Add firefox user.js preference as a code

And fix the role ideompotent testing

5 files changed, 106 insertions, 8 deletions

diff --git a/roles/firefox/defaults/main.yml b/roles/firefox/defaults/main.yml
index dc53080f..2d24c7dc 100644
--- a/roles/firefox/defaults/main.yml
+++ b/roles/firefox/defaults/main.yml
@@ -6,6 +6,32 @@
 # and converted into JSON format using a Jinja2 tojson filter.
 firefox_policies_override: {}
 firefox_extra_extensions: {}
+firefox_user_prefs_override: {}
+
+# Default user preferences for Firefox.
+firefox_default_user_prefs:
+  "browser.newtabpage.enabled": false
+  "browser.aboutConfig.showWarning": false
+  "browser.tabs.closeWindowWithLastTab": false
+  "privacy.trackingprotection.enabled": true
+  "privacy.trackingprotection.socialtracking.enabled": true
+  "privacy.donottrackheader.enabled": true
+  "dom.security.https_only_mode": true
+  "dom.security.https_only_mode_ever_enabled": true
+  "datareporting.healthreport.uploadEnabled": false
+  "datareporting.policy.dataSubmissionEnabled": false
+  "toolkit.telemetry.unified": false
+  "toolkit.telemetry.enabled": false
+  "toolkit.telemetry.server": ""
+  "toolkit.telemetry.archive.enabled": false
+  "toolkit.telemetry.newProfilePing.enabled": false
+  "toolkit.telemetry.shutdownPingSender.enabled": false
+  "toolkit.telemetry.updatePing.enabled": false
+  "toolkit.telemetry.bhrPing.enabled": false
+  "toolkit.telemetry.firstShutdownPing.enabled": false
+  "extensions.pocket.enabled": false
+  "sidebar.verticalTabs": true
+  "sidebar.verticalTabs.dragToPinPromo.dismissed": true
 
 # Default extensions to be installed in Firefox.
 firefox_default_extensions:
diff --git a/roles/firefox/meta/argument_specs.yml b/roles/firefox/meta/argument_specs.yml
index ebae7a94..13f9f61d 100644
--- a/roles/firefox/meta/argument_specs.yml
+++ b/roles/firefox/meta/argument_specs.yml
@@ -1,6 +1,8 @@
 ---
 # NOTE: The defaults below are sensible role defaults and are not meant to be changed directly.
-# Use the override variables (firefox_policies_override, firefox_extra_extensions) to customize behavior.
+# Use the override variables (firefox_policies_override, firefox_extra_extensions, firefox_user_prefs_override)
+# to customize behavior.
+# But also you can change these defaults directly.
 argument_specs:
   main:
     short_description: "Configure firefox settings and policies"
@@ -8,12 +10,16 @@ argument_specs:
     options:
       firefox_policies_override:
         type: "dict"
-        description: "Override default firefox policies"
+        description: "Override role's default firefox policies"
         default: {}
       firefox_extra_extensions:
         type: "dict"
         description: "Extra firefox extensions to install via policies (added to the default extensions)"
         default: {}
+      firefox_user_prefs_override:
+        type: "dict"
+        description: "Override role's default user pref (user.js preferences for Firefox profile)"
+        default: {}
       firefox_default_extensions:
         # Default extensions to be installed in Firefox via policies
         # - uBlock Origin
@@ -134,3 +140,29 @@ argument_specs:
             FirfoxLabs: false
           UseSystemPrintDialog: true
           VisualSearchEnabled: true
+      firefox_default_user_prefs:
+        type: "dict"
+        description: "Default (sensible) user.js preference for Firefox"
+        default:
+          "browser.newtabpage.enabled": false
+          "browser.aboutConfig.showWarning": false
+          "browser.tabs.closeWindowWithLastTab": false
+          "privacy.trackingprotection.enabled": true
+          "privacy.trackingprotection.socialtracking.enabled": true
+          "privacy.donottrackheader.enabled": true
+          "dom.security.https_only_mode": true
+          "dom.security.https_only_mode_ever_enabled": true
+          "datareporting.healthreport.uploadEnabled": false
+          "datareporting.policy.dataSubmissionEnabled": false
+          "toolkit.telemetry.unified": false
+          "toolkit.telemetry.enabled": false
+          "toolkit.telemetry.server": ""
+          "toolkit.telemetry.archive.enabled": false
+          "toolkit.telemetry.newProfilePing.enabled": false
+          "toolkit.telemetry.shutdownPingSender.enabled": false
+          "toolkit.telemetry.updatePing.enabled": false
+          "toolkit.telemetry.bhrPing.enabled": false
+          "toolkit.telemetry.firstShutdownPing.enabled": false
+          "extensions.pocket.enabled": false
+          "sidebar.verticalTabs": true
+          "sidebar.verticalTabs.dragToPinPromo.dismissed": true
diff --git a/roles/firefox/tasks/install_passff.yml b/roles/firefox/tasks/install_passff.yml
index fbce12ee..00bb76eb 100644
--- a/roles/firefox/tasks/install_passff.yml
+++ b/roles/firefox/tasks/install_passff.yml
@@ -25,7 +25,7 @@
     set -euo pipefail
     curl -sSL https://codeberg.org/PassFF/passff-host/releases/download/latest/install_host_app.sh | bash -s -- firefox
   args:
-    creates: "/usr/lib/mozilla/native-messaging-hosts/pro.invicem.passff.json"
+    creates: "/usr/lib/mozilla/native-messaging-hosts/passff.py"
     executable: "/bin/bash"
 
