some librewolf changes

9 files changed, 198 insertions, 120 deletions

diff --git a/flake.lock b/flake.lock
index fff0ef0..ee96c59 100644
--- a/flake.lock
+++ b/flake.lock
@@ -311,11 +311,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774357140,
-        "narHash": "sha256-Bg5VVybYUvLK44FjgjcOaYQ578fHPsFwfN5Y4I9M4Lo=",
+        "lastModified": 1774647953,
+        "narHash": "sha256-f0u5YpobYpm6LsmInRFYbc+gI0NJG9WcMzSmlkhdzs8=",
         "owner": "Mjoyufull",
         "repo": "fsel",
-        "rev": "8daa931b565bdebd07e363b7ded3ed05c8dd632a",
+        "rev": "c7c7a3f4dfbe06e2facdb6b6ed11002286717308",
         "type": "github"
       },
       "original": {
@@ -353,11 +353,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774561634,
-        "narHash": "sha256-3q1xsREjqdVIIwQQDZQ9y0YdBzP8gAxdwKoKnZSzJtU=",
+        "lastModified": 1774738535,
+        "narHash": "sha256-2jfBEZUC67IlnxO5KItFCAd7Oc+1TvyV/jQlR+2ykGQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7c046c63ac3b467c1d589b99d531da5b6520825a",
+        "rev": "769e07ef8f4cf7b1ec3b96ef015abec9bc6b1e2a",
         "type": "github"
       },
       "original": {
@@ -453,11 +453,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774483626,
-        "narHash": "sha256-8VAX9GXNfv4eBj0qBEf/Rc2/E6G0SBEpuo2A5plw34I=",
+        "lastModified": 1774742707,
+        "narHash": "sha256-a3FjZJxDOn0t18VwtIAgpNuUNaIEl6T+Awu5tXifQQw=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "5deaa19e80e1c0695f7fa8a16e13a704fd08f96e",
+        "rev": "7966a9c203276bea3b7e8dd2e125fd2b4c8b6753",
         "type": "github"
       },
       "original": {
@@ -469,11 +469,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1774472446,
-        "narHash": "sha256-Hp4A0llEmBvvNuw5uKOz+BA86X7TmXZ1vUK0StiMdVs=",
+        "lastModified": 1774725909,
+        "narHash": "sha256-aOiiQCmjCrvo+jAUDO2oMa377FvOtU97aqvTm74ZRGU=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "c9e961994b16ed841be43541ef550bf3d3f043ec",
+        "rev": "d5516daf121aa718e79bcd423ee24c24492893c0",
         "type": "github"
       },
       "original": {
@@ -494,11 +494,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1774539534,
-        "narHash": "sha256-kRKybUNiXTivTZSUnqwXHCY4GRD3e+Nu+1Mb8jf2HCI=",
+        "lastModified": 1774620721,
+        "narHash": "sha256-QucawBaJ6Rl5JWAXAbpouXM1MsvlzwCsPGl3zOwLtzw=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "975e9c55001333df0ddab36d938372c14917998a",
+        "rev": "fb83d584532282f585cd02f3aa513e98b843e7e7",
         "type": "github"
       },
       "original": {
@@ -527,11 +527,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1773130184,
-        "narHash": "sha256-3bwx4WqCB06yfQIGB+OgIckOkEDyKxiTD5pOo4Xz2rI=",
+        "lastModified": 1774616418,
+        "narHash": "sha256-z+dLkAS4bqytIlOI4h2MnjBJrSP4d1Awx0n+IV5YA3Y=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "b07bde3ee82dd73115e6b949e4f3f63695da35ea",
+        "rev": "8f48f56fe19918b5cfa02e5d68a47ebaf7bf3dee",
         "type": "github"
       },
       "original": {
@@ -550,11 +550,11 @@
         "nixpkgs-nixcord": "nixpkgs-nixcord"
       },
       "locked": {
-        "lastModified": 1774542254,
-        "narHash": "sha256-/y48dfuiZECFqVzoCGwJvbpF+rk/aKiAuZ23gKYf83s=",
+        "lastModified": 1774800440,
+        "narHash": "sha256-MQhm3HEVv9xHWQNIx/xp++q2+SUeH8hLohKZFIO7DZM=",
         "owner": "KaylorBen",
         "repo": "nixcord",
-        "rev": "6ba8404eedc4a080a0b4ecb615e094abe70ef530",
+        "rev": "287d1894eb8f682a99660f1b8bcb0f063d948a0c",
         "type": "github"
       },
       "original": {
@@ -565,11 +565,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774465523,
-        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
+        "lastModified": 1774777275,
+        "narHash": "sha256-qogBiYFq8hZusDPeeKRqzelBAhZvREc7Cl+qlewGUCg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
+        "rev": "b8f81636927f1af0cca812d22c876bad0a883ccd",
         "type": "github"
       },
       "original": {
@@ -714,11 +714,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1774309640,
-        "narHash": "sha256-8oWL7YLwElBY9ebYri1LlSlhf/gd1Qoqj0nbBwG2yso=",
+        "lastModified": 1774802402,
+        "narHash": "sha256-L1UJ/zxKTyyaGGmytH6OYlgQ0HGSMhvPkvU+iz4Mkb8=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "28c58bf023bf537354f78d6e496a349d7a0ed554",
