I spent some time (and got help from another nice person) to make a pretty thorough nix config to create a firefox policy.json.
It is still missing an “autoConfig” which would allow setting arbitrary user.js values. Policies block random configurations, see this issue.
Click to show the config
{ ... }:
let
# Check about:support for extension/add-on ID strings.
extensions = [
"uBlock0@raymondhill.net" # uBlock Origin
"plasma-browser-integration@kde.org" # Plasma browser integration (nice to have, not needed)
"keepassxc-browser@keepassxc.org" # KeePassXC Integration (needs IPC and native messaging to communicate with KeepassXC)
"{b11bea1f-a888-4332-8d8a-cec2be7d24b9}" # Snowflake (arguable if it actually still makes sense)
"{531906d3-e22f-4a6c-a102-8057b88a1a63}" # SingleFile (archive websites as a single html file)
"jid1-QoFqdK4qzUfGWQ@jetpack" # Dark Background and Light Text (change website colors locally)
"{1ea2fa75-677e-4702-b06a-50fc7d06fe7e}" # Temporary Containers Plus (State Partitioning)
"{32af1358-428a-446d-873e-5f8eb5f2a72e}" # Download all images (extract images from websites that are not allowed to download)
];
in
{
programs.firefox = {
enable = true;
languagePacks = [ "en-US" "de" "en-GB" ]; # change this to the languages you use!
# Check about:policies#documentation for options.
policies = {
#### DEBLOAT ###
DisableFirefoxStudies = true;
#DisableFirefoxScreenshots = true; # neat but might not be needed
DontCheckDefaultBrowser = true;
UserMessaging = {
ExtensionRecommendations = false;
UrlbarInterventions = false;
SkipOnboarding = true;
MoreFromMozilla = false;
FirefoxLabs = true;
};
FirefoxSuggest = {
WebSuggestions = false;
SponsoredSuggestions = false;
ImproveSuggest = false;
Weather = false; # uses Accuweather, UI only allows locations in country of IP address
Locked = true;
};
### AI Nonsense
AIControls = {
Default = {
Value = "blocked";
Locked = true;
};
Translations.Value = "available";
PDFAltText.Value = "available";
# SmartTabGroups.Value = "available"; # unclear if local model is used
# SmartWindow.Value = "available";
};
# older policy, still active?
GenerativeAI = {
Enabled = true;
Chatbot = false;
LinkPreviews = false; # duplicate?
TabGroups = true; # duplicate?
Locked = true;
};
# default?
DisplayMenuBar = "default-off";
#### SECURITY ###
AutofillAddressEnabled = false;
AutofillCreditCardEnabled = false;
HttpsOnlyMode = "force_enabled";
SSLVersionMin = "tls1.2"; # <<-- change this to "tlsv1.3" if you are okay with proken pages
PostQuantumKeyAgreementEnabled = true;
HttpAllowlist = [
"http://localhost"
"http://127.0.0.1"
];
# new since firefox 151
LocalNetworkAccess = {
Enabled = false;
BlockTrackers = true;
EnablePrompting = true; # what is this?
SkipDomains = [
"127.0.0.1"
];
};
#### HIGH THREAT MODELS ###
# (you will also want more Arkenfox configs)
# https://github.com/mozilla/policy-templates/blob/a5e0c6a4c89ff86f089c0e0cfc4d8fac0c7af9f1/docs/index.md#disabledciphers
# DisabledCiphers = {
# "CIPHER_NAME" = true;
# };
### Settings changes between updates
# https://support.mozilla.org/en-US/kb/remote-improvements
# DisableRemoteImprovements = true;
#### PRIVACY ###
DisableTelemetry = true;
EnableTrackingProtection = {
Value = true;
Locked = true;
Cryptomining = true;
Fingerprinting = true;
Exceptions = [
"https://netflix.com"
"https://amazon.de"
"https://spotify.com"
];
};
DisablePocket = true;
NetworkPrediction = false;
# Delete data on shutdown
SanitizeOnShutdown = {
Cache = true;
FormData = true;
#SiteSettings = true; # what does this mean?
