nixos-config/modules/browser.nix

{ config, lib, pkgs, ... }:

# todo : this needs to be cleaned up

with lib;

let

  cfg = config.services.browser;

  chromiumBin = "${pkgs.chromium}/bin/chromium";
  chromeBin = "${pkgs.google-chrome}/bin/google-chrome-stable";
  firefoxBin = "${pkgs.firefox}/bin/firefox";
  tarBin = "${pkgs.gnutar}/bin/tar";

  # desktop file
  # ------------
  # makes it possible to be used by other programs
  desktopFile = bin:
    let browserName = bin.name;
    in pkgs.writeTextFile {
      name = "${browserName}.desktop";
      destination = "/share/applications/${browserName}.desktop";
      text = ''
        [Desktop Entry]
        Type=Application
        Exec=${bin}/bin/${browserName} %U
        Icon=chromium
        Comment=An open source web browser from Google
        Terminal=false
        Name=${browserName}
        GenericName=Web browser
        MimeType=text/html;text/xml;application/xhtml+xml;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;x-scheme-handler/webcal;x-scheme-handler/about
        Categories=Network;WebBrowser
        StartupWMClass=${browserName}
      '';
    };

  killBrowser = name:
    pkgs.writeShellScriptBin "${name}-kill" "sudo ${pkgs.killall}/bin/killall -9 -u ${name}";

  cleanBrowser = name: browser: home: homeBackup:
    let
      backupFile = "${homeBackup}.tar.lzma";
      rolloutFile = "${home}.tar.lzma";
      lockFile = "${home}-lock";
    in
    pkgs.writeShellScriptBin "${name}-clean" # sh
      ''
        sudo ${pkgs.killall}/bin/killall -9 -u ${name}
        sudo rm -f ${lockFile}
        sudo rm -rf ${home}
      '';

  createBrowser = name: user: browser: home: homeBackup:
    let
      backupFile = "${homeBackup}.tar.lzma";
      rolloutFile = "${home}.tar.lzma";
      lockFile = "${home}-lock";
    in
    pkgs.writeShellScriptBin "${name}" # sh
      ''
        # set -x
        if [[ ! -e ${lockFile} ]]
        then
            # rollout backup
            if [[ -e ${backupFile} ]]
            then
                if [[ ! -d ${home} ]]
                then
                    # todo : use make user
                    sudo mkdir -p ${home}
                    sudo chown -R ${user}:users ${home}
                fi
                cp ${backupFile} ${rolloutFile}
                sudo -u ${user} ${tarBin} xf ${rolloutFile} --directory ${home}
                rm ${rolloutFile}
                touch ${lockFile}
            fi
        fi

        sudo -u ${user} ${browser}
      '';

  browserExecutableList =
    let
      allBrowser = flip mapAttrsToList cfg.configList (name: config:
        let
          browser =
            if config.browserType == "chrome" then
              ''${chromiumBin} "$@"''
            else if config.browserType == "google" then
              ''${chromeBin} "$@"''
            else
              ''${firefoxBin} "$@"'';
        in
        createBrowser name config.user browser config.home config.homeBackup);
      xclipBrowser = [
        (pkgs.writeShellScriptBin "copy-to-xclip" # sh
          ''
            echo "$*" | ${pkgs.xclip}/bin/xclip
          '')
      ];
    in
    allBrowser ++ xclipBrowser;

  createBackupScript = name: home: backupHome:
    createBackupScriptTemplate {
      sudo = name;
      name = name;
      source = home;
      target = backupHome;
      excludes = [
        "Downloads"
        ".cache"
        ".config/*chrom*/*cache"
        ".config/*chrom*/Crash Reports"
        ".config/*chrom*/Default/DawnCache"
        ".config/*chrom*/Default/IndexedDB"
        ".config/*chrom*/Default/Local Storage"
        ".config/*chrom*/Default/Service Worker/CacheStorage"
        ".config/*chrom*/Default/Storage"
        ".config/*chrom*/Default/optimization_guide_prediction_model_downloads"
        ".mozilla/firefox/*.default/*cache*"
        ".mozilla/firefox/*.default/crashes"
        ".mozilla/firefox/*.default/datareporting"
        ".mozilla/firefox/*.default/sessionstore-backups"
        ".mozilla/firefox/*.default/storage-sync-v2.sqlite"
        ".mozilla/firefox/*.default/storage/temporary"
        ".mozilla/firefox/*.default/storage/to-be-removed"
        ".mozilla/firefox/Crash Reports"
      ];
    };

  createBackupScriptTemplate = { sudo, name, source, target, excludes ? [ ] }:
    pkgs.writers.writeBashBin "${name}-backup"
      ''
        sudo -u ${sudo} \
        ${tarBin} \
        ${concatStringsSep " " (map (pattern: "--exclude=\"${pattern}\"") excludes)} \
        --create \
        --verbos \
        --lzma \
        --file ${source}.tar.lzma \
        --directory ${source} \
        .

