Firefox flotte : reprend la config oreo (page de bienvenue + pubs), DuckDuckGo, extensions réduites
Le config Firefox précédente ne coupait que showSponsored -- pas aboutwelcome (page de config au premier lancement), pas les autres sources de contenu sponsorisé/promo (FirefoxHome TopSites/Highlights/ Pocket/Snippets, FirefoxSuggest, UserMessaging...). Reprend la config complète d'oreo (nixos_users/hosts/oreo/configuration.nix), avec deux changements : SearXNG (perso/privé) -> DuckDuckGo (public, intégré, pas besoin d'Add) ; ExtensionSettings réduit à uBlock Origin + Privacy Badger (oreo en a une quinzaine, hors sujet pour un poste générique). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
+161
-14
@@ -186,45 +186,192 @@ in
|
||||
'';
|
||||
system.activationScripts.dconfUpdate.text = "${pkgs.dconf}/bin/dconf update";
|
||||
|
||||
# Confidentialité générique (pas de SearXNG/DNS perso : repo public).
|
||||
# Reprend la config Firefox d'oreo (nixos_users/hosts/oreo/configuration.nix)
|
||||
# -- c'est elle qui tue la page d'accueil/configuration au premier
|
||||
# lancement (aboutwelcome, newtabpage...) et bloque les pubs/contenu
|
||||
# sponsorisé bien plus largement que l'ancienne version ici (qui ne
|
||||
# coupait que le strict showSponsored). Deux choses changées par
|
||||
# rapport à oreo, volontairement : SearXNG (perso, privé) remplacé par
|
||||
# DuckDuckGo (public, intégré à Firefox) ; ExtensionSettings réduit à
|
||||
# uBlock Origin + Privacy Badger (oreo en a une quinzaine, trop pour
|
||||
# un poste générique de flotte).
|
||||
programs.firefox = {
|
||||
enable = true;
|
||||
languagePacks = [ "fr" ];
|
||||
|
||||
preferences = {
|
||||
"browser.startup.homepage" = "https://duckduckgo.com";
|
||||
"privacy.resistFingerprinting" = true;
|
||||
"browser.newtabpage.activity-stream.showSponsored" = false;
|
||||
|
||||
"network.trr.mode" = 3;
|
||||
"network.trr.uri" = "https://dns.quad9.net/dns-query";
|
||||
"network.trr.fallback-resolver" = "https://mozilla.cloudflare-dns.com/dns-query";
|
||||
|
||||
"browser.newtabpage.enabled" = false;
|
||||
"browser.newtabpage.activity-stream.enabled" = false;
|
||||
"browser.startup.page" = 1;
|
||||
|
||||
# Page de configuration/bienvenue au premier lancement -- désactivée.
|
||||
"browser.aboutwelcome.enabled" = false;
|
||||
"browser.newtabpage.pinned" = "[]";
|
||||
"browser.newtabpage.section.discovery" = false;
|
||||
|
||||
"places.history.enabled" = false;
|
||||
"privacy.clearOnShutdown.history" = true;
|
||||
"privacy.clearOnShutdown.cache" = true;
|
||||
"privacy.clearOnShutdown.downloads" = true;
|
||||
"privacy.clearOnShutdown.cookies" = false;
|
||||
"privacy.clearOnShutdown.sessions" = false;
|
||||
"privacy.clearOnShutdown.formdata" = false;
|
||||
"privacy.clearOnShutdown.offlineApps" = true;
|
||||
|
||||
# Onglets verticaux à gauche par défaut
|
||||
"sidebar.revamp" = true;
|
||||
"sidebar.verticalTabs" = true;
|
||||
|
||||
# Virer "Recent browsing" (Firefox View)
|
||||
"browser.tabs.firefox-view" = false;
|
||||
"browser.tabs.firefox-view-next" = false;
|
||||
|
||||
# Virer "List all tabs" (bouton chevron dropdown)
|
||||
"browser.tabs.tabmanager.enabled" = true;
|
||||
|
||||
# Virer suggestions de recherche (y compris tendances)
|
||||
"browser.search.suggest.enabled" = false;
|
||||
"browser.urlbar.suggest.searches" = false;
|
||||
"browser.urlbar.suggest.trending" = false;
|
||||
"browser.newtabpage.activity-stream.showSponsored" = false;
|
||||
|
||||
# HTTPS obligatoire en permanence
|
||||
"dom.security.https_only_mode" = true;
|
||||
"dom.security.https_only_mode_ever_enabled" = true;
|
||||
|
||||
# Désactiver WebRTC (fuite d'IP réelle même via VPN)
|
||||
"media.peerconnection.enabled" = false;
|
||||
|
||||
# Désactiver la géolocalisation
|
||||
"geo.enabled" = false;
|
||||
|
||||
# Désactiver DRM (Widevine)
|
||||
"media.eme.enabled" = false;
|
||||
|
||||
# Désactiver le prefetching (DNS/liens) — fuite d'intention de navigation
|
||||
"network.dns.disablePrefetch" = true;
|
||||
"network.prefetch-next" = false;
|
||||
"network.predictor.enabled" = false;
|
||||
"network.http.speculative-parallel-limit" = 0;
|
||||
|
||||
# Désactiver Safe Browsing distant (envoie des hachages d'URL à Google)
|
||||
"browser.safebrowsing.malware.enabled" = false;
|
||||
"browser.safebrowsing.phishing.enabled" = false;
|
||||
|
||||
# Désactiver la détection de portail captif (requête réseau vers Mozilla)
|
||||
"network.captive-portal-service.enabled" = false;
|
||||
"network.connectivity-service.enabled" = false;
|
||||
|
||||
# Isolation par premier-parti (empêche le cross-site tracking via cache/cookies)
|
||||
"privacy.firstparty.isolate" = true;
|
||||
|
||||
# Désactiver WebGL (vecteur de fingerprinting majeur)
|
||||
"webgl.disabled" = true;
|
||||
|
||||
# Désactiver l'API batterie (fingerprinting)
|
||||
"dom.battery.enabled" = false;
|
||||
|
||||
# Bloquer l'autoplay média
|
||||
"media.autoplay.default" = 5;
|
||||
|
||||
# Référent minimal envoyé aux sites
|
||||
"network.http.referer.XOriginPolicy" = 2;
