enzo: switch to LibreWolf, drive dark theme via portal

Replace the programs.firefox block with LibreWolf. Since there's no
programs.librewolf module, bake the policy into the package via
librewolf.override { extraPolicies = ...; } — blank home/new-tab and no
bookmarks toolbar, merged with LibreWolf's own defaults. No profile or /etc
policy file to manage.

Handle dark mode desktop-wide instead of per-browser: set the dconf key
org/gnome/desktop/interface/color-scheme = prefer-dark, which the niri
xdg-desktop-portal (gnome/gtk) backends report to apps. Firefox/LibreWolf Auto
theme and GTK apps all go dark, so the per-browser theme prefs are gone.

LibreWolf defaults resistFingerprinting on, which spoofs web content's
prefers-color-scheme to light; disable it so pages honor the dark setting.

Assisted-by: Claude:claude-opus-4-8

1 files changed, 50 insertions, 27 deletions

diff --git a/machines/enzo/desktop.nix b/machines/enzo/desktop.nix
index b340e7f..4b04b13 100644
--- a/machines/enzo/desktop.nix
+++ b/machines/enzo/desktop.nix
@@ -8,6 +8,17 @@
   programs.niri.enable = true;
   programs.dconf.enable = true;
 
+  # Tell the desktop it's in dark mode. niri has no settings daemon; apps learn
+  # light/dark from xdg-desktop-portal's Settings interface, whose gnome/gtk
+  # backends read this dconf key. Setting it here makes the portal report
+  # "prefer-dark", so Firefox/LibreWolf (Auto theme + web content) and GTK apps
+  # all go dark — no per-app theme config needed.
+  programs.dconf.profiles.user.databases = [
+    {
+      settings."org/gnome/desktop/interface".color-scheme = "prefer-dark";
+    }
+  ];
+
   services.greetd = {
     enable = true;
     settings.default_session = {
@@ -71,35 +82,47 @@
     "input"
   ];
 
-  # Firefox customizations. The native NixOS module has no profile/userChrome
-  # support (that's Home Manager); instead `preferences` are delivered as a
-  # Firefox enterprise policy (etc/firefox/policies/policies.json), so they
-  # apply to every profile without managing one. preferencesStatus = "default"
-  # means these seed the defaults but stay overridable in the UI.
-  #
-  # This covers dark chrome, blank home/new-tab, and hiding the bookmarks
-  # toolbar. Fully removing the nav/tab toolbars needs userChrome.css, which
-  # this module can't ship — would require Home Manager or an activation hack.
-  programs.firefox = {
-    enable = true;
-    preferencesStatus = "default";
-    preferences = {
-      # Dark theme (UI chrome + toolbars)
-      "ui.systemUsesDarkTheme" = 1;
-      "browser.theme.content-theme" = 0;
-      "browser.theme.toolbar-theme" = 0;
-
-      # Blank home page + blank new tab
-      "browser.startup.homepage" = "about:blank";
-      "browser.startup.page" = 0; # 0 = blank on startup
-      "browser.newtabpage.enabled" = false;
+  users.users.hwebs.packages = with pkgs; [
+    # LibreWolf with customizations baked into the package. There's no
+    # programs.librewolf module, but librewolf is wrapFirefox-based, so
+    # extraPolicies writes an enterprise policy into the package's distribution
+    # dir — no profile, no /etc file. Dark theme is handled desktop-wide by the
+    # portal (see color-scheme dconf key above), so no theme prefs needed here.
+    (librewolf.override {
+      extraPolicies = {
+        DisableAppUpdate = true;
+        Preferences = {
+          # LibreWolf enables resistFingerprinting by default, which spoofs web
+          # content's prefers-color-scheme to light — so sites would ignore the
+          # desktop dark setting. Turn it off so pages follow dark; LibreWolf
+          # keeps its other protections (uBlock, no telemetry, FPP).
+          "privacy.resistFingerprinting" = {
+            Value = false;
+            Status = "default";
+          };
 
-      # Hide the bookmarks toolbar
-      "browser.toolbars.bookmarks.visibility" = "never";
-    };
-  };
+          # Blank home page + blank new tab
+          "browser.startup.homepage" = {
+            Value = "about:blank";
+            Status = "default";
+          };
+          "browser.startup.page" = {
+            Value = 0; # 0 = blank on startup
+            Status = "default";
+          };
+          "browser.newtabpage.enabled" = {
+            Value = false;
+            Status = "default";
+          };
+          # Hide the bookmarks toolbar
+          "browser.toolbars.bookmarks.visibility" = {
+            Value = "never";
+            Status = "default";
+          };
+        };
+      };
+    })
 
-  users.users.hwebs.packages = with pkgs; [
     ghostty # terminal
     fuzzel # launcher
     swaybg # wallpaper