From 7b8b6a2af4adeba5b2005e449195c1f4e8a136c6 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Sun, 22 Feb 2026 03:04:59 +0100 Subject: Refactor firefox role to use flatpak on debian --- roles/firefox/meta/main.yml | 2 + roles/firefox/tasks/install-archlinux.yml | 12 +++++ roles/firefox/tasks/install-debian.yml | 20 ++++++++ roles/firefox/tasks/install-plugin-browserpass.yml | 48 +++++++++++++++++++ roles/firefox/tasks/install-plugin-passff.yml | 55 ++++++++++++++++++++++ roles/firefox/tasks/install_browserpass.yml | 48 ------------------- roles/firefox/tasks/install_passff.yml | 55 ---------------------- roles/firefox/tasks/main.yml | 21 ++------- roles/firefox/vars/archlinux.yml | 2 - roles/firefox/vars/debian.yml | 4 +- roles/firefox/vars/ubuntu.yml | 8 ---- 11 files changed, 143 insertions(+), 132 deletions(-) create mode 100644 roles/firefox/tasks/install-archlinux.yml create mode 100644 roles/firefox/tasks/install-debian.yml create mode 100644 roles/firefox/tasks/install-plugin-browserpass.yml create mode 100644 roles/firefox/tasks/install-plugin-passff.yml delete mode 100644 roles/firefox/tasks/install_browserpass.yml delete mode 100644 roles/firefox/tasks/install_passff.yml delete mode 100644 roles/firefox/vars/ubuntu.yml diff --git a/roles/firefox/meta/main.yml b/roles/firefox/meta/main.yml index 2f0ca096..cae9c8ff 100644 --- a/roles/firefox/meta/main.yml +++ b/roles/firefox/meta/main.yml @@ -1,6 +1,8 @@ --- dependencies: - role: "xdg-utils" + - role: "flatpak" + when: ansible_facts['os_family'] == "Debian" galaxy_info: author: "a14m" description: "Configure firefox settings and policies." diff --git a/roles/firefox/tasks/install-archlinux.yml b/roles/firefox/tasks/install-archlinux.yml new file mode 100644 index 00000000..69a17e4d --- /dev/null +++ b/roles/firefox/tasks/install-archlinux.yml @@ -0,0 +1,12 @@ +--- +- name: "Ensure firefox is installed" + become: true + ansible.builtin.package: + name: "firefox" + state: "present" + +- name: "Set firefox as default" + ansible.builtin.command: + cmd: "xdg-settings set default-web-browser firefox.desktop" + changed_when: false + when: firefox_is_default | default(false) diff --git a/roles/firefox/tasks/install-debian.yml b/roles/firefox/tasks/install-debian.yml new file mode 100644 index 00000000..08cf8950 --- /dev/null +++ b/roles/firefox/tasks/install-debian.yml @@ -0,0 +1,20 @@ +--- +- name: "Ensure firefox is installed via flatpak" + community.general.flatpak: + name: "org.mozilla.firefox" + remote: "flathub" + state: "present" + method: "user" + +- name: "Allow Flatpak Firefox to read system policies" + ansible.builtin.command: + cmd: "flatpak override --user --filesystem=/etc/firefox:ro org.mozilla.firefox" + changed_when: false + +- name: "Set firefox as default" + ansible.builtin.command: + cmd: "xdg-settings set default-web-browser org.mozilla.firefox.desktop" + environment: + XDG_DATA_DIRS: "{{ ansible_facts['env']['HOME'] }}/.local/share/flatpak/exports/share" + changed_when: false + when: firefox_is_default | default(false) diff --git a/roles/firefox/tasks/install-plugin-browserpass.yml b/roles/firefox/tasks/install-plugin-browserpass.yml new file mode 100644 index 00000000..50d6cef2 --- /dev/null +++ b/roles/firefox/tasks/install-plugin-browserpass.yml @@ -0,0 +1,48 @@ +--- +- name: "Add browserpass to default extensions" + ansible.builtin.set_fact: + firefox_default_extensions: "{{ firefox_default_extensions | combine(firefox_browserpass_extension) }}" + vars: + firefox_browserpass_extension: + "browserpass@maximbaz.com": + installation_mode: "force_installed" + install_url: "https://addons.mozilla.org/firefox/downloads/latest/browserpass-ce/latest.xpi" + +- name: "Ensure browserpass native messaging host is installed" + become: true + ansible.builtin.package: + name: "{{ firefox_browserpass_packages }}" + state: "present" + +- name: "Create native messaging hosts directory" + become: true + ansible.builtin.file: + path: "/usr/lib/mozilla/native-messaging-hosts" + state: "directory" + mode: "0755" + +- name: "Create browserpass native messaging hosts file" + become: true + ansible.builtin.copy: + dest: "/usr/lib/mozilla/native-messaging-hosts/com.github.browserpass.native.json" + mode: "0644" + content: | + { + "name": "com.github.browserpass.native", + "description": "Browserpass native component for the Firefox extension", + "path": "/usr/lib/browserpass/browserpass-wrapper", + "type": "stdio", + "allowed_extensions": ["browserpass@maximbaz.com"] + } + +- name: "Create browserpass-native wrapper" + become: true + ansible.builtin.copy: + dest: "/usr/lib/browserpass/browserpass-wrapper" + mode: "0755" + content: | + #!