|
||||
|
||||
# Do Not Track : plus d'UI depuis les versions récentes de Firefox,
|
||||
# mais le pref existe encore et envoie bien l'en-tête DNT=1.
|
||||
"privacy.donottrackheader.enabled" = true;
|
||||
};
|
||||
|
||||
policies = {
|
||||
DisableTelemetry = true;
|
||||
DisablePocket = true;
|
||||
DisableFirefoxStudies = true;
|
||||
OfferToSaveLogins = false;
|
||||
DontCheckDefaultBrowser = true;
|
||||
EnableTrackingProtection = {
|
||||
Value = true;
|
||||
Locked = true;
|
||||
DisableFirefoxAccounts = false;
|
||||
DisableFirefoxScreenshots = true;
|
||||
DisableForgetButton = true;
|
||||
DisableMasterPasswordCreation = true;
|
||||
DisableProfileImport = true;
|
||||
DisableProfileRefresh = true;
|
||||
DisableSetDesktopBackground = true;
|
||||
DisablePocket = true;
|
||||
DisableTelemetry = true;
|
||||
DisableFormHistory = true;
|
||||
DisablePasswordReveal = true;
|
||||
SanitizeOnShutdown = false;
|
||||
GenerativeAI.Enable = false;
|
||||
|
||||
FirefoxSuggest = {
|
||||
WebSuggestions = false;
|
||||
SponsoredSuggestions = false;
|
||||
ImproveSuggest = false;
|
||||
};
|
||||
|
||||
# DuckDuckGo est un moteur intégré à Firefox, pas besoin de l'Add.
|
||||
SearchEngines.Default = "DuckDuckGo";
|
||||
|
||||
# Pubs/contenu sponsorisé sur le nouvel onglet et la barre d'adresse.
|
||||
FirefoxHome = {
|
||||
SponsoredTopSites = false;
|
||||
SponsoredPocket = false;
|
||||
TopSites = false;
|
||||
Highlights = false;
|
||||
Pocket = false;
|
||||
Snippets = false;
|
||||
Locked = true;
|
||||
};
|
||||
FirefoxSuggest.SponsoredSuggestions = false;
|
||||
|
||||
UserMessaging = {
|
||||
WhatsNew = false;
|
||||
MoreFromMozilla = false;
|
||||
};
|
||||
|
||||
EnableTrackingProtection = {
|
||||
Value = true;
|
||||
Locked = true;
|
||||
Cryptomining = true;
|
||||
Fingerprinting = true;
|
||||
};
|
||||
|
||||
BlockAboutConfig = false;
|
||||
BlockAboutProfiles = false;
|
||||
BlockAboutSupport = false;
|
||||
|
||||
DontCheckDefaultBrowser = true;
|
||||
HardwareAcceleration = true;
|
||||
OfferToSaveLogins = false;
|
||||
DefaultDownloadDirectory = "$HOME/Downloads";
|
||||
PromptForDownloadLocation = true;
|
||||
DisplayBookmarksToolbar = "never";
|
||||
|
||||
Preferences = {
|
||||
"privacy.globalprivacycontrol.enabled" = {
|
||||
Value = true;
|
||||
Status = "locked";
|
||||
};
|
||||
"privacy.globalprivacycontrol.functionality.enabled" = {
|
||||
Value = true;
|
||||
Status = "locked";
|
||||
};
|
||||
};
|
||||
|
||||
# DuckDuckGo est un moteur intégré à Firefox, pas besoin de l'Add.
|
||||
Homepage = {
|
||||
URL = "https://duckduckgo.com";
|
||||
Locked = true;
|
||||
StartPage = "homepage";
|
||||
};
|
||||
SearchEngines = {
|
||||
Default = "DuckDuckGo";
|
||||
PreventInstalls = true;
|
||||
};
|
||||
|
||||
"browser.aboutConfig.showWarning" = {
|
||||
Value = false;
|
||||
Status = "locked";
|
||||
};
|
||||
|
||||
NewTabPage = false;
|
||||
|
||||
ExtensionSettings = {
|
||||
"uBlock0@raymondhill.net" = {
|
||||
|
||||
Reference in New Issue
Block a user