Dank bar

.github/workflows/perseus.yaml

@@ -37,6 +37,7 @@ jobs:
           }
           EOF
 
+      - run: nix flake update oisd
       - run: nix flake check
       - run: nix flake show
       - run: echo "=== user-config.nix content ===" && cat user-config.nix

.github/workflows/trufflehog.yaml

@@ -14,22 +14,9 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      - name: Install TruffleHog
-        run: |
-          python -m pip install --upgrade pip
-          pip install truffleHog
-      - name: Run TruffleHog and Check Output
-        run: |
-          trufflehog --json . --exclude-path flake.lock > trufflehog_report.json || true
-          if [ -s trufflehog_report.json ]; then
-            echo No secrets found
-            cat trufflehog_report.json
-            exit 1
-          else
-            echo No secrets found
-          fi
-      - name: Upload Report
-        uses: actions/upload-artifact@v4
         with:
-          name: trufflehog-report
-          path: trufflehog_report.json
+          fetch-depth: 0
+      - name: TruffleHog Scan
+        uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --only-verified

flake.nix

@@ -5,23 +5,38 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixvim.url = "github:nix-community/nixvim/nixos-25.11";
 
+    dgop.url = "github:AvengeMedia/dgop";
+    dgop.inputs.nixpkgs.follows = "nixpkgs";
+
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "nixpkgs";
+
     flakehub.url = "github:DeterminateSystems/fh";
+
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-    thunderbird-catppuccin.url = "github:catppuccin/thunderbird";
+
 
     home-manager.url = "github:nix-community/home-manager/release-25.11";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
     dms.url = "github:AvengeMedia/DankMaterialShell";
     dms.inputs.nixpkgs.follows = "nixpkgs";
 
+    danksearch.url = "github:AvengeMedia/danksearch";
+    danksearch.inputs.nixpkgs.follows = "nixpkgs";
+
+    oisd = {
+      url = "https://big.oisd.nl/domainswild";
+      flake = false;
+    };
+
+    thunderbird-catppuccin.url = "github:catppuccin/thunderbird";
     catppuccin-firefox = {
       url = "github:catppuccin/firefox";
       flake = false;
     };
+
     betterfox = {
       url = "github:yokoffing/Betterfox";
       flake = false;
@@ -30,7 +45,7 @@
 
   outputs = { nixpkgs, flakehub, home-manager, ... }@inputs:
   let
-    version = "1.2.0";
+    version = "1.3.0";
     userConfig = import ./user-config.nix;
     lib = nixpkgs.lib;
 

home/firefox/default.nix

@@ -2,7 +2,7 @@
 {
   programs.firefox = {
     enable = true;
-    package = pkgs.firefox; # Use the standard Firefox package
+    package = pkgs.firefox;
 
     policies = import ./policies.nix { inherit lib; };
 

home/firefox/policies.nix

@@ -26,7 +26,7 @@
   DisableFeedbackCommands = true;
   DontCheckDefaultBrowser = true;
   DNSOverHTTPS = {
-    Enabled = true;
+    Enabled = false;
   };
   EnableTrackingProtection = {
     Value = true;

home/firefox/settings.nix

@@ -20,6 +20,12 @@ in
   "privacy.userContext.ui.enabled" = true;
   "privacy.userContext.longPressBehavior" = 2;
 
+  "media.peerconnection.enabled" = false;
+  "media.peerconnection.ice.default_address_only" = true;
+  "media.peerconnection.ice.no_host" = true;
+  "network.dns.echconfig.enabled" = true;
+  "network.dns.use_https_rr_as_altsvc" = true;
+
   # Smooth Scroll
   "general.smoothScroll" = true;
   "general.smoothScroll.lines.durationMaxMS" = 125;

modules/app-telemetry-deny.nix

@@ -63,6 +63,22 @@
       "codewhisperer.aws.amazon.com"
       "ai.jetbrains.com"
       "ai-assistant.jetbrains.com"
+
+      # DoH/DoT bypass prevention - force apps to use system DNS
+      "mozilla.cloudflare-dns.com"
+      "dns.google"
+      "dns.google.com"
+      "cloudflare-dns.com"
+      "one.one.one.one"
+      "1dot1dot1dot1.cloudflare-dns.com"
+      "dns.quad9.net"
+      "dns9.quad9.net"
+      "dns10.quad9.net"
+      "dns11.quad9.net"
+      "doh.opendns.com"
+      "doh.cleanbrowsing.org"
+      "dns.adguard.com"
+      "dns.nextdns.io"
     ];
   };
 

modules/dms.nix

@@ -1,16 +1,27 @@
-{ pkgs, userConfig, ... }:
+{ pkgs, userConfig, inputs, ... }:
 
 {
+  environment.systemPackages = with pkgs; [
+    cliphist
+    wl-clipboard
+  ];
+
   home-manager.users.${userConfig.username} = {
-    home.file.".config/DankMaterialShell/settings.json".text = builtins.toJSON {
-      blurredWallpaperLayer = false; 
-      currentThemeName = "blue";
-      use24HourClock = true;
-      cornerRadius = 12;
-      fontFamily = "Inter Variable";
-      monoFontFamily = "Fira Code";
-      barOpacity = 0;
-      widgetOpacity = 54;
+    imports = [ inputs.danksearch.homeModules.dsearch ];
+
+
+    programs.dsearch.enable = true;
+    xdg.mimeApps = {
+      enable = true;
+      defaultApplications = {
+        "text/html" = "firefox.desktop";
+        "x-scheme-handler/http" = "firefox.desktop";
+        "x-scheme-handler/https" = "firefox.desktop";
+        "x-scheme-handler/about" = "firefox.desktop";
+        "x-scheme-handler/unknown" = "firefox.desktop";
+        "application/xhtml+xml" = "firefox.desktop";
+        "application/pdf" = "firefox.desktop";
+      };
     };
   };
 }

modules/environment.nix

@@ -89,7 +89,7 @@ in
     };
     gnome.gnome-keyring.enable = true;
     # TLP is primary
-    upower.enable = false;
+    upower.enable = true;
 
     # Security
     opensnitch = {

modules/firejail.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+  programs.firejail = {
+    enable = true;
+    wrappedBinaries = {
+      firfox ={
+        executable = "${pkgs.firefox}/bin/firefox";
+        profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
+      };
+    };
+  };
+}

modules/greetd.nix

@@ -9,7 +9,7 @@
 
   security.pam.services = {
     greetd = {
-      fprintAuth = true;
+      fprintAuth = false;
       nodelay = true;
       enableGnomeKeyring = false;
     };