OfflineApps = true;
# History and Sessions false
};
Cookies = {
Allow = [
# Code forges
"https://github.com"
"https://gitlab.com"
"https://codeberg.org"
"https://sr.ht"
"https://gitlab.freedesktop.org"
# local sites
"http://127.0.0.1"
"https://127.0.0.1"
"http://localhost"
"https://localhost"
"https://192.168.1.1"
# search engines
"https://searloc.org"
"https://duckduckgo.com"
# AI
"https://duck.ai"
"https://chat.mistral.ai"
# Other...
];
};
SearchEngines = {
Remove = [
"eBay"
"Google"
"Bing"
"Ecosia"
"Wikipedia"
"Perplexity"
];
Add = [
{
"Name" = "Brave Search";
"URLTemplate" = "https://search.brave.com/search?q={searchTerms}&summary=0";
"IconURL" = "https://cdn.search.brave.com/serp/v1/static/brand/eebf5f2ce06b0b0ee6bbd72d7e18621d4618b9663471d42463c692d019068072-brave-lion-favicon.png";
"Alias" = "brave";
"Description" = "Independent search engine using the Brave web discovery project";
}
{
"Name" = "DuckDuckGo";
"URLTemplate" = "https://duckduckgo.com/?q={searchTerms}&ia=web&assist=false";
"IconURL" = "https://duckduckgo.com/favicon.ico";
"Alias" = "ddg";
"Description" = "Privacy respecting Bing frontend without AI integrations";
}
{
"Name" = "Qwant DE";
"URLTemplate" = "https://www.qwant.com/?l=de&sr=de%2F&r=DE&q={searchTerms}&t=web";
"IconURL" = "https://www.qwant.com/favicon.ico";
"Alias" = "qwant";
"Description" = "French search engine, might use the 'European Search Perspective' in certain countries, sometimes, maybe.";
}
{
"Name" = "Ecosia DE";
"URLTemplate" = "https://www.ecosia.org/search?method=index&q={searchTerms}";
"IconURL" = "https://www.ecosia.org/favicon.ico";
"Alias" = "ecosia";
"Description" = "German search engine, presumably eco-friendly, uses Bing, Google or Staan ('European Search Perspective', in some countries.). Not privacy friendly!";
}
{
"Name" = "OpenStreetMap";
"URLTemplate" = "https://www.openstreetmap.org/search?query={searchTerms}";
"IconURL" = "https://www.openstreetmap.org/favicon.ico";
"Alias" = "osm";
"Description" = "Community maintained map of the world";
}
{
"Name" = "Wikipedia";
"URLTemplate" = "https://en.wikipedia.org/wiki/Special:Search?go=Go&search={searchTerms}";
"IconURL" = "https://en.wikipedia.org/favicon.ico";
"Alias" = "wiki";
"Description" = "Community maintained knowledgebase";
}
{
"Name" = "Startpage (EU)";
"URLTemplate" = "https://eu.startpage.com/sp/search?query={searchTerms}";
"IconURL" = "https://eu.startpage.com/favicon.ico";
"Alias" = "sp";
"Description" = "Startpage with custom searches";
}
{
"Name" = "eBay";
"URLTemplate" = "https://www.ebay.de/sch/i.html?_nkw={searchTerms}&_sacat=0&_from=R40&LH_PrefLoc=6&_sop=15";
"IconURL" = "https://www.ebay.de/favicon.ico";
"Alias" = "ebay";
"Description" = "German eBay";
}
{
"Name" = "eBay gebraucht";
"URLTemplate" = "https://www.ebay.de/sch/i.html?_fsrp=1&rt=nc&_from=R40&_nkw={searchTerms}&_sacat=0&_sop=15&LH_PrefLoc=6&LH_ItemCondition=1500%7C2010%7C2020%7C2030%7C3000";
"IconURL" = "https://www.ebay.de/favicon.ico";
"Alias" = "egeb";
"Description" = "Used articles on german eBay";
}
{
"Name" = "RottenTomatos";
"URLTemplate" = "https://www.rottentomatoes.com/search?search={searchTerms}";
"IconURL" = "https://external-content.duckduckgo.com/ip3/www.rottentomatoes.com.ico";
"Alias" = "rt";
"Description" = "Movie Database and ratings";
}
{
"Name" = "IMDB";
"URLTemplate" = "https://www.imdb.com/find/?q={searchTerms}";
"IconURL" = "https://imdb.com/favicon.ico";
"Alias" = "imdb";
