firefox overlay

allow-searchengines-policy.patch

@@ -0,0 +1,11 @@
+--- a/browser/components/enterprisepolicies/schemas/policies-schema.json
++++ b/browser/components/enterprisepolicies/schemas/policies-schema.json
+@@ -1104,8 +1104,6 @@
+     },
+ 
+     "SearchEngines": {
+-      "enterprise_only": true,
+-
+       "type": "object",
+       "properties": {
+         "Add": {

allow-unsigned-addons.patch

@@ -0,0 +1,11 @@
+--- a/toolkit/moz.configure	2021-09-27 19:17:29.000000000 -0400
++++ b/toolkit/moz.configure	2021-10-24 00:47:41.559674267 -0400
+@@ -1412,7 +1412,7 @@
+ # ==============================================================
+ @depends(milestone)
+ def require_signing(milestone):
+-    return milestone.is_release_or_beta and not milestone.is_esr
++    return False
+ 
+ 
+ option(

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1656461576,
+        "narHash": "sha256-rlmmw6lIlkMQIiB+NsnO8wQYWTfle8TA41UREPLP5VY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "cf3ab54b4afe2b7477faa1dd0b65bf74c055d70c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,38 @@
+{
+  description = "Overlay for a policy-configurable non-ESR Firefox";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs = { self, nixpkgs }: let
+    pkgs = import nixpkgs { system = "x86_64-linux"; };
+  in rec {
+    packages.x86_64-linux = rec {
+      default = firefox-patched-unwrapped;
+
+      firefox-patched-unwrapped = (pkgs.firefox-unwrapped.override {
+        geolocationSupport = false;
+        googleAPISupport = false;
+      }).overrideAttrs (oldAttrs: rec {
+        # wrapFirefox gets scared if you try to give addons to non-ESR firefox
+        name = oldAttrs.name + "-not-esr";
+        patches = oldAttrs.patches ++ [
+          # I want to preconfigure the search engine settings to make
+          # DuckDuckGo the default search engine and remove most of the
+          # others.  For some reason, Mozilla is scared of allowing
+          # managed policies to set the default search engine in non-ESR
+          # firefox.  This is a two-line patch to remove that
+          # restriction.
+          # https://github.com/mozilla/policy-templates/issues/484
+          ./allow-searchengines-policy.patch
+          # Nix's wrapFirefox enables unsigned addons, but mainline
+          # Firefox has that force-locked.
+          ./allow-unsigned-addons.patch
+        ];
+      });
+    };
+
+    overlay = final: prev: {
+      inherit (packages.x86_64-linux) firefox-patched-unwrapped;
+    };
+  };
+}