_host_rsa_key";
-              type = "rsa";
-            }
-            {
-              path = "/etc/ssh/keys/ssh_host_ed25519_key";
-              type = "ed25519";
-            }
-          ];
-        };
-
-        users.users.kira = {
-          isNormalUser = true;
-          home = "/home/kira";
-          password = "hello";
-          extraGroups = [ "pulse-access" ];
-          packages = contPackages;
-        };
-
-        environment.sessionVariables = {
-          DISPLAY = ":0";
-          PULSE_SERVER = "tcp:${hostAddress}:4713";
-          XAUTHORITY = "/home/kira/.Xauthority";
-          DBUS_SESSION_BUS_ADDRESS = "";
-        };
-      };
-    };
-  };
 }

modules/nixos/programs/browsers/librewolf.nix

@@ -1,11 +1,12 @@
-{ pkgs, lib, inputs, ... }:
+{ config, pkgs, lib, inputs, ... }:
 
 let
-  # isPassEnabled = config.local.programs.pass.enable;
+  cfg = config.local.programs.browsers.librewolf;
+  isPassEnabled = config.local.programs.pass.enable;
 
   policiesJson = pkgs.callPackage ./policies.nix {
     firefoxAddons = inputs.firefox-addons.packages."${pkgs.system}";
-    # withPassffAddon = isPassEnabled;
+    withPassffAddon = isPassEnabled;
     withRedirectorAddon = true;
     withSidebarTabsAddon = true;
     withAllSearchEngines = true;
@@ -13,12 +14,15 @@ let
 
   librewolf' = with pkgs.unstable; librewolf.override {
     extraPoliciesFiles = librewolf.unwrapped.extraPoliciesFiles ++ [ policiesJson ];
-    # nativeMessagingHosts = lib.optional isPassEnabled passff-host;
+    nativeMessagingHosts = lib.optional isPassEnabled passff-host;
   };
 in
 {
   options.local.programs.browsers.librewolf = with lib; {
     enable = mkEnableOption "librewolf";
-    package = mkPackageOption pkgs "librewolf" {} // { default = librewolf'; };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ librewolf' ];
   };
 }

modules/nixos/programs/browsers/mullvad-browser.nix

@@ -1,6 +1,8 @@
-{ pkgs, lib, inputs, ... }:
+{ config, pkgs, lib, inputs, ... }:
 
 let
+  cfg = config.local.programs.browsers.mullvad-browser;
+
   policiesJson = pkgs.callPackage ./policies.nix {
     firefoxAddons = inputs.firefox-addons.packages."${pkgs.system}";
     withRedirectorAddon = true;
@@ -19,6 +21,9 @@ in
 {
   options.local.programs.browsers.mullvad-browser = with lib; {
     enable = mkEnableOption "mullvad-browser";
-    package = mkPackageOption pkgs "mullvad-browser" {} // { default = mullvadBrowser; };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ mullvadBrowser ];
   };
 }

modules/nixos/programs/browsers/policies.nix

@@ -28,7 +28,7 @@ writeText "policies.json" (builtins.toJSON {
     SearchEngines = {
       Add = [
         {
-          Alias = "@sx";
+          Alias = "sx";
           Name = "SearXNG";
           Description = "SearXNG — a privacy-respecting, open metasearch engine";
           IconURL = "https://search.sapti.me/static/themes/simple/img/favicon.png";
@@ -36,28 +36,28 @@ writeText "policies.json" (builtins.toJSON {
         }
       ] ++ lib.optionals withAllSearchEngines [
         {
-          Alias = "@np";
+          Alias = "np";
           Name = "NixOS Packages";
           Description = "Search NixOS packages by name or description.";
           IconURL = "https://nixos.org/favicon.png";
           URLTemplate = "https://search.nixos.org/packages?query={searchTerms}";
         }
         {
-          Alias = "@no";
+          Alias = "no";
           Name = "NixOS Options";
           Description = "Search NixOS options by name or description.";
           IconURL = "https://nixos.org/favicon.png";
           URLTemplate = "https://search.nixos.org/options?query={searchTerms}";
         }
         {
-          Alias = "@ng";
+          Alias = "ng";
           Name = "Noogle";
           Description = "Search for nix functions by name.";
           IconURL = "https://noogle.dev/favicon.png";
           URLTemplate = "https://noogle.dev/q?term={searchTerms}";
         }
         {
-          Alias = "@hg";
+          Alias = "hg";
           Name = "Hoogle";
           Description = ''
               Hoogle is a Haskell API search engine, which allows you to

