{ config, pkgs, lib, ... }:

let
  librewolfPkg = pkgs.librewolf;

in {
  programs.librewolf = {
    enable = true;
    package = librewolfPkg;

    profiles.default = {
      isDefault = true;

      settings = {
        # UI / behavior
        "browser.startup.homepage" = "https://duckduckgo.com";
        "browser.newtabpage.enabled" = false;

        # Privacy baseline (LibreWolf already hardens most of this)
        "privacy.resistFingerprinting" = true;
        "privacy.trackingprotection.enabled" = true;

        # Disable telemetry completely
        "toolkit.telemetry.enabled" = false;
        "toolkit.telemetry.unified" = false;

        # Network / DNS (optional redundancy with policies)
        "network.trr.mode" = 3;
        "network.trr.uri" = "https://dns.quad9.net/dns-query";

        # UI behavior
        "browser.tabs.warnOnClose" = false;
        "browser.quitShortcut.disabled" = true;

        # Security tightening
        "dom.event.clipboardevents.enabled" = false;
        "geo.enabled" = false;
        "media.autoplay.default" = 5;
      };

      extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
        ublock-origin
        firefox-multi-account-containers
        noscript
      ];
    };
  };

  # Make LibreWolf default browser
  home.sessionVariables.BROWSER = "${librewolfPkg}/bin/librewolf";
}