+        "rev": "cbd8536a05d1aae2593cb5c9ace1010c8c5845cb",
         "type": "github"
       },
       "original": {
@@ -733,11 +733,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1774558268,
-        "narHash": "sha256-mzJSoSK8Eob6V1wbtafSrxkwusOtOV5IPItP8vcGhZ4=",
+        "lastModified": 1774803137,
+        "narHash": "sha256-Tevm4k4U2/6SBdzMSp7TP0L+HSuhcJdZSbk2hoHfvN8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "abfc10f1e9f4b301593df325b8cdc1cc2ba1cde2",
+        "rev": "8d4a2c59ab7666082ed4aa0f91dbca6911a531da",
         "type": "github"
       },
       "original": {
@@ -758,11 +758,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1774375131,
-        "narHash": "sha256-d22VIgsDXagQQWnAnebYeQWGHlmF81YRwuGCzAgNZAQ=",
+        "lastModified": 1774736237,
+        "narHash": "sha256-uQ+Was7QP9Bupr0XZyZXOAD32Ox8z2mJnevT2FmDwS8=",
         "owner": "NotAShelf",
         "repo": "nvf",
-        "rev": "d847d401bea4dcb1478d02a61a3209fa8512f71d",
+        "rev": "a0636d5c977743851c91d3c2e74bfac90be48835",
         "type": "github"
       },
       "original": {
@@ -779,11 +779,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774382611,
-        "narHash": "sha256-ZWFwBUYjPaZrBI5VapISxz45ec3Xec6VOokvOmmdGas=",
+        "lastModified": 1774755469,
+        "narHash": "sha256-sO6h2JLu7eaxILkHQgdAo7oDc8soqJbIShzlzH79tUw=",
         "ref": "refs/heads/master",
-        "rev": "783a58d95487a1a8e97f1cc5f2fc58016e695b7e",
-        "revCount": 73,
+        "rev": "6b8a278b4f2973391b256eedf6add3d6a3516bc0",
+        "revCount": 79,
         "type": "git",
         "url": "https://git.bwaaa.monster/omnisearch"
       },
@@ -802,11 +802,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1773647611,
-        "narHash": "sha256-Dkb6ft4LNHiYpmzJ9O90Qg3Jv2VThtzlC88bIAgVTWM=",
+        "lastModified": 1774790305,
+        "narHash": "sha256-tW1GBE0hzRBySkHYKGZS3tL82rllfOodPP/0xohr+Zg=",
         "owner": "kuokuo123",
         "repo": "otter-launcher",
-        "rev": "5aea41193a8da76c4720ec11059d56eb2fd86de1",
+        "rev": "869763de65d9d6f368c9931646a12c5aec42aa19",
         "type": "github"
       },
       "original": {
@@ -928,11 +928,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1774541495,
-        "narHash": "sha256-ELw4NuJ/ND9UGp8yLUewggSdmOxmgkUrAd1FGWe1A8g=",
+        "lastModified": 1774718281,
+        "narHash": "sha256-tQXPdiwU7Wqh91y85k6MwffoMRxl/rwaWpvI1Lhkr8A=",
         "owner": "gabm",
         "repo": "Satty",
-        "rev": "5c3cb87edbc1c2fd911905660befc4d57b6bdb78",
+        "rev": "590253c8bba01f5c559808dd432cbb80bc4bd7c8",
         "type": "github"
       },
       "original": {
@@ -948,11 +948,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774303811,
-        "narHash": "sha256-fhG4JAcLgjKwt+XHbjs8brpWnyKUfU4LikLm3s0Q/ic=",
+        "lastModified": 1774760784,
+        "narHash": "sha256-D+tgywBHldTc0klWCIC49+6Zlp57Y4GGwxP1CqfxZrY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "614e256310e0a4f8a9ccae3fa80c11844fba7042",
+        "rev": "8adb84861fe70e131d44e1e33c426a51e2e0bfa5",
         "type": "github"
       },
       "original": {
@@ -969,11 +969,11 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1774157037,
-        "narHash": "sha256-kJpgEIF0sxMW0vx543m3AwyqptJOxPoOJY1DfJ4jQas=",
+        "lastModified": 1774790928,
+        "narHash": "sha256-/JO77td8AOH45kg9IJl2DXDwbhn+cyQxYbCMu4Ae1CA=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "2e2234c2932a3aff5f845cda33cb1972a9e889aa",
+        "rev": "2bfdf55faf76fed12950b17d4af501e5a463607f",
         "type": "github"
       },
       "original": {
@@ -1135,11 +1135,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1774439851,
-        "narHash": "sha256-4eGyZtW+KsAVZqeS5bq/o+16YagjgWP+Uc3pltSaroU=",
+        "lastModified": 1774567340,
+        "narHash": "sha256-skKD1hvAvilKkK406RgNl6X/YJgkSsoZmtHmdfeoyWI=",
         "owner": "sxyazi",
         "repo": "yazi",
-        "rev": "b67798ea199a28fbe6cc210305d5db64918d0970",
+        "rev": "935eb6b2989f8a7ce219a2a71a539365c8dccfbb",
         "type": "github"
       },
       "original": {
diff --git a/hm/conf/xdg-mime.nix b/hm/conf/xdg-mime.nix
index 05b85a2..3f58e9f 100644
--- a/hm/conf/xdg-mime.nix
+++ b/hm/conf/xdg-mime.nix
@@ -15,7 +15,7 @@ in
 
