Install zen-browser (re-skinned firefox)

9 files changed, 429 insertions, 0 deletions

diff --git a/configure.yml b/configure.yml
index fc508189..11039705 100644
--- a/configure.yml
+++ b/configure.yml
@@ -39,6 +39,7 @@
     - role: "ansible"
     - role: "claude"
     - role: "firefox"
+    - role: "zen-browser"
     - role: "chromium"
     - role: "obsidian"
     - role: "microsoft-teams"
diff --git a/host_vars/archlinux.local.yml b/host_vars/archlinux.local.yml
index e3ab1701..7b671da3 100644
--- a/host_vars/archlinux.local.yml
+++ b/host_vars/archlinux.local.yml
diff --git a/roles/zen-browser/defaults/main.yml b/roles/zen-browser/defaults/main.yml
new file mode 100644
index 00000000..a29a073b
--- /dev/null
+++ b/roles/zen-browser/defaults/main.yml
@@ -0,0 +1,124 @@
+---
+# Check firefox policies documentation at:
+# https://mozilla.github.io/policy-templates/
+# The policies override dictionary can be used to override the default policies.
+# This is merged with the zen_browser_default_policies dictionary,
+# and converted into JSON format using a Jinja2 tojson filter.
+zen_browser_policies_override: {}
+zen_browser_extra_extensions: {}
+
+# Default extensions to be installed in Zen Browser.
+zen_browser_default_extensions:
+  "*":
+    installation_mode: "allowed" # options: allowed, blocked, force_installed, normal_installed
+    allowed_types:
+      - "extension"
+      - "theme"
+      - "dictionary"
+      - "locale"
+  # Get the guid using `curl -s "https://addons.mozilla.org/api/v5/addons/addon/{slug}/" | jq '.guid'`
+  # where the {slug} is found on the https://addons.mozilla.org/en-US/firefox/ search.
+  "[email protected]":
+    installation_mode: "force_installed"
+    install_url: "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
+  "{d7742d87-e61d-4b78-b8a1-b469842139fa}":
+    installation_mode: "force_installed"
+    install_url: "https://addons.mozilla.org/firefox/downloads/latest/vimium-ff/latest.xpi"
+  "jid1-MnnxcxisBPnSXQ@jetpack":
+    installation_mode: "force_installed"
+    install_url: "https://addons.mozilla.org/firefox/downloads/latest/privacy-badger17/latest.xpi"
+  "woop-NoopscooPsnSXQ@jetpack":
+    installation_mode: "force_installed"
+    install_url: "https://addons.mozilla.org/firefox/downloads/latest/privacy-possum/latest.xpi"
+  "[email protected]":
+    installation_mode: "force_installed"
+    install_url: "https://addons.mozilla.org/firefox/downloads/latest/languagetool/latest.xpi"
+
+# Default (sensible) policies for Zen Browser.
+zen_browser_default_policies:
+  AutofillAddressEnabled: true
+  AutofillCreditCardEnabled: false
+  BlockAboutAddons: false
+  BlockAboutConfig: false
+  BlockAboutProfiles: false
+  BlockAboutSupport: false
+  CaptivePortal: true
+  DisableDeveloperTools: false
+  DisableEncryptedClientHello: false
+  DisableFeedbackCommands: true
+  DisableFirefoxAccounts: false
+  DisableFirefoxScreenshots: true
+  DisableFirefoxStudies: true
+  DisablePasswordReveal: false
+  DisableProfileImport: true
+  DisableProfileRefresh: true
+  DisableSafeMode: false
+  DisableTelemetry: true
+  DisablePocket: true
+  DisplayBookmarksToolbar: "always" # options: always, never, newtab
+  DisplayMenuBar: "default-on" # options: always, never, default-on, default-off
+  DNSOverHTTPS:
+    Enabled: true
+    Fallback: true
+  DontCheckDefaultBrowser: true
+  EnableTrackingProtection:
+    Value: true
+    Category: "strict" # options: standard, strict
+  ExtensionSettings:
+    "{{ zen_browser_default_extensions | combine(zen_browser_extra_extensions) }}"
+  FirefoxHome:
+    Search: true
+    TopSites: true
+    SponsoredTopSites: false
+    SponsoredPocket: false
+    SponsoredStories: false
+    Highlights: true
+    Pocket: false
+    Stories: false
+    Snippets: true
+    Locked: false
+  FirefoxSuggest:
+    WebSuggestions: false
+    SponsoredSuggestions: false
+    ImproveSuggest: false
+    Locked: false
+    GenerativeAI:
+      Enabled: false
+      Locked: false
+  Homepage:
+    StartupPage: "homepage" # options: none, homepage, previous-session, homepage-locked
+  HttpsOnlyMode: "enabled" # options: allowed, disallowed, enabled, force_enabled
+  LegacyProfiles: false
+  PasswordManagerEnabled: false
+  PictureInPicture:
+    Enabled: true
+  PostQuantumKeyAgreementEnabled: true
+  PrintingEnabled: true
+  PrivateBrowsingModeAvailability: 0 # options: 0 (enabled), 1 (disabled), 2 (forced)
+  RequestedLocales:
+    - "en-US"
+    - "de"
+  SearchBar: "unified" # options: unified, separate
+  SearchEngines:
+    Default: "DuckDuckGo"
+    PreventInstalls: true
+    Remove:
