add ublock origin and sideberry

flake.lock

@@ -275,6 +275,21 @@
         "type": "github"
       }
     },
+    "nur": {
+      "locked": {
+        "lastModified": 1730885145,
+        "narHash": "sha256-UPrBEY0No1O3ULb67xYjRh2r3u7MnZovfo1oYSPCIxI=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "c0d8828600ef47d475e6ec33513bf9af6eb6b991",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
     "plasma-manager": {
       "inputs": {
         "home-manager": "home-manager_2",
@@ -359,6 +374,7 @@
         "nix2container": "nix2container",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
+        "nur": "nur",
         "plasma-manager": "plasma-manager",
         "pre-commit-hooks": "pre-commit-hooks",
         "riscv-overlay": "riscv-overlay",

flake.nix

@@ -49,6 +49,7 @@
     };
     nixos-hardware.url = "github:NixOS/nixos-hardware";
     nixpkgs.url = "github:nixos/nixpkgs";
+    nur.url = "github:nix-community/NUR";
     plasma-manager = {
       url = "github:nix-community/plasma-manager";
       inputs.nixpkgs.follows = "nixpkgs";

modules/default.nix

@@ -2,6 +2,7 @@
   disko,
   home-manager,
   lib,
+  nur,
   ...
 }:
 with lib; {
@@ -14,6 +15,7 @@ with lib; {
     disko.nixosModules.default
     ./hydra/build-server.nix
     "${home-manager}/nixos"
+    nur.nixosModules.nur
   ];
   options.isGraphical = mkEnableOption "Whether or not this configuration is a graphical install";
   options.isInstaller = mkEnableOption "Whether or not this configuration is an installer and has no access to secrets";

programs/desktop/firefox/default.nix

@@ -1,17 +1,60 @@
 {
   pkgs,
   config,
+  lib,
   ...
-}: {
+}: let
+  extensions = {
+    "ublock-origin" = [
+      "alarms"
+      "dns"
+      "menus"
+      "privacy"
+      "storage"
+      "tabs"
+      "unlimitedStorage"
+      "webNavigation"
+      "webRequest"
+      "webRequestBlocking"
+      "<all_urls>"
+      "http://*/*"
+      "https://*/*"
+      "file://*/*"
+      "https://easylist.to/*"
+      "https://*.fanboy.co.nz/*"
+      "https://filterlists.com/*"
+      "https://forums.lanik.us/*"
+      "https://github.com/*"
+      "https://*.github.io/*"
+      "https://github.com/uBlockOrigin/*"
+      "https://ublockorigin.github.io/*"
+      "https://*.reddit.com/r/uBlockOrigin/*"
+    ];
+    "sidebery" = [
+      "activeTab"
+      "tabs"
+      "contextualIdentities"
+      "cookies"
+      "storage"
+      "unlimitedStorage"
+      "sessions"
+      "menus"
+      "menus.overrideContext"
+      "search"
+      "theme"
+    ];
+  };
+in {
   programs.firefox = {
     enable = true;
     profiles.default = {
       containersForce = true;
-      extensions = []; # TODO
+      extensions = map (v: config.nur.repos.rycee.firefox-addons.${v}) (lib.attrKeys extensions);
       settings = {
         "extensions.autoDisableScopes" = 0;
       };
       userChrome = ''
+        @namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
         #main-window #titlebar {
           overflow: hidden;
           transition: height 0.3s 0.3s !important;
@@ -27,4 +70,16 @@
       '';
     };
   };
+  assertions =
+    lib.mapAttrsToList (k: v: let
+      unaccepted =
+        lib.subtractLists
+        v
+        config.nur.repos.rycee.firefox-addons.${k}.meta.mozPermissions;
+    in {
+      assertion = unaccepted == [];
+      message = ''
+        Extension ${k} has unaccepted permissions: ${builtins.toJSON unaccepted}'';
+    })
+    extensions;
 }