 - name: "Create browserpass native messaging hosts file"
diff --git a/roles/firefox/tasks/main.yml b/roles/firefox/tasks/main.yml
index 00cfdd2e..5a75e001 100644
--- a/roles/firefox/tasks/main.yml
+++ b/roles/firefox/tasks/main.yml
@@ -8,17 +8,44 @@
     name: "{{ firefox_package }}"
     state: "present"
 
-- name: "Create Firefox profile"
-  ansible.builtin.command: "firefox --headless -no-remote -CreateProfile ansible-profile"
+- name: "Initialize Firefox default profile"
+  ansible.builtin.command: "timeout 3 firefox --headless"
+  failed_when: false
   args:
-    creates: "{{ firefox_folder }}/*ansible-profile/prefs.js"
+    creates: "{{ firefox_folder }}/profiles.ini"
+  changed_when: false
+
+- name: "Find default Firefox profile directory"
+  ansible.builtin.find:
+    paths: "{{ firefox_folder }}"
+    patterns: "*.default*"
+    file_type: "directory"
+  register: firefox_default_profile
+
+- name: "Set Firefox profile path"
+  ansible.builtin.set_fact:
+    firefox_profile_path: "{{ firefox_default_profile.files[0].path }}"
+  when: firefox_default_profile.matched > 0
+
+- name: "Set firefox_user_prefs fact"
+  ansible.builtin.set_fact:
+    firefox_user_prefs: "{{ firefox_default_user_prefs | combine(firefox_user_prefs_override) }}"
+
+- name: "Deploy user.js to Firefox profile"
+  ansible.builtin.template:
+    src: "user.js.j2"
+    dest: "{{ firefox_profile_path }}/user.js"
+    mode: "0644"
 
 - name: "Install browserpass extension for Firefox"
   ansible.builtin.include_tasks: "install_browserpass.yml"
   when: firefox_install_browserpass | default(false)
 
-# NOTE: passff extension is using sed during install and python to run
-# That's why the firefox role depends on these roles
+# NOTE: passff extension is using sed/curl during install and python/pass to run
+# Make sure those dependencies are installed on the target system before enabling this part.
+# It doesn't make a lot of sense to have all these dependencies added to the firefox role, just for using
+# this extension, which isn't enabled by default.
+# Personally I find it has better UI/UX than browserpass, but browserpass is more lightweight.
 - name: "Install passff extension for Firefox"
   ansible.builtin.include_tasks: "install_passff.yml"
   when: firefox_install_passff | default(false)
diff --git a/roles/firefox/templates/user.js.j2 b/roles/firefox/templates/user.js.j2
new file mode 100644
index 00000000..547ccf8f
--- /dev/null
+++ b/roles/firefox/templates/user.js.j2
@@ -0,0 +1,13 @@
+// Firefox user.js - User preferences
+// This file is automatically generated by Ansible
+// Manual changes will be overwritten
+
+{% for pref, value in firefox_user_prefs.items() %}
+{% if value is string %}
+user_pref("{{ pref }}", "{{ value }}");
+{% elif value is boolean %}
+user_pref("{{ pref }}", {{ value | lower }});
+{% else %}
+user_pref("{{ pref }}", {{ value }});
+{% endif %}
+{% endfor %}