+      - "Bing"
+      - "Ecosia"
+      - "Amazon"
+      - "eBay"
+      - "Twitter"
+      - "Wikipedia (en)"
+  SearchSuggestEnabled: true
+  ShowHomeButton: false
+  SkipTermsOfUse: true
+  TranslateEnabled: true
+  UserMessaging:
+    ExtensionRecommendations: false
+    FeatureRecommendations: false
+    UrlbarInterventions: false
+    SkipOnboarding: true
+    MoreFromMozilla: false
+    FirfoxLabs: false
+  UseSystemPrintDialog: true
+  VisualSearchEnabled: true
diff --git a/roles/zen-browser/meta/argument_specs.yml b/roles/zen-browser/meta/argument_specs.yml
new file mode 100644
index 00000000..64120e24
--- /dev/null
+++ b/roles/zen-browser/meta/argument_specs.yml
@@ -0,0 +1,150 @@
+---
+# NOTE: The defaults below are sensible role defaults and are not meant to be changed directly.
+# Use the override variables (zen_browser_policies_override, zen_browser_extra_extensions)
+# to customize behavior.
+# But also you can change these defaults directly.
+argument_specs:
+  main:
+    short_description: "Install and configure Zen Browser settings and policies"
+    description: "Install and configure Zen Browser settings and policies"
+    options:
+      zen_browser_is_default:
+        type: "bool"
+        description: "Set Zen Browser as the default web browser"
+        default: false
+      zen_browser_install_browserpass:
+        type: "bool"
+        description: "Install the browserpass extension and native messaging host"
+        default: false
+      zen_browser_install_passff:
+        type: "bool"
+        description: "Install the passff extension and native messaging host"
+        default: false
+      zen_browser_policies_override:
+        type: "dict"
+        description: "Override role's default Zen Browser policies"
+        default: {}
+      zen_browser_extra_extensions:
+        type: "dict"
+        description: "Extra extensions to install via policies (added to the default extensions)"
+        default: {}
+      zen_browser_default_extensions:
+        # Default extensions to be installed via policies
+        # - uBlock Origin
+        # - Vimium FF
+        # - Privacy Badger
+        # - Privacy Possum
+        # - LanguageTool
+        type: "dict"
+        description: "Default Zen Browser extensions configurations to install via policies"
+        default:
+          "*":
+            installation_mode: "allowed"
+            allowed_types:
+              - "extension"
+              - "theme"
+              - "dictionary"
+              - "locale"
+          "[email protected]":
+            installation_mode: "force_installed"
+            install_url: "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
+          "{d7742d87-e61d-4b78-b8a1-b469842139fa}":
+            installation_mode: "force_installed"
+            install_url: "https://addons.mozilla.org/firefox/downloads/latest/vimium-ff/latest.xpi"
+          "jid1-MnnxcxisBPnSXQ@jetpack":
+            installation_mode: "force_installed"
+            install_url: "https://addons.mozilla.org/firefox/downloads/latest/privacy-badger17/latest.xpi"
+          "woop-NoopscooPsnSXQ@jetpack":
+            installation_mode: "force_installed"
+            install_url: "https://addons.mozilla.org/firefox/downloads/latest/privacy-possum/latest.xpi"
+          "[email protected]":
+            installation_mode: "force_installed"
+            install_url: "https://addons.mozilla.org/firefox/downloads/latest/languagetool/latest.xpi"
+      zen_browser_default_policies:
+        type: "dict"
+        description: "Default (sensible) policies for Zen Browser"
+        default:
+          AutofillAddressEnabled: true
+          AutofillCreditCardEnabled: false
+          BlockAboutAddons: false
+          BlockAboutConfig: false
+          BlockAboutProfiles: false
+          BlockAboutSupport: false
+          CaptivePortal: true
+          DisableDeveloperTools: false
+          DisableEncryptedClientHello: false
+          DisableFeedbackCommands: true
+          DisableFirefoxAccounts: false
+          DisableFirefoxScreenshots: true
+          DisableFirefoxStudies: true
+          DisablePasswordReveal: false
+          DisableProfileImport: true
+          DisableProfileRefresh: true
+          DisableSafeMode: false
+          DisableTelemetry: true
+          DisablePocket: true
+          DisplayBookmarksToolbar: "always"
+          DisplayMenuBar: "default-on"
+          DNSOverHTTPS:
+            Enabled: true
+            Fallback: true
+          DontCheckDefaultBrowser: true
+          EnableTrackingProtection:
+            Value: true
+            Category: "strict"