"Description" = "Movie Database owned by Amazon";
}
{
"Name" = "TMDB";
"URLTemplate" = "https://www.themoviedb.org/search?query={searchTerms}";
"IconURL" = "https://www.themoviedb.org/favicon.ico";
"Alias" = "tmdb";
"Description" = "The Movie Database";
}
{
"Name" = "Flathub";
"URLTemplate" = "https://flathub.org/en/apps/search?q={searchTerms}";
"IconURL" = "https://flathub.org/favicon.ico";
"Alias" = "flathub";
"Description" = "Sandboxed apps that work on every Linux system";
}
{
"Name" = "Random SearX";
"URLTemplate" = "https://searx.neocities.org/#q={searchTerms}&category_general=on";
"IconURL" = "https://searx.neocities.org/favicon.ico";
"Alias" = "rand";
"Description" = "Redirects each search to a different SearXNG provider, increasing privacy";
}
{
"Name" = "Wiki DE";
"URLTemplate" = "https://de.wikipedia.org/wiki/Spezial:Suche?fulltext=Artikel+suchen&fulltext=Search&search={searchTerms}";
"IconURL" = "https://en.wikipedia.org/favicon.ico";
"Alias" = "wikide";
"Description" = "Wikipedia";
}
{
"Name" = "AlternativeTo";
"URLTemplate" = "https://alternativeto.net/browse/search/?q={searchTerms}";
"IconURL" = "https://alternativeto.net/favicon.ico";
"Alias" = "alto";
}
{
"Name" = "ProtonDB";
"URLTemplate" = "https://www.protondb.com/search?q={searchTerms}";
"IconURL" = "https://www.protondb.com/favicon.ico";
"Alias" = "proton";
"Description" = "Community-maintained compatibility database for Windows games on Linux";
}
{
"Name" = "Icons";
"URLTemplate" = "https://icons8.com/icons/set/{searchTerms}";
"IconURL" = "https://icons8.com/favicon.ico";
"Alias" = "icons";
"Description" = "Icon database";
}
{
"Name" = "ConnectedPapers";
"URLTemplate" = "https://www.connectedpapers.com/search?q={searchTerms}";
"IconURL" = "https://www.connectedpapers.com/favicon.ico";
"Alias" = "connectedpapers";
"Description" = "Academic search engine";
}
{
"Name" = "Elsevier";
"URLTemplate" = "https://www.elsevier.com/search?query={searchTerms}&page=1&sortBy=relevance";
"IconURL" = "https://www.elsevier.com/images/elsevier-favicon.png";
"Alias" = "elsevier";
"Description" = "Academic search engine";
}
{
"Name" = "Semantic Scholar";
"URLTemplate" = "https://www.semanticscholar.org/search?q={searchTerms}&sort=relevance";
"IconURL" = "https://www.semanticscholar.org/favicon.ico";
"Alias" = "semantic";
"Description" = "Academic search engine";
}
{
"Name" = "LibGen";
"URLTemplate" = "https://libgen.li/index.php?req={searchTerms}";
"IconURL" = "https://libgen.li/favicon.ico";
"Alias" = "libgen";
"Description" = "Library of books";
}
{
"Name" = "Annas Archive";
"URLTemplate" = "https://annas-archive.gl/search?q={searchTerms}";
"IconURL" = "https://annas-archive.gl/favicon.ico";
"Alias" = "aa";
"Description" = "Gigantic library of books via direct download or torrent.";
}
{
"Name" = "Thingiverse";
"URLTemplate" = "https://www.thingiverse.com/search?q={searchTerms}&page=1";
"IconURL" = "https://www.thingiverse.com/favicon.ico";
"Alias" = "thingiverse";
"Description" = "Search 3D objects for 3D Printing and more";
}
];
Default = "Startpage (EU)";
};
SearchSuggestEnabled = false;
ExtensionSettings = builtins.listToAttrs (builtins.map (id: {
name = id;
value = {
install_url = "https://addons.mozilla.org/firefox/downloads/latest/${id}/latest.xpi";
installation_mode = "force_installed";
};
}) extensions);
};
preferences = {
#### FEATURES ###
"layout.spellcheckDefault" = 1;
# Use the systems native filechooser portal
"widget.use-xdg-desktop-portal.file-picker" = 1;
