firefox: install user-agent-string-switcher automatically so I don't have to worry about that for Microsoft Teams

TODO: proper automagic deployment

etc/firefox/policies/README.md

@@ -13,6 +13,7 @@ per whatever I am doing.
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 
 - [WARNING TO LIBREWOLF USERS](#warning-to-librewolf-users)
+- [General warning](#general-warning)
 - [Extensions](#extensions)
   - [Privacy Badger](#privacy-badger)
     - [Duplicate](#duplicate)
@@ -33,6 +34,12 @@ This file takes priority over
 `/usr/share/librewolf/distribution/policies.json` so don't apply this or
 a lot of LibreWolf specific customizations stops being in force.
 
+## General warning
+
+This is meant for me and devices I maintain for self-dogfooding so there are
+opinions. Including those Firefox won't accept and will appear as warnings or
+errors in `about:config` depending on the release channel or even all of them.
+
 ## Extensions
 
 They are mostly self-explanatory.

etc/firefox/policies/policies.json

@@ -90,10 +90,13 @@
         "norwegianwifi.com"
       ],
       "Fallback": false,
-      "Locked": false,
+      "Locked": true,
-      "ProviderURL": "https://dns.quad9.net/dns-query"
+      "ProviderURL": "https://dns0.eu/",
+      "ProviderURL_outside_europe_aminda_comment": "Swap to https://unfiltered.adguard-dns.com/dns-query if device is expected to cross continents from Europe?"
     },
     "DisableEncryptedClientHello": false,
+    "DisableFirefoxAccounts": false,
+    "DisableFirefoxScreenshots": false,
     "DisablePocket": true,
     "DisplayBookmarksToolbar": "never",
     "DontCheckDefaultBrowser": true,
@@ -190,6 +193,10 @@
       "{759dbb01-b646-4327-bf9e-69ca2543ef8d}": {
         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/opendyslexic-for-firefox/latest.xpi",
         "installation_mode": "normal_installed"
+      },
+      "{a6c4a591-f1b2-4f03-b3ff-767e5bedf4e7}": {
+        "install_url": "https://addons.mozilla.org/firefox/downloads/latest/user-agent-string-switcher/latest.xpi",
+        "installation_mode": "normal_installed"
       }
     },
     "FirefoxHome": {
@@ -251,6 +258,16 @@
         "Type": "boolean",
         "Value": false
       },
+      "dom.block_download_insecure": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
+      "dom.security.https_only_mode": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
       "extensions.webextensions.restrictedDomains": {
         "Status": "locked",
         "Type": "string",
@@ -351,6 +368,36 @@
         "Type": "string",
         "Value": "#ffb700"
       },
+      "privacy.donottrackheader.enabled": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
+      "privacy.donottrackheader.value": {
+        "Status": "locked",
+        "Type": "number",
+        "Value": 1
+      },
+      "privacy.globalprivacycontrol.enabled": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
+      "privacy.globalprivacycontrol.functionality.enabled": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
+      "privacy.userContext.enabled": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
+      "privacy.userContext.ui.enabled": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
       "security.OCSP.require": {
         "Status": "locked",
         "Type": "boolean",
@@ -366,6 +413,11 @@
         "Type": "boolean",
         "Value": true
       },
+      "security.ssl.enable_ocsp_must_staple": {
+        "Status": "locked",
+        "Type": "boolean",
+        "Value": true
+      },
       "security.ssl.enable_ocsp_stapling": {
         "Status": "locked",
         "Type": "boolean",

rc/curlrc

@@ -1,12 +1,16 @@
 # ~/.curlrc
 
-# DNS-over-HTTPS (maybe HTTP/3, I don't know)
-#
 # https://dns0.eu - Anycast with servers in the EU. Private ECS.
-#doh-url = https://dns0.eu/
+doh-url = https://dns0.eu/
-#
+#doh-url = https://open.dns0.eu/
+
+# https://adguard-dns.io - anycast with servers in multiple continents,
+# private ECS
+#doh-url = https://unfiltered.adguard-dns.com/dns-query
+
+
 # https://quad9.net - Anycast, no ECS
-doh-url = https://dns.quad9.net/dns-query
+#doh-url = https://dns.quad9.net/dns-query
 # ECS
 #doh-url = https://dns11.quad9.net/dns-query