Weather Clock Dash

Posted on Oct 16

Configuring Firefox on NixOS: Declarative Settings, Extensions, and Wayland

#nixos #firefox #linux #privacy

NixOS is known for its reproducible configuration model. Configuring Firefox on NixOS fits naturally into the declarative approach. Here's how to do it properly.

Firefox Packages in NixOS

NixOS provides several Firefox variants:

# In system configuration.nix or home-manager
environment.systemPackages = with pkgs; [
  firefox          # Latest stable release
  firefox-esr      # Extended Support Release
  librewolf        # Hardened Firefox fork
  firefox-devedition  # Firefox Developer Edition
];

For daily use, firefox tracks the latest release. firefox-esr is appropriate for stability-focused setups.

Home Manager Configuration

If you use home-manager, you can configure Firefox declaratively:

programs.firefox = {
  enable = true;

  profiles.default = {
    id = 0;
    name = "default";
    isDefault = true;

    settings = {
      # Privacy settings
      "privacy.trackingprotection.enabled" = true;
      "privacy.trackingprotection.emailtracking.enabled" = true;
      "network.trr.mode" = 3;  # DNS over HTTPS only
      "network.trr.uri" = "https://1.1.1.1/dns-query";
      "dom.security.https_only_mode" = true;
      "media.peerconnection.ice.no_host" = true;

      # Disable telemetry
      "datareporting.healthreport.uploadEnabled" = false;
      "datareporting.policy.dataSubmissionEnabled" = false;
      "app.shield.optoutstudies.enabled" = false;
      "browser.discovery.enabled" = false;

      # UI preferences
      "browser.tabs.drawInTitlebar" = true;
      "browser.toolbars.bookmarks.visibility" = "never";
      "browser.startup.page" = 3;  # Resume previous session
    };

    # Extensions via home-manager
    extensions = with pkgs.nur.repos.rycee.firefox-addons; [
      ublock-origin
      bitwarden
      multi-account-containers
    ];
  };
};

The NixOS Declarative Firefox configuration means settings and extensions are reproduced exactly on every rebuild.

Extensions via NUR (Nix User Repository)

NUR provides pre-packaged Firefox extensions:

# First, enable NUR in configuration.nix
nixpkgs.config.packageOverrides = pkgs: {
  nur = import (builtins.fetchTarball {
    url = "https://github.com/nix-community/NUR/archive/main.tar.gz";
  }) { inherit pkgs; };
};

Available extensions in pkgs.nur.repos.rycee.firefox-addons:

ublock-origin
bitwarden
multi-account-containers
darkreader
tree-style-tab

Extensions installed this way are managed by Nix — they can't be updated by Firefox itself (update flow goes through your NixOS rebuild). This ensures reproducibility at the cost of requiring a nixos-rebuild switch to update extensions.

Wayland Configuration

For Wayland (preferred on modern NixOS desktops):

# In environment variables
environment.sessionVariables = {
  MOZ_ENABLE_WAYLAND = "1";
};

Or per-package:

home.packages = [
  (pkgs.firefox.override {
    nativeMessagingHosts = [ pkgs.plasma5Packages.plasma-browser-integration ];
  })
];

Mozilla's Wayland backend has been the default in recent Firefox versions. MOZ_ENABLE_WAYLAND=1 is mainly needed on older configurations.

VA-API Hardware Acceleration

For hardware video acceleration:

# Enable VA-API
hardware.opengl = {
  enable = true;
  extraPackages = with pkgs; [
    intel-media-driver   # For Intel GPU
    # vaapiVdpau         # For AMD/NVIDIA via VDPAU
    # libvdpau-va-gl     # VDPAU to VA-API bridge
  ];
};

# Firefox user.js settings (via home-manager)
programs.firefox.profiles.default.settings = {
  "media.ffmpeg.vaapi.enabled" = true;
  "media.hardware-video-decoding.force-enabled" = true;
};

Verify in Firefox: about:support → search for "HW_COMPOSITING"

Managing Multiple Profiles

NixOS home-manager supports multiple profiles:

programs.firefox.profiles = {
  personal = {
    id = 0;
    isDefault = true;
    settings = { /* personal browsing settings */ };
  };
  work = {
    id = 1;
    settings = {
      # Work profile — more permissive, different homepage
      "browser.startup.homepage" = "https://work.intranet.com";
    };
  };
  hardened = {
    id = 2;
    settings = {
      "javascript.enabled" = false;
      "dom.security.https_only_mode" = true;
    };
  };
};

Launch specific profiles: firefox -P work

System-Wide Policies

For multi-user NixOS systems:

programs.firefox = {
  enable = true;
  policies = {
    DisableTelemetry = true;
    EnableTrackingProtection = {
      Value = true;
      Locked = true;
    };
    ExtensionSettings = {
      "uBlock0@raymondhill.net" = {
        installation_mode = "force_installed";
        install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
      };
    };
  };
};

This applies to all users system-wide via policies.json.

The Reproducibility Benefit

The key advantage of NixOS Firefox configuration: your entire browser setup (settings, extensions, policies) is version-controlled in your nix configuration. Rebuilding or moving to a new machine reproduces the exact same Firefox configuration.

For development machines, this means your testing browser is consistently configured across all machines. For privacy-focused setups, it ensures settings can't accidentally be changed by an update.

LibreWolf as Alternative

If you want hardened Firefox defaults without manual configuration:

environment.systemPackages = [ pkgs.librewolf ];

LibreWolf is available in nixpkgs and ships with strong privacy defaults. Not configurable via home-manager's programs.firefox (different package), but you can still apply user.js settings manually or via the NixOS overlay.

DEV Community