desktop: firefox — drop KeePassXC for Proton Pass + uBlock, hide Profiles button

Replace the KeePassXC-Browser extension, its native-messaging host, and the
keepassxc package with Proton Pass (password manager + passkeys) and uBlock
Origin. Also disable the Firefox 138+ multi-profile feature so the "Profiles"
toolbar button no longer appears.

Assisted-by: Claude:claude-opus-4-8

1 files changed, 14 insertions, 10 deletions

diff --git a/profiles/desktop.nix b/profiles/desktop.nix
index f84b2de..a213995 100644
--- a/profiles/desktop.nix
+++ b/profiles/desktop.nix
@@ -80,10 +80,6 @@ in
   # from the portal above, which Firefox honors for both chrome and web content.
   programs.firefox = {
     enable = true;
-    # Let Firefox reach KeePassXC's browser-integration proxy. This installs the
-    # native-messaging manifest system-wide; the matching toggle is enabled in
-    # the app via the stowed keepassxc.ini (Settings → Browser Integration).
-    nativeMessagingHosts.packages = [ pkgs.keepassxc ];
     preferencesStatus = "default";
     preferences = {
       "browser.startup.homepage" = "about:blank";
@@ -96,6 +92,9 @@ in
       "permissions.default.geo" = 2;
       # Likewise silently deny "Website would like to send notifications".
       "permissions.default.desktop-notification" = 2;
+      # Remove the "Profiles" selector button from the toolbar by turning off
+      # the multi-profile feature (Firefox 138+). false = no Profiles button.
+      "browser.profiles.enabled" = false;
     };
     # Note: Firefox View ("View recent browsing across windows and devices")
     # can't be disabled via pref or policy on modern Firefox — the old
@@ -124,12 +123,18 @@ in
       Order = [ "DuckDuckGo" "Searx" "Wikipedia (en)" "eBay" "Google" ];
     };
 
-    # KeePassXC-Browser: autofill + passkeys, talking to the local app over the
-    # native-messaging host above. normal_installed = installed but the user can
-    # still disable/remove it (force_installed would lock it in).
+    # Auto-installed extensions. normal_installed = installed but the user can
+    # still disable/remove them (force_installed would lock them in). The GUIDs
+    # must match each add-on's internal ID for the policy to take effect.
     policies.ExtensionSettings = {
-      "keepassxc-browser@keepassxc.org" = {
-        install_url = "https://addons.mozilla.org/firefox/downloads/latest/keepassxc-browser/latest.xpi";
+      # uBlock Origin: content/ad blocker.
+      "uBlock0@raymondhill.net" = {
+        install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
+        installation_mode = "normal_installed";
+      };
+      # Proton Pass: password manager + passkeys (replaces KeePassXC).
+      "78272b6fa58f4a1abaac99321d503a20@proton.me" = {
+        install_url = "https://addons.mozilla.org/firefox/downloads/latest/proton-pass/latest.xpi";
         installation_mode = "normal_installed";
       };
     };
@@ -145,7 +150,6 @@ in
     libnotify # notify-send
     gnupg # gpg
     pinentry-gnome3 # passphrase prompt for the gpg agent
-    keepassxc # offline password manager + software passkeys
   ];
 
   # --- Fonts (base) ---