Bring over the PC config's changes: NexoPass, AppImages, Firefox privacy

- nexopass and nexopass-gui (scripts.nix, with the wordlist and icon)
- AppImages run directly through appimage-run's binfmt (apps.nix)
- Firefox: full fingerprinting protection except forced light mode,
  Accept-Language en-US, and its own font list without corefonts
- README updated to match

Left out as PC-only: OpenRGB, acpi_enforce_resources=lax, the
Vega 8/RTX 3060 Ti graphics setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -32,13 +32,21 @@ only the hardware differs.
 | `modules/audio.nix` | PipeWire |
 | `modules/desktop.nix` | Plasma, SDDM, fonts, theming |
 | `modules/users.nix` | Account, shell, Steam, Flatpak |
-| `modules/apps.nix` | Installed packages, nix-ld |
+| `modules/apps.nix` | Installed packages, nix-ld, AppImage support |
 | `modules/default-apps.nix` | MIME associations |
-| `modules/scripts.nix` | Custom scripts in `modules/scripts/` (vault, metadata stripping, brightness, Wi-Fi hotspot, telemetry, weather) |
+| `modules/scripts.nix` | Custom scripts in `modules/scripts/` (vault, metadata stripping, brightness, Wi-Fi hotspot, telemetry, weather, NexoPass) |
 | `modules/fastfetch.nix` | Installs `configs/fastfetch/config.jsonc` system-wide |
-| `modules/firefox.nix` | Firefox, with prefs from `configs/firefox/prefs.js` (reapplied each start, not locked) |
+| `modules/firefox.nix` | Firefox, with prefs from `configs/firefox/prefs.js` (reapplied each start, not locked), and its own font list without the Microsoft core fonts (against font fingerprinting) |
 | `configs/` | Plain app config files (Firefox prefs, fastfetch) used by the modules |
 
+## NexoPass
+
+`nexopass` (in `modules/scripts/`) derives site passwords from a master with Argon2id, so no password is ever stored. You can have several accounts, each with its own master and an encrypted site list (current versions plus an archive of old ones) in `~/.local/share/nexopass/accounts/`. One app password or PIN unlocks them all; a master is only typed to create or recover an account.
+
+Passwords of 5-15 words or 12-64 characters, "did you mean" for typos, "stay unlocked" for a few minutes (kernel keyring), encrypted export/import shared with the NexoPass Android app, and `nexopass settings`. Run `nexopass help` for everything else. Apache License 2.0.
+
+`nexopass-gui` is the [NexoPass](https://github.com/Nexoniarz/NexoPass) window (also on Android and Windows), fetched from its GitHub release. It uses the same files as `nexopass`, so both see the same accounts and app password.
+
 ---
 
 *Made by **Nexoniarz***

configs/firefox/prefs.js

@@ -20,10 +20,36 @@
 // for that site only.
 pref("browser.contentblocking.category", "strict");
 
-// resistFingerprinting replaced by the fingerprintingProtection above. RFP
-// forced light mode, UTC time and English pages on every site.
+// Fingerprinting protection at full strength: everything resistFingerprinting
+// does (a Windows user agent and platform that agree, UTC time, a fixed core
+// count, the bundled font list, no precise GPU name, canvas noise...), but
+// switched on through fingerprintingProtection, because only that one takes
+// exceptions. The one exception: prefers-color-scheme isn't forced to light,
+// so sites still get dark mode.
+// To check it worked: coveryourtracks.eff.org should show Windows in both
+// User Agent and Platform, and timezone UTC.
 pref("privacy.resistFingerprinting", false);
-pref("privacy.spoof_english", 0);
+pref("privacy.fingerprintingProtection", true);
+pref("privacy.fingerprintingProtection.pbmode", true);
+pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-CSSPrefersColorScheme");
+
+// Ask sites for English pages the way most English-speaking browsers do
+// (en-US, en), so the language header doesn't stand out. en-GB would be
+// rarer, and rarer is what gets you tracked.
+pref("intl.accept_languages", "en-US, en");
+pref("privacy.spoof_english", 2);
+
+// Sites only see base system fonts, not the ones installed on top
+// (the Microsoft core fonts made the font list 1 in 9,481).
+pref("layout.css.font-visibility.standard", 1);
+pref("layout.css.font-visibility.trackingprotection", 1);
+pref("layout.css.font-visibility.private", 1);
+pref("layout.css.font-visibility.resistFingerprinting", 1);
+
+// WebGPU tells sites about the graphics card in detail. Off breaks some
+// sites (3D, AI demos, some games); uncomment to turn it off.
+// pref("dom.webgpu.enabled", false);
+
 // First-party isolation stays ON. Every existing cookie in this profile was
 // saved with a first-party tag; turning this off makes Firefox ignore them
 // all (logged out everywhere). Works alongside Strict mode.