           "image/png" = [ "nsxiv.desktop" ];
           "image/jpeg" = [ "nsxiv.desktop" ];
-          "image/gif" = [ "nsxiv.desktop" ];
+          "image/gif" = [ "mpv.desktop" ];
           "image/webp" = [ "nsxiv.desktop" ];
           "image/bmp" = [ "nsxiv.desktop" ];
 
@@ -29,11 +29,11 @@ in
           "audio/wav" = [ "mpv.desktop" ];
           "audio/ogg" = [ "mpv.desktop" ];
 
-          "text/html" = [ "firefox.desktop" ];
+          "text/html" = [ "librewolf.desktop" ];
           "x-scheme-handler/terminal" = [ "foot.desktop" ];
-          "x-scheme-handler/http" = [ "firefox.desktop" ];
-          "x-scheme-handler/https" = [ "firefox.desktop" ];
-          "inode/directory" = [ "thunar.desktop" ];
+          "x-scheme-handler/http" = [ "librewolf.desktop" ];
+          "x-scheme-handler/https" = [ "librewolf.desktop" ];
+          "inode/directory" = [ "pcmanfm.desktop" ];
         };
       };
       terminal-exec = {
diff --git a/hm/env/niri/binds.nix b/hm/env/niri/binds.nix
index c5c1f56..6bc5c5e 100644
--- a/hm/env/niri/binds.nix
+++ b/hm/env/niri/binds.nix
@@ -54,7 +54,7 @@ in
   "Super+D".action = spawn "equibop";
   "Super+B".action = spawn "librewolf";
   "Super+S".action = spawn "spotify";
-  "Super+E".action = spawn "thunar";
+  "Super+E".action = spawn "pcmanfm";
   "Super+Space".action = spawn "${otter-menu}/bin/otter-menu";
 