/bin/sh + # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case. + # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper + export PINENTRY_USER_DATA=gnome + exec /usr/lib/browserpass/browserpass-native "$@" diff --git a/roles/firefox/tasks/install-plugin-passff.yml b/roles/firefox/tasks/install-plugin-passff.yml new file mode 100644 index 00000000..00bb76eb --- /dev/null +++ b/roles/firefox/tasks/install-plugin-passff.yml @@ -0,0 +1,55 @@ +--- +# NOTE: This part of the role depends on +# - role: "curl" +# - role: "sed" +# - role: "python" +# - role: "bash" +# - role: "password_store" +# +# As it uses these tools to install and run passff. +# The curl, sed, bash are used for installation. +# Python is used to run the passff native messaging host. +# pass is required by passff to access the password store, and errors when not found. +- name: "Add passff to default extensions" + ansible.builtin.set_fact: + firefox_default_extensions: "{{ firefox_default_extensions | combine(firefox_passff_extension) }}" + vars: + firefox_passff_extension: + "passff@invicem.pro": + installation_mode: "force_installed" + install_url: "https://addons.mozilla.org/firefox/downloads/latest/passff/latest.xpi" + +- name: "Ensure passff native messaging host is installed" + become: true + ansible.builtin.shell: | + set -euo pipefail + curl -sSL https://codeberg.org/PassFF/passff-host/releases/download/latest/install_host_app.sh | bash -s -- firefox + args: + creates: "/usr/lib/mozilla/native-messaging-hosts/passff.py" + executable: "/bin/bash" + +- name: "Create browserpass native messaging hosts file" + become: true + ansible.builtin.copy: + dest: "/usr/lib/mozilla/native-messaging-hosts/passff.json" + mode: "0644" + content: | + { + "name": "passff", + "description": "Host for communicating with zx2c4 pass", + "path": "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper", + "type": "stdio", + "allowed_extensions": [ "passff@invicem.pro" ] + } + +- name: "Create passff wrapper" + become: true + ansible.builtin.copy: + dest: "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper" + mode: "0755" + content: | + #!/bin/sh + # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case. + # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper + export PINENTRY_USER_DATA=gnome + exec /usr/lib/mozilla/native-messaging-hosts/passff.py "$@" diff --git a/roles/firefox/tasks/install_browserpass.yml b/roles/firefox/tasks/install_browserpass.yml deleted file mode 100644 index 50d6cef2..00000000 --- a/roles/firefox/tasks/install_browserpass.yml +++ /dev/null @@ -1,48 +0,0 @@ ---- -- name: "Add browserpass to default extensions" - ansible.builtin.set_fact: - firefox_default_extensions: "{{ firefox_default_extensions | combine(firefox_browserpass_extension) }}" - vars: - firefox_browserpass_extension: - "browserpass@maximbaz.com": - installation_mode: "force_installed" - install_url: "https://addons.mozilla.org/firefox/downloads/latest/browserpass-ce/latest.xpi" - -- name: "Ensure browserpass native messaging host is installed" - become: true - ansible.builtin.package: - name: "{{ firefox_browserpass_packages }}" - state: "present" - -- name: "Create native messaging hosts directory" - become: true - ansible.builtin.file: - path: "/usr/lib/mozilla/native-messaging-hosts" - state: "directory" - mode: "0755" - -- name: "Create browserpass native messaging hosts file" - become: true - ansible.builtin.copy: - dest: "/usr/lib/mozilla/native-messaging-hosts/com.github.browserpass.native.json" - mode: "0644" - content: | - { - "name": "com.github.browserpass.native", - "description": "Browserpass native component for the Firefox extension", - "path": "/usr/lib/browserpass/browserpass-wrapper", - "type": "stdio", - "allowed_extensions": ["browserpass@maximbaz.com"] - } - -- name: "Create browserpass-native wrapper" - become: true - ansible.builtin.copy: - dest: "/usr/lib/browserpass/browserpass-wrapper" - mode: "0755" - content: | - #!/bin/sh - # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case. - # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper - export PINENTRY_USER_DATA=gnome - exec /usr/lib/browserpass/browserpass-native "$@" diff --git a/roles/firefox/tasks/install_passff.yml b/roles/firefox/tasks/install_passff.yml deleted file mode 100644 index 00bb76eb..00000000 --- a/roles/firefox/tasks/install_passff.yml +++ /dev/null @@ -1,55 +0,0 @@ ---- -# NOTE: This part of the role depends on -# - role: "curl" -# - role: "sed" -# - role: "python" -# - role: "bash" -# - role: "password_store" -# -# As it uses these tools to install and run passff. -# The curl, sed, bash are used for installation. -# Python is used to run the passff native messaging