modules/apps.nix

@@ -122,4 +122,9 @@ in
     libxrandr libxcursor libxcb libxkbcommon
     alsa-lib mesa zlib stdenv.cc.cc
   ];
+
+  # Registers AppImages with binfmt_misc, so ./Foo.AppImage (or a double-click
+  # in Dolphin) runs straight through appimage-run's FHS environment.
+  programs.appimage.enable = true;
+  programs.appimage.binfmt = true;
 }

modules/firefox.nix

@@ -1,8 +1,33 @@
 { config, pkgs, ... }:
 
+let
+  # Firefox's own font setup: every system font except the Microsoft core
+  # fonts. Sites measure which fonts are installed to fingerprint you, and
+  # Comic Sans, Impact, Georgia, Verdana... made that list 1 in 9,000.
+  # Only Firefox is affected: other apps still have corefonts. In Firefox,
+  # Arial, Times New Roman and Courier New render as Liberation (same
+  # letter widths), the rest fall back to Noto.
+  firefoxFonts = pkgs.writeText "firefox-fonts.conf" ''
+    <?xml version="1.0"?>
+    <!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+    <fontconfig>
+      <include ignore_missing="no">/etc/fonts/fonts.conf</include>
+      <selectfont>
+        <rejectfont>
+          <glob>${pkgs.corefonts}/*</glob>
+        </rejectfont>
+      </selectfont>
+    </fontconfig>
+  '';
+in
 {
   programs.firefox = {
     enable = true;
+    # The wrapper sets FONTCONFIG_FILE when Firefox starts. (overrideAttrs
+    # keeps the package overridable, so the autoConfig below still applies.)
+    package = pkgs.firefox.overrideAttrs (old: {
+      makeWrapperArgs = old.makeWrapperArgs ++ [ "--set" "FONTCONFIG_FILE" "${firefoxFonts}" ];
+    });
     # Not locked: values are reapplied on every Firefox start, but can be
     # changed in the UI for the current session. (Read as text: the module
     # doesn't copy autoConfigFiles paths into the store.)

modules/scripts.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 let
   vaultToggle = pkgs.writeShellScriptBin "vault-toggle" (builtins.readFile ./scripts/vault-toggle.sh);
@@ -7,6 +7,37 @@ let
   hotspotStart = pkgs.writeShellScriptBin "hotspot-start" (builtins.readFile ./scripts/hotspot-start.sh);
   systemTelemetry = pkgs.writeShellScriptBin "system-telemetry" (builtins.readFile ./scripts/system-telemetry.sh);
   weatherFetch = pkgs.writeShellScriptBin "weather-fetch" (builtins.readFile ./scripts/weather-fetch.sh);
+
+  nexopass = pkgs.writeShellApplication {
+    name = "nexopass";
+    runtimeInputs = with pkgs; [ libargon2 gnupg wl-clipboard keyutils coreutils gnused ];
+    runtimeEnv.NEXOPASS_WORDLIST = "${./scripts/eff_large_wordlist.txt}";
+    text = builtins.readFile ./scripts/nexopass.sh;
+  };
+
+  # NexoPass window (github.com/Nexoniarz/NexoPass). Shares accounts, site
+  # lists and the app password with the nexopass command above.
+  nexopassGuiVersion = "1.3.1";
+  nexopassGuiJar = pkgs.fetchurl {
+    url = "https://github.com/Nexoniarz/NexoPass/releases/download/v${nexopassGuiVersion}/NexoPass-linux-x64-${nexopassGuiVersion}.jar";
+    hash = "sha256-WeUixuz+aLPsMDj+a0Gs09gfikMYYCf8uuZIN89CqVo=";
+  };
+  nexopassGuiLibs = with pkgs; [ libGL libx11 libxext libxrender libxtst libxi libxrandr libxcursor fontconfig freetype ];
+  nexopassGuiDesktop = pkgs.makeDesktopItem {
+    name = "nexopass";
+    desktopName = "NexoPass";
+    comment = "Passwords derived from a master";
+    exec = "nexopass-gui";
+    icon = "nexopass";
+    categories = [ "Utility" "Security" ];
+  };
+  nexopassGui = pkgs.runCommand "nexopass-gui-${nexopassGuiVersion}" { nativeBuildInputs = [ pkgs.makeWrapper ]; } ''
+    makeWrapper ${pkgs.jdk17}/bin/java $out/bin/nexopass-gui \
+      --add-flags "-Xmx1g -jar ${nexopassGuiJar}" \
+      --prefix LD_LIBRARY_PATH : /run/opengl-driver/lib:${lib.makeLibraryPath nexopassGuiLibs}
+    install -Dm644 ${./scripts/nexopass.png} $out/share/icons/hicolor/512x512/apps/nexopass.png
+    install -Dm644 ${nexopassGuiDesktop}/share/applications/nexopass.desktop $out/share/applications/nexopass.desktop
+  '';
 in
 {
   environment.systemPackages = with pkgs; [
@@ -19,5 +50,7 @@ in
     hotspotStart
     systemTelemetry
     weatherFetch
+    nexopass
+    nexopassGui
   ];
 }