   # --- Navigation: Columns & Workspaces ---
diff --git a/hm/soft/browser.nix b/hm/soft/browser.nix
index 7223b27..5edbeb9 100644
--- a/hm/soft/browser.nix
+++ b/hm/soft/browser.nix
@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  inputs,
   ...
 }:
 let
@@ -13,17 +12,29 @@ in
     librewolf.enable = lib.mkEnableOption "LibreWolf browser";
     brave.enable = lib.mkEnableOption "Brave browser";
   };
-  imports = [ inputs.arkenfox.hmModules.arkenfox ];
   config = lib.mkMerge [
     (lib.mkIf cfg.librewolf.enable {
       programs.librewolf = {
         enable = true;
-        # arkenfox = {
-        #   enable = true;
-        #   version = "148.0.2-2";
-        # };
-        settings = {
-          "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+        policies = {
+          DisableTelemetry = true;
+          DisableFirefoxStudies = true;
+          DontCheckDefaultBrowser = true;
+          SearchEngines = {
+            Remove = [
+              "Google"
+              "Bing"
+              "Perplexity"
+              "Wikipedia (en)"
+              "DuckDuckGo"
+              "DuckDuckGo Lite"
+              "Searx Belgium"
+              "MetaGer"
+              "Startpage"
+              "Mojeek"
+            ];
+            PreventInstalls = true;
+          };
         };
 
         profiles = {
@@ -33,10 +44,15 @@ in
             isDefault = true;
             search = {
               force = true;
+              default = "OmniSearch";
+              order = [
+                "OmniSearch"
+                "SearXNG"
+              ];
               engines = {
                 "google".metaData.hidden = true;
                 "bing".metaData.hidden = true;
-                # "ddg".metaData.hidden = true;
+                "ddg".metaData.hidden = true;
                 "perplexity".metaData.hidden = true;
                 "wikipedia".metaData.hidden = true;
                 "policy-DuckDuckGo Lite".metaData.hidden = true;
@@ -44,13 +60,13 @@ in
                 "policy-MetaGer".metaData.hidden = true;
                 "policy-Startpage".metaData.hidden = true;
                 "policy-Mojeek".metaData.hidden = true;
-
                 "OmniSearch" = {
-                  urls = [ { template = "http://omnisearch.local:8087/search?q={searchTerms}"; } ];
+                  urls = [ { template = "http://127.0.0.1:8087/search?q={searchTerms}"; } ];
                   definedAliases = [ "@o" ];
                 };
                 "SearXNG" = {
                   urls = [ { template = "https://sxng.violets-purgatory.dev/search?q={searchTerms}"; } ];
+                  icon = "https://sxng.violets-purgatory.dev/favicon.ico";
                   definedAliases = [ "@s" ];
                 };
                 "NixOS Packages" = {
@@ -87,6 +103,8 @@ in
               ];
             };
             settings = {
+              "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+
               "identity.fxaccounts.enabled" = true;
               "extensions.autoDisableScopes" = 0;
               # --- Privacy & Fingerprinting ---
@@ -167,11 +185,6 @@ in
               "network.prefetch-next" = false;
               "network.dns.disablePrefetch" = true;
             };
-            userChrome = ''
-              #TabsToolbar { visibility: collapse !important; }
-              #sidebar-header { display: none !important; }
-              #toolbar-menubar { display: none !important; }
-            '';
           };
         };
       };
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index 05ef3f7..6f4757e 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -1,7 +1,6 @@
 {
   config,
   username,
-  pkgs,
   ...
 }:
 {
@@ -48,12 +47,17 @@
         };
       };
       network.enable = true;
-      security.enable = true;
+      security = {
+        enable = true;
+        sandboxing.enable = true;
+        antivirus.enable = true;
+      };
       ssh.enable = true;
       storage.enable = true;
       users.enable = true;
     };
     srv = {
+      bluetooth.enable = true;
       yggdrasil.enable = true;
       i2p.enable = true;
       files = {
@@ -81,8 +85,6 @@
     };
   };
 
-  programs.firefox.enable = true;
-
   boot = {
     kernelModules = [
       "nct6687"
diff --git a/os/core/security.nix b/os/core/security.nix
index f0eadab..34e2f1f 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -11,37 +11,99 @@ in
 {
   options.os.core.security = {
     enable = lib.mkEnableOption "core security services";
+    antivirus.enable = lib.mkEnableOption "enables clamav antivirus";
+    sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff";
   };
-  config = lib.mkIf cfg.enable {
-    services.gnome.gnome-keyring.enable = true;
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        security = {
+          polkit.enable = true;
+          rtkit.enable = true;
+          doas = {
+            enable = true;
+            extraRules = [
+              {
+                users = [ username ];
+                keepEnv = true;
+                persist = true;
+              }
+            ];
+          };
+          sudo.enable = false;
+          pam.services = {
+            swaylock = { };
+            login.enableGnomeKeyring = true;
+          };
+        };
+        environment.systemPackages = [ pkgs.doas-sudo-shim ];
+      }
+      (lib.mkIf cfg.sandboxing.enable {
+        security.apparmor = {
+          enable = true;
+          enableCache = true;
+          killUnconfinedConfinables = true;
+          packages = with pkgs; [
+            apparmor-profiles
+            roddhjav-apparmor-rules
+          ];
+        };
+        programs.firejail.enable = true;
+        environment.etc = {
+          "firejail/games.profile".text = ''
+            include wine.profile
 