        cp ${source}.tar.lzma ${target}.tar.lzma
      '';

  allBackupScripts =
    let
      filteredConfigs =
        filterAttrs (name: browserConfig: browserConfig.homeBackup != null)
          cfg.configList;
    in
    mapAttrsToList
      (name: browserConfig:
        createBackupScript name browserConfig.home browserConfig.homeBackup)
      filteredConfigs;

  allCleanScripts =
    let
      filteredConfigs =
        filterAttrs (name: browserConfig: browserConfig.homeBackup != null)
          cfg.configList;
    in
    mapAttrsToList
      (name: browserConfig:
        cleanBrowser name name browserConfig.home browserConfig.homeBackup)
      filteredConfigs;

  allKillScripts = mapAttrsToList (name: _: killBrowser name) cfg.configList;

  # browser chooser
  # ---------------
  browserSelect = pkgs.writeScriptBin "browser-select" ''
    # select a browser using dmenu
    # ----------------------------
    BROWSER=$( echo -e "${
      lib.concatMapStringsSep "\\n" (bin: bin.name) browserExecutableList
    }" \
      | ${pkgs.rofi}/bin/rofi -dmenu )

    # start selected browser
    # ----------------------
    case $BROWSER in
    ${lib.concatStringsSep "\n" (flip map browserExecutableList
      (bin: "${bin.name}) export BIN=${bin}/bin/${bin.name} ;;"))}
    *) exit 0 ;;
    esac
    $BIN "$@"
  '';

in
{

  options.services.browser = {
    enable = mkEnableOption "enable browsers";
    # todo : it's not a list
    configList = mkOption {
      default = { };
      type = with types;
        attrsOf (submodule ({ name, ... }: {
          options = {
            browserType = mkOption {
              type = with types; enum [ "firefox" "chrome" "google" ];
              default = "chrome";
              description = ''
                the type of browser which is simulated
              '';
            };
            home = mkOption {
              type = with types; str;
              description = ''
                Home of the browser.
              '';
            };
            gpu = mkOption {
              type = with types; bool;
              default = true;
              description = ''
                add browser user to video group so give browser rights to use gpu.
                see : chrome://gpu/
              '';
            };
            user = mkOption {
              default = name;
              type = with types; str;
              description = ''
                user to run the browser as
              '';
            };
            sudoUsers = mkOption {
              default = [ config.users.users.mainUser.name ];
              type = with types; listOf str;
              description = ''
                user allowed to run sudo without password to start the browser
              '';
            };
            homeBackup = mkOption {
              type = with types; nullOr str;
              default = null;
              example = "~/.my-browser-backup";
              description = ''
                backup of the home, which gets rolled out if the
                home does not exists. usefull for homes in tmpfs.
                dont use file endings!
              '';
            };
          };
        }));
    };
  };

  config = mkIf cfg.enable {

    # add sudo rights
    security.sudo.extraConfig =
      let
        extraRules = flip mapAttrsToList cfg.configList (name: values:
          concatStringsSep "" (map
            (sudoUser: ''
              # sudo configuration to control browser
              ${sudoUser} ALL=(${values.user}) NOPASSWD: ALL
              ${sudoUser} ALL=(root) NOPASSWD: /run/current-system/sw/bin/mkdir -p ${values.home}
              ${sudoUser} ALL=(root) NOPASSWD: /run/current-system/sw/bin/chown -R ${values.user}\:users ${values.home}
              ${sudoUser} ALL=(root) NOPASSWD: ${pkgs.killall}/bin/killall -9 -u ${name}
              ${sudoUser} ALL=(root) NOPASSWD: /run/current-system/sw/bin/rm -rf ${values.home}
              ${sudoUser} ALL=(root) NOPASSWD: /run/current-system/sw/bin/rm -f ${values.home}-lock
            '')
            values.sudoUsers));
      in
      lib.concatStringsSep "\n" extraRules;

    # create users
    users.users = flip mapAttrs cfg.configList
      (name: config: {
        home = config.home;
        createHome = false;
        initialPassword = "${name} -browser";
        shell = pkgs.bashInteractive;
        isNormalUser = false;
        isSystemUser = true;
        group = "users";
        # enable video usage
        extraGroups = [ "audio" "pipewire" ] ++ (if config.gpu then [ "video" ] else [ ]);
      }) // {
      # add groups to mainUser
      mainUser.extraGroups = builtins.attrNames cfg.configList;
    };

    environment.systemPackages = [
      browserSelect
      (desktopFile browserSelect)
    ]
    ++ browserExecutableList
    ++ (map (bin: desktopFile bin) browserExecutableList) ++ allBackupScripts
    ++ allCleanScripts ++ allKillScripts;

  };
}