# allow adblockers to act everywhere. WARNING this is a security hole.
"extensions.webextensions.restrictedDomains" = "";
"media.webrtc.camera.allow-pipewire" = true;
"browser.download.always_ask_before_handling_new_types" = true;
# disable touchpad gestures
"browser.gesture.swipe.left" = "";
"browser.gesture.swipe.right" = "";
# disable drag tab to open new window
"browser.tabs.allowTabDetach" = false;
#### DEBLOAT ###
"browser.discovery.enabled" = false;
"app.shield.optoutstudies.enabled" = false;
"browser.topsites.contile.enabled" = false;
"browser.urlbar.suggest.quicksuggest.sponsored" = false;
"browser.urlbar.trending.featureGate" = false;
"browser.newtabpage.activity-stream.feeds.section.topstories" = false;
"browser.newtabpage.activity-stream.feeds.snippets" = false;
"browser.newtabpage.activity-stream.section.highlights.includePocket" = false;
"browser.newtabpage.activity-stream.section.highlights.includeBookmarks" = false;
"browser.newtabpage.activity-stream.section.highlights.includeDownloads" = false;
"browser.newtabpage.activity-stream.section.highlights.includeVisited" = false;
"browser.newtabpage.activity-stream.showSponsored" = false;
"browser.newtabpage.activity-stream.system.showSponsored" = false;
"browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
# Privacy: Disable automatic opening in new windows (manually still works)
# https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881
"browser.link.open_newwindow" = 3;
# Privacy: Set all window open modes to abide above method
"browser.link.open_newwindow.restriction"= 0;
#### PRIVACY ###
"privacy.resistFingerprinting" = "true";
# disable sending downloaded files to the internet
"browser.safebrowsing.downloads.remote.enabled" = false;
"network.dns.disablePrefetch" = false;
# redundancy: disable network prefetching
"network.predictor.enabled" = false;
# disable preloading websites when hovering over links
"network.http.speculative-parallel-limit" = 0;
# disable connecting to bookmarks when hovering over them
"browser.places.speculativeConnect.enabled" = "false";
"privacy.globalprivacycontrol.enabled" = true;
"privacy.clearOnShutdown_v2.cookiesAndStorage" = true;
"privacy.fingerprintingProtection" = true;
"browser.contentblocking.category" = "strict";
"extensions.pocket.enabled" = false;
"browser.search.suggest.enabled" = false;
"browser.search.suggest.enabled.private" = false;
"browser.urlbar.suggest.searches" = false;
# store media in cache only on private browsing
"browser.privatebrowsing.forceMediaMemoryCache" = true;
"network.http.referer.XOriginTrimmingPolicy" = 2;
# Privacy: Disable CSP reporting
# https://bugzilla.mozilla.org/show_bug.cgi?id=1964249
"security.csp.reporting.enabled" = false;
#### SECURITY ###
#"browser.formfill.enable" = false;
"pdfjs.enableScripting" = false;
#"signon.autofillForms" = false
# UNCLEAR
"signon.formlessCapture.enabled" = false;
# prevent scripts from moving or resizing windows
"dom.disable_window_move_resize" = true;
# Security: Disable remote debugging feature
# https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222
"devtools.debugger.remote-enabled" = false;
# Security: Restrict directories from which extensions can be loaded (Unclear)
# https://archive.is/DYjAM
"extensions.enabledScopes" = 5;
#### SSL ###
# Security: Require safe SSL negotiation to avoid potentially MITMed sites
"security.ssl.require_safe_negotiation" = true;
# Security: Disable TLS1.3 0-RTT as key encryption may not be forward secret
# https://github.com/tlswg/tls13-spec/issues/1001
"security.tls.enable_0rtt_data" = 2;
# Security: Enable strict public key pinning, prevents some MITM attacks
"security.cert_pinning.enforcement_level" = 2;
# Security: Enable CRLite to ensure that revoked certificates are detected
"security.pki.crlite_mode" = 2;
# Security: Treat unsafe negotiation as broken
# https://wiki.mozilla.org/Security:Renegotiation
# https://bugzilla.mozilla.org/1353705
"security.ssl.treat_unsafe_negotiation_as_broken" = true;
# Security: Display more information on Insecure Connection warning pages
# Test: https://badssl.com
"browser.xul.error_pages.expert_bad_cert" = true;
};
};
}
Sources
Use this Github repo with this file for updates of the recent policies. The git commits are very messy, so finding changes is not perfect but it should include all policies that exist.
Phoenix project by Celenity (likely more extensive policies than mine