+          FirefoxHome:
+            Search: true
+            TopSites: true
+            SponsoredTopSites: false
+            SponsoredPocket: false
+            SponsoredStories: false
+            Highlights: true
+            Pocket: false
+            Stories: false
+            Snippets: true
+            Locked: false
+          FirefoxSuggest:
+            WebSuggestions: false
+            SponsoredSuggestions: false
+            ImproveSuggest: false
+            Locked: false
+            GenerativeAI:
+              Enabled: false
+              Locked: false
+          Homepage:
+            StartupPage: "homepage"
+          HttpsOnlyMode: "enabled"
+          LegacyProfiles: false
+          PasswordManagerEnabled: false
+          PictureInPicture:
+            Enabled: true
+          PostQuantumKeyAgreementEnabled: true
+          PrintingEnabled: true
+          PrivateBrowsingModeAvailability: 0
+          RequestedLocales:
+            - "en-US"
+            - "de"
+          SearchBar: "unified"
+          SearchEngines:
+            Default: "DuckDuckGo"
+            PreventInstalls: true
+            Remove:
+              - "Bing"
+              - "Ecosia"
+              - "Amazon"
+              - "eBay"
+              - "Twitter"
+              - "Wikipedia (en)"
+          SearchSuggestEnabled: true
+          ShowHomeButton: false
+          SkipTermsOfUse: true
+          TranslateEnabled: true
+          UserMessaging:
+            ExtensionRecommendations: false
+            FeatureRecommendations: false
+            UrlbarInterventions: false
+            SkipOnboarding: true
+            MoreFromMozilla: false
+            FirfoxLabs: false
+          UseSystemPrintDialog: true
+          VisualSearchEnabled: true
diff --git a/roles/zen-browser/meta/main.yml b/roles/zen-browser/meta/main.yml
new file mode 100644
index 00000000..3cd59bdf
--- /dev/null
+++ b/roles/zen-browser/meta/main.yml
@@ -0,0 +1,12 @@
+---
+dependencies:
+  - role: "xdg-utils"
+galaxy_info:
+  author: "a14m"
+  description: "Install and configure Zen Browser settings and policies."
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
diff --git a/roles/zen-browser/tasks/install-archlinux.yml b/roles/zen-browser/tasks/install-archlinux.yml
new file mode 100644
index 00000000..63be8607
--- /dev/null
+++ b/roles/zen-browser/tasks/install-archlinux.yml
@@ -0,0 +1,14 @@
+---
+- name: "Ensure Zen Browser is installed"
+  become: true
+  become_user: "aur_builder"
+  kewlfft.aur.aur:
+    name: "zen-browser-bin"
+    state: "present"
+    use: "yay"
+
+- name: "Set Zen Browser as default"
+  ansible.builtin.command:
+    cmd: "xdg-settings set default-web-browser zen-browser-bin.desktop"
+  changed_when: false
+  when: zen_browser_is_default | default(false)
diff --git a/roles/zen-browser/tasks/install-plugin-browserpass.yml b/roles/zen-browser/tasks/install-plugin-browserpass.yml
new file mode 100644
index 00000000..f9a7c7e2
--- /dev/null
+++ b/roles/zen-browser/tasks/install-plugin-browserpass.yml
@@ -0,0 +1,48 @@
+---
+- name: "Add browserpass to default extensions"
+  ansible.builtin.set_fact:
+    zen_browser_default_extensions: "{{ zen_browser_default_extensions | combine(zen_browser_browserpass_extension) }}"
+  vars:
+    zen_browser_browserpass_extension:
+      "[email protected]":
+        installation_mode: "force_installed"
+        install_url: "https://addons.mozilla.org/firefox/downloads/latest/browserpass-ce/latest.xpi"
+
+- name: "Ensure browserpass native messaging host is installed"
+  become: true
+  ansible.builtin.package:
+    name: "browserpass"
+    state: "present"
+
+- name: "Create native messaging hosts directory"
+  become: true
+  ansible.builtin.file:
+    path: "/usr/lib/mozilla/native-messaging-hosts"
+    state: "directory"
+    mode: "0755"
+
+- name: "Create browserpass native messaging hosts file"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/mozilla/native-messaging-hosts/com.github.browserpass.native.json"
+    mode: "0644"
+    content: |
+      {
+          "name": "com.github.browserpass.native",
+          "description": "Browserpass native component for the Zen Browser extension",
+          "path": "/usr/lib/browserpass/browserpass-wrapper",
+          "type": "stdio",
+          "allowed_extensions": ["[email protected]"]
+      }
+
+- name: "Create browserpass-native wrapper"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/browserpass/browserpass-wrapper"
+    mode: "0755"
+    content: |
+      #!/bin/sh
+      # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case.
