From bb251e5e6066d4eb89cdb70f682dfe7a88030a13 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Mon, 24 Nov 2025 22:16:43 +0100
Subject: Add initial firefox role implementation with only GNOME support for
 pass

---
 roles/firefox/tasks/install_browserpass.yml | 48 +++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 roles/firefox/tasks/install_browserpass.yml

(limited to 'roles/firefox/tasks/install_browserpass.yml')

diff --git a/roles/firefox/tasks/install_browserpass.yml b/roles/firefox/tasks/install_browserpass.yml
new file mode 100644
index 00000000..50d6cef2
--- /dev/null
+++ b/roles/firefox/tasks/install_browserpass.yml
@@ -0,0 +1,48 @@
+---
+- name: "Add browserpass to default extensions"
+  ansible.builtin.set_fact:
+    firefox_default_extensions: "{{ firefox_default_extensions | combine(firefox_browserpass_extension) }}"
+  vars:
+    firefox_browserpass_extension:
+      "browserpass@maximbaz.com":
+        installation_mode: "force_installed"
+        install_url: "https://addons.mozilla.org/firefox/downloads/latest/browserpass-ce/latest.xpi"
+
+- name: "Ensure browserpass native messaging host is installed"
+  become: true
+  ansible.builtin.package:
+    name: "{{ firefox_browserpass_packages }}"
+    state: "present"
+
+- name: "Create native messaging hosts directory"
+  become: true
+  ansible.builtin.file:
+    path: "/usr/lib/mozilla/native-messaging-hosts"
+    state: "directory"
+    mode: "0755"
+
+- name: "Create browserpass native messaging hosts file"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/mozilla/native-messaging-hosts/com.github.browserpass.native.json"
+    mode: "0644"
+    content: |
+      {
+          "name": "com.github.browserpass.native",
+          "description": "Browserpass native component for the Firefox extension",
+          "path": "/usr/lib/browserpass/browserpass-wrapper",
+          "type": "stdio",
+          "allowed_extensions": ["browserpass@maximbaz.com"]
+      }
+
+- name: "Create browserpass-native wrapper"
+  become: true
+  ansible.builtin.copy:
+    dest: "/usr/lib/browserpass/browserpass-wrapper"
+    mode: "0755"
+    content: |
+      #!/bin/sh
+      # NOTE: this uses the dotfiles pinentry-wrapper which forces the usage of GUI pinentry in this case.
+      # REF: https://git.sr.ht/~a14m/.rc/tree/94b355aa0ce648e3d41bfa7ef76611e3650523d2/item/.gnupg/pinentry-wrapper
+      export PINENTRY_USER_DATA=gnome
+      exec /usr/lib/browserpass/browserpass-native "$@"
-- 
cgit v1.2.3