Install zen-browser (re-skinned firefox)

4 files changed, 142 insertions, 0 deletions

diff --git a/roles/zen-browser/tasks/install-archlinux.yml b/roles/zen-browser/tasks/install-archlinux.yml
new file mode 100644
index 00000000..63be8607
--- /dev/null
+++ b/roles/zen-browser/tasks/install-archlinux.yml
@@ -0,0 +1,14 @@
+---
+- name: "Ensure Zen Browser is installed"
+  become: true
+  become_user: "aur_builder"
+  kewlfft.aur.aur:
+    name: "zen-browser-bin"
+    state: "present"
+    use: "yay"
+
+- name: "Set Zen Browser as default"
+  ansible.builtin.command:
+    cmd: "xdg-settings set default-web-browser zen-browser-bin.desktop"
+  changed_when: false
+  when: zen_browser_is_default | default(false)
diff --git a/roles/zen-browser/tasks/install-plugin-browserpass.yml b/roles/zen-browser/tasks/install-plugin-browserpass.yml
new file mode 100644
index 00000000..f9a7c7e2
--- /dev/null
+++ b/roles/zen-browser/tasks/install-plugin-browserpass.yml
@@ -0,0 +1,48 @@
+---
+- name: "Add browserpass to default extensions"
+  ansible.builtin.set_fact:
+    zen_browser_default_extensions: "{{ zen_browser_default_extensions | combine(zen_browser_browserpass_extension) }}"
+  vars:
+    zen_browser_browserpass_extension:
+      "[email protected]":
+        installation_mode: "force_installed"
+        install_url: "https://addons.mozilla.org/firefox/downloads/latest/browserpass-ce/latest.xpi"
+
+- name: "Ensure browserpass native messaging host is installed"
+  become: true
+  ansible.builtin.package:
+    name: "browserpass"
+    state: "present"
+
+- name: "Create native messaging hosts directory"
+  become: true
+  ansible.builtin.file:
+    path: "/usr/lib/mozilla/native-messaging-hosts"
+    state: "directory"
+    mode: "0755"
+
+- name: "Create browserpass native messaging hosts file"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/mozilla/native-messaging-hosts/com.github.browserpass.native.json"
+    mode: "0644"
+    content: |
+      {
+          "name": "com.github.browserpass.native",
+          "description": "Browserpass native component for the Zen Browser extension",
+          "path": "/usr/lib/browserpass/browserpass-wrapper",
+          "type": "stdio",
+          "allowed_extensions": ["[email protected]"]
+      }
+
+- name: "Create browserpass-native wrapper"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/browserpass/browserpass-wrapper"
+    mode: "0755"
+    content: |
+      #!/bin/sh
+      # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case.
+      # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper
+      export PINENTRY_USER_DATA=gnome
+      exec /usr/lib/browserpass/browserpass-native "$@"
diff --git a/roles/zen-browser/tasks/install-plugin-passff.yml b/roles/zen-browser/tasks/install-plugin-passff.yml
new file mode 100644
index 00000000..a8d04f9b
--- /dev/null
+++ b/roles/zen-browser/tasks/install-plugin-passff.yml
@@ -0,0 +1,55 @@
+---
+# NOTE: This part of the role depends on
+# - role: "curl"
+# - role: "sed"
+# - role: "python"
+# - role: "bash"
+# - role: "password_store"
+#
+# As it uses these tools to install and run passff.
+# The curl, sed, bash are used for installation.
+# Python is used to run the passff native messaging host.
+# pass is required by passff to access the password store, and errors when not found.
+- name: "Add passff to default extensions"
+  ansible.builtin.set_fact:
+    zen_browser_default_extensions: "{{ zen_browser_default_extensions | combine(zen_browser_passff_extension) }}"
+  vars:
+    zen_browser_passff_extension:
+      "[email protected]":
+        installation_mode: "force_installed"
+        install_url: "https://addons.mozilla.org/firefox/downloads/latest/passff/latest.xpi"
+
+- name: "Ensure passff native messaging host is installed"
+  become: true
+  ansible.builtin.shell: |
+    set -euo pipefail
+    curl -sSL https://codeberg.org/PassFF/passff-host/releases/download/latest/install_host_app.sh | bash -s -- firefox
+  args:
+    creates: "/usr/lib/mozilla/native-messaging-hosts/passff.py"
+    executable: "/bin/bash"
+
+- name: "Create passff native messaging hosts file"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/mozilla/native-messaging-hosts/passff.json"
+    mode: "0644"
+    content: |
+      {
+        "name": "passff",
+        "description": "Host for communicating with zx2c4 pass",
+        "path": "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper",
+        "type": "stdio",
+        "allowed_extensions": [ "[email protected]" ]
+      }
+
+- name: "Create passff wrapper"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper"
+    mode: "0755"
+    content: |
+      #!/bin/sh
+      # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case.
+      # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper
+      export PINENTRY_USER_DATA=gnome
+      exec /usr/lib/mozilla/native-messaging-hosts/passff.py "$@"
diff --git a/roles/zen-browser/tasks/main.yml b/roles/zen-browser/tasks/main.yml
new file mode 100644
index 00000000..5f6c9dbb
--- /dev/null
+++ b/roles/zen-browser/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+- name: "Include OS-specific tasks"
+  ansible.builtin.include_tasks: "install-{{ ansible_facts['os_family'] | lower }}.yml"
+
+- name: "Install browserpass extension for Zen Browser"
+  ansible.builtin.include_tasks: "install-plugin-browserpass.yml"
+  when: zen_browser_install_browserpass | default(false)
+
+- name: "Install passff extension for Zen Browser"
+  ansible.builtin.include_tasks: "install-plugin-passff.yml"
+  when: zen_browser_install_passff | default(false)
+
+- name: "Set zen_browser_policies fact"
+  ansible.builtin.set_fact:
+    zen_browser_policies: "{{ zen_browser_default_policies | combine(zen_browser_policies_override) }}"
+
+- name: "Create Zen Browser policies file"
+  become: true
+  ansible.builtin.copy:
+    dest: "/opt/zen-browser-bin/distribution/policies.json"
+    mode: "0644"
+    content: |
+      {
+        "policies": {{ zen_browser_policies | tojson(indent=4) }}
+      }