+      # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper
+      export PINENTRY_USER_DATA=gnome
+      exec /usr/lib/browserpass/browserpass-native "$@"
diff --git a/roles/zen-browser/tasks/install-plugin-passff.yml b/roles/zen-browser/tasks/install-plugin-passff.yml
new file mode 100644
index 00000000..a8d04f9b
--- /dev/null
+++ b/roles/zen-browser/tasks/install-plugin-passff.yml
@@ -0,0 +1,55 @@
+---
+# NOTE: This part of the role depends on
+# - role: "curl"
+# - role: "sed"
+# - role: "python"
+# - role: "bash"
+# - role: "password_store"
+#
+# As it uses these tools to install and run passff.
+# The curl, sed, bash are used for installation.
+# Python is used to run the passff native messaging host.
+# pass is required by passff to access the password store, and errors when not found.
+- name: "Add passff to default extensions"
+  ansible.builtin.set_fact:
+    zen_browser_default_extensions: "{{ zen_browser_default_extensions | combine(zen_browser_passff_extension) }}"
+  vars:
+    zen_browser_passff_extension:
+      "[email protected]":
+        installation_mode: "force_installed"
+        install_url: "https://addons.mozilla.org/firefox/downloads/latest/passff/latest.xpi"
+
+- name: "Ensure passff native messaging host is installed"
+  become: true
+  ansible.builtin.shell: |
+    set -euo pipefail
+    curl -sSL https://codeberg.org/PassFF/passff-host/releases/download/latest/install_host_app.sh | bash -s -- firefox
+  args:
+    creates: "/usr/lib/mozilla/native-messaging-hosts/passff.py"
+    executable: "/bin/bash"
+
+- name: "Create passff native messaging hosts file"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/mozilla/native-messaging-hosts/passff.json"
+    mode: "0644"
+    content: |
+      {
+        "name": "passff",
+        "description": "Host for communicating with zx2c4 pass",
+        "path": "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper",
+        "type": "stdio",
+        "allowed_extensions": [ "[email protected]" ]
+      }
+
+- name: "Create passff wrapper"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper"
+    mode: "0755"
+    content: |
+      #!/bin/sh
+      # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case.
+      # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper
+      export PINENTRY_USER_DATA=gnome
+      exec /usr/lib/mozilla/native-messaging-hosts/passff.py "$@"
diff --git a/roles/zen-browser/tasks/main.yml b/roles/zen-browser/tasks/main.yml
new file mode 100644
index 00000000..5f6c9dbb
--- /dev/null
+++ b/roles/zen-browser/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+- name: "Include OS-specific tasks"
+  ansible.builtin.include_tasks: "install-{{ ansible_facts['os_family'] | lower }}.yml"
+
+- name: "Install browserpass extension for Zen Browser"
+  ansible.builtin.include_tasks: "install-plugin-browserpass.yml"
+  when: zen_browser_install_browserpass | default(false)
+
+- name: "Install passff extension for Zen Browser"
+  ansible.builtin.include_tasks: "install-plugin-passff.yml"
+  when: zen_browser_install_passff | default(false)
+
+- name: "Set zen_browser_policies fact"
+  ansible.builtin.set_fact:
+    zen_browser_policies: "{{ zen_browser_default_policies | combine(zen_browser_policies_override) }}"
+
+- name: "Create Zen Browser policies file"
+  become: true
+  ansible.builtin.copy:
+    dest: "/opt/zen-browser-bin/distribution/policies.json"
+    mode: "0644"
+    content: |
+      {
+        "policies": {{ zen_browser_policies | tojson(indent=4) }}
+      }