modules/nixos/programs/browsers/tor-browser.nix

@@ -1,6 +1,8 @@
-{ pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:
 
 let
+  cfg = config.local.programs.browsers.tor-browser;
+
   policiesJson = pkgs.callPackage ./policies.nix { };
 
   torBrowser = (pkgs.tor-browser-bundle-bin.override {
@@ -16,6 +18,95 @@ in
 {
   options.local.programs.browsers.tor-browser = with lib; {
     enable = mkEnableOption "tor-browser";
-    package = mkPackageOption pkgs "tor-browser-bundle-bin" {} // { default = torBrowser; };
+    container = {
+      enable = mkEnableOption "tor-browser inside a container";
+      externalInterface = mkOption {
+        type = types.str;
+        default = "";
+      };
+      sshAuthorizedKeys = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+      };
+    };
   };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.mkIf (!cfg.container.enable) {
+      environment.systemPackages = [ torBrowser ];
+    })
+    (lib.mkIf cfg.container.enable (
+      let
+        hostRunTorBrowser = pkgs.writeScriptBin "tor-browser" ''
+          ${pkgs.socat}/bin/socat -d TCP-LISTEN:6000,fork,bind=192.168.7.10 UNIX-CONNECT:/tmp/.X11-unix/X0 &
+          ${pkgs.xorg.xhost}/bin/xhost +
+          ssh -X browser@192.168.7.11 tor-browser
+          ${pkgs.xorg.xhost}/bin/xhost -
+        '';
+
+        clientRunTorBrowser = pkgs.writeScriptBin "tor-browser" ''
+          PULSE_SERVER=tcp:192.168.7.10:4713 \
+          XAUTHORITY="/home/browser/.Xauthority" \
+          DBUS_SESSION_BUS_ADDRESS="" \
+          DISPLAY=192.168.7.10:0.0 \
+          ${pkgs.apulse}/bin/apulse ${torBrowser}/bin/tor-browser $@
+        '';
+      in
+      {
+        assertions = [
+          {
+            assertion = cfg.container.externalInterface != "";
+            message = "The `tor-browser` module with the `isContainer` option enabled requires a non-empty `externalInterface` with Internet access";
+          }
+          {
+            assertion = cfg.container.sshAuthorizedKeys != [ ];
+            message = "The `tor-browser` module with the `isContainer` option enabled requires a non-empty `sshAuthorizedKeys` to connect to the container";
+          }
+        ];
+
+        environment.systemPackages = [ hostRunTorBrowser ];
+
+        hardware.pulseaudio = {
+          systemWide = true;
+          support32Bit = true;
+          tcp = {
+            enable = true;
+            anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
+          };
+        };
+
+        networking = {
+          firewall.allowedTCPPorts = [ 4713 6000 ];
+          nat = {
+            enable = true;
+            internalInterfaces = [ "ve-browser" ];
+            externalInterface = cfg.container.externalInterface;
+          };
+        };
+
+        containers.browser = {
+          autoStart = true;
+          privateNetwork = true;
+          hostAddress = "192.168.7.10";
+          localAddress = "192.168.7.11";
+
+          config = { ... }: {
+            system.stateVersion = "23.11";
+            services.openssh = {
+              enable = true;
+              settings.X11Forwarding = true;
+            };
+
+            users.extraUsers.browser = {
+              isNormalUser = true;
+              home = "/home/browser";
+              openssh.authorizedKeys.keys = cfg.container.sshAuthorizedKeys;
+              extraGroups = [ "pulse-access" ];
+              packages = [ clientRunTorBrowser ];
+            };
+          };
+        };
+      }
+    ))
+  ]);
 }