From f5cb21019eb5853c43425a539fa6787a67b83f55 Mon Sep 17 00:00:00 2001 From: FileMagic Date: Thu, 16 Jul 2026 23:11:14 +0000 Subject: [PATCH] modules/firefox.nix: add security and privacy hardening - HTTPS-only mode enforced - DNS over HTTPS (Cloudflare) with strict mode 3 - First-party isolation, resist fingerprinting enabled - WebRTC local IP leak prevention - OCSP stapling required, cert error bypass hidden - Referrer policy tightened - Camera/mic/location/notifications default-blocked - signon.rememberSignons and autofill disabled --- modules/firefox.nix | 49 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file(s) changed, 48 insertion(s)(+), 1 deletion(s)(-) diff --git a/modules/firefox.nix b/modules/firefox.nix --- a/modules/firefox.nix +++ b/modules/firefox.nix @@ -37,15 +37,62 @@ }; # ---- Preferences (can be overridden) ---- preferences = { - # Privacy + # HTTPS-only + "dom.security.https_only_mode" = true; + "dom.security.https_only_mode_pbm" = true; + "dom.security.https_only_mode_send_http_background_request" = false; + + # DNS over HTTPS + "network.trr.mode" = 3; + "network.trr.uri" = "https://mozilla.cloudflare-dns.com/dns-query"; + "network.trr.bootstrapAddress" = "1.1.1.1"; + + # Privacy / Tracking "privacy.trackingprotection.fingerprinting.enabled" = true; "privacy.trackingprotection.cryptomining.enabled" = true; "privacy.trackingprotection.enabled" = true; "privacy.resistFingerprinting" = true; + "privacy.firstparty.isolate" = true; + + # Sanitize on shutdown "privacy.clearOnShutdown.cache" = true; "privacy.clearOnShutdown.cookies" = true; "privacy.clearOnShutdown.history" = false; + "privacy.clearOnShutdown.sessions" = true; "privacy.sanitize.sanitizeOnShutdown" = true; + + # WebRTC — prevent local IP leak + "media.peerconnection.ice.default_address_only" = true; + "media.peerconnection.ice.no_host" = true; + + # OCSP / Certificate checks + "security.OCSP.enabled" = 1; + "security.OCSP.require" = true; + "security.ssl.enable_ocsp_stapling" = true; + "security.certerrors.mitm.auto_enable_enterprise_roots" = false; + "security.certerror.hideAddException" = true; + + # Safe browsing + "browser.safebrowsing.downloads.enabled" = true; + "browser.safebrowsing.malware.enabled" = true; + "browser.safebrowsing.phishing.enabled" = true; + + # Referrer + "network.http.referer.XOriginPolicy" = 2; + "network.http.referer.XOriginTrimmingPolicy" = 2; + + # Clipboard / Permission prompts + "dom.events.asyncClipboard.readText" = false; + "permissions.default.camera" = 2; + "permissions.default.microphone" = 2; + "permissions.default.location" = 2; + "permissions.default.notifications" = 2; + "permissions.default.geo" = 2; + + # Disable password saving (policy handles the prompt, this kills storage) + "signon.rememberSignons" = false; + "signon.autofillForms" = false; + "signon.formlessCapture.enabled" = false; # Appearance "browser.theme.toolbar-theme" = 0; -- tangled.sh