-    security = {
-      doas = {
-        enable = true;
-        extraRules = [
-          {
-            users = [ username ];
-            keepEnv = true;
-            persist = true;
-          }
-        ];
-      };
-      sudo.enable = false;
+            # --- Security stuff ---
+            apparmor
+            nonewprivs
+            net none
+            noinput
+            nogroups
+            novideo
+            dbus-user none
+            dbus-system none
 
-      pam.services = {
-        swaylock = { };
-        login.enableGnomeKeyring = true;
-      };
-      polkit.enable = true;
-      rtkit.enable = true;
-    };
+            # --- Filesystem Isolation ---
+            whitelist ~/games/repacks/firejail
+            private-tmp
+          '';
+        };
+        environment.systemPackages = with pkgs; [
+          landrun
+          apparmor-utils
+          apparmor-bin-utils
+        ];
+      })
+      (lib.mkIf cfg.antivirus.enable {
+        services.clamav = {
+          daemon = {
+            enable = true;
+            settings = {
+              OnAccessIncludePath = [ "/home/${username}" ];
+              OnAccessPrevention = true;
+              OnAccessExcludeUname = "clamav";
+              MaxThreads = 20;
+              MaxQueue = 100;
+            };
+          };
+          scanner.enable = true;
+          updater.enable = true;
+          fangfrisch.enable = true;
+          # massive performance hit
+          # clamonacc.enable = true;
+        };
+        boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
+        users.users.${username}.extraGroups = [ "clamav" ];
+      })
+      {
+        services.gnome.gnome-keyring.enable = true;
 
-    environment.systemPackages = with pkgs; [
-      doas-sudo-shim
-      veracrypt
-      bitwarden-desktop
-      keepassxc
-      git-credential-keepassxc
-    ];
-  };
+        environment.systemPackages = with pkgs; [
+          veracrypt
+          bitwarden-desktop
+          keepassxc
+        ];
+      }
+    ]
+  );
 }
diff --git a/os/srv/files.nix b/os/srv/files.nix
index 22117d0..f5e4ebb 100644
--- a/os/srv/files.nix
+++ b/os/srv/files.nix
@@ -15,23 +15,24 @@ in
   };
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
-      programs.thunar = {
-        enable = true;
-        plugins = with pkgs; [
-          ffmpegthumbnailer
-          libgsf
-          poppler
-          freetype
-          webp-pixbuf-loader
-          thunar-volman
-          thunar-archive-plugin
-        ];
-      };
+      # programs.thunar = {
+      #   enable = true;
+      #   plugins = with pkgs; [
+      #     ffmpegthumbnailer
+      #     libgsf
+      #     poppler
+      #     freetype
+      #     webp-pixbuf-loader
+      #     thunar-volman
+      #     thunar-archive-plugin
+      #   ];
+      # };
       services = {
         tumbler.enable = true;
         gvfs.enable = true;
       };
       environment.systemPackages = with pkgs; [
+        pcmanfm
         file-roller
         dua
         pxz
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 33f492a..28ebcc3 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -107,6 +107,7 @@ in
         openFirewall = true;
         highPriority = true;
         steam.importOXRRuntimes = true;
+        defaultRuntime = true;
       };
       environment.systemPackages = [ pkgs.android-tools ];
       users.users.${username}.extraGroups = [ "adbusers" ];
diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix
index dea0490..756711f 100644
--- a/os/srv/omnisearch.nix
+++ b/os/srv/omnisearch.nix
@@ -13,6 +13,5 @@ in
 
   config = lib.mkIf cfg.enable {
     services.omnisearch.enable = true;
-    networking.hosts."127.0.0.1" = [ "omnisearch.local" ];
   };
 }