host. -# pass is required by passff to access the password store, and errors when not found. -- name: "Add passff to default extensions" - ansible.builtin.set_fact: - firefox_default_extensions: "{{ firefox_default_extensions | combine(firefox_passff_extension) }}" - vars: - firefox_passff_extension: - "passff@invicem.pro": - installation_mode: "force_installed" - install_url: "https://addons.mozilla.org/firefox/downloads/latest/passff/latest.xpi" - -- name: "Ensure passff native messaging host is installed" - become: true - ansible.builtin.shell: | - set -euo pipefail - curl -sSL https://codeberg.org/PassFF/passff-host/releases/download/latest/install_host_app.sh | bash -s -- firefox - args: - creates: "/usr/lib/mozilla/native-messaging-hosts/passff.py" - executable: "/bin/bash" - -- name: "Create browserpass native messaging hosts file" - become: true - ansible.builtin.copy: - dest: "/usr/lib/mozilla/native-messaging-hosts/passff.json" - mode: "0644" - content: | - { - "name": "passff", - "description": "Host for communicating with zx2c4 pass", - "path": "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper", - "type": "stdio", - "allowed_extensions": [ "passff@invicem.pro" ] - } - -- name: "Create passff wrapper" - become: true - ansible.builtin.copy: - dest: "/usr/lib/mozilla/native-messaging-hosts/passff-wrapper" - mode: "0755" - content: | - #!/bin/sh - # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case. - # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper - export PINENTRY_USER_DATA=gnome - exec /usr/lib/mozilla/native-messaging-hosts/passff.py "$@" diff --git a/roles/firefox/tasks/main.yml b/roles/firefox/tasks/main.yml index c78af295..02aa2243 100644 --- a/roles/firefox/tasks/main.yml +++ b/roles/firefox/tasks/main.yml @@ -1,15 +1,12 @@ --- - name: "Include OS-specific variables" - ansible.builtin.include_vars: "{{ ansible_facts['distribution'] | lower }}.yml" + ansible.builtin.include_vars: "{{ ansible_facts['os_family'] | lower }}.yml" -- name: "Ensure firefox is installed" - become: true - ansible.builtin.package: - name: "{{ firefox_package }}" - state: "present" +- name: "Include OS-specific tasks" + ansible.builtin.include_tasks: "install-{{ ansible_facts['os_family'] | lower }}.yml" - name: "Install browserpass extension for Firefox" - ansible.builtin.include_tasks: "install_browserpass.yml" + ansible.builtin.include_tasks: "install-plugin-browserpass.yml" when: firefox_install_browserpass | default(false) # NOTE: passff extension is using sed/curl during install and python/pass to run @@ -18,7 +15,7 @@ # this extension, which isn't enabled by default. # Personally I find it has better UI/UX than browserpass, but browserpass is more lightweight. - name: "Install passff extension for Firefox" - ansible.builtin.include_tasks: "install_passff.yml" + ansible.builtin.include_tasks: "install-plugin-passff.yml" when: firefox_install_passff | default(false) - name: "Create policies directory" @@ -41,11 +38,3 @@ { "policies": {{ firefox_policies | tojson(indent=4) }} } - -- name: "Set firefox as default" - ansible.builtin.command: - cmd: "xdg-settings set default-web-browser {{ firefox_desktop_file }}" - environment: - XDG_DATA_DIRS: "/var/lib/snapd/desktop:{{ ansible_facts['env']['XDG_DATA_DIRS'] }}" - changed_when: false - when: firefox_is_default | default(false) diff --git a/roles/firefox/vars/archlinux.yml b/roles/firefox/vars/archlinux.yml index 41d4ab15..7e64c811 100644 --- a/roles/firefox/vars/archlinux.yml +++ b/roles/firefox/vars/archlinux.yml @@ -1,6 +1,4 @@ --- -firefox_package: "firefox" -firefox_desktop_file: "firefox.desktop" firefox_folder: "{{ ansible_facts['env']['HOME'] }}/.mozilla/firefox" firefox_browserpass_packages: diff --git a/roles/firefox/vars/debian.yml b/roles/firefox/vars/debian.yml index 0f2995c2..f4aab405 100644 --- a/roles/firefox/vars/debian.yml +++ b/roles/firefox/vars/debian.yml @@ -1,7 +1,5 @@ --- -firefox_package: "firefox-esr" -firefox_desktop_file: "firefox-esr.desktop" -firefox_folder: "{{ ansible_facts['env']['HOME'] }}/.mozilla/firefox" +firefox_folder: "{{ ansible_facts['env']['HOME'] }}/.var/app/org.mozilla.firefox/.mozilla/firefox" firefox_browserpass_packages: - "webext-browserpass" diff --git a/roles/firefox/vars/ubuntu.yml b/roles/firefox/vars/ubuntu.yml deleted file mode 100644 index 4c04fd17..00000000 --- a/roles/firefox/vars/ubuntu.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -firefox_package: "firefox" -firefox_desktop_file: "firefox_firefox.desktop" -firefox_folder: "{{ ansible_facts['env']['HOME'] }}/snap/firefox/common/.mozilla/firefox" - -firefox_browserpass_packages: - - "webext-browserpass" - - "pinentry-gnome3" -- cgit v1.2.3