Chromium

Installation

NixOS

Add chromium to systemPackages.

Updating browser policies

In Chromium the policy settings, which can be accessed by using chrome://policy, allow the user to change a lot of settings that dont exist anywhere else such as

• Creating webapps when the browser is installed
• Finding and downloading browser extensions automatically
• Enabling or disabling the dinosaur game when the device is offline
• Disable screenshots to be taken with browser extensions
• Block all downloads from the browser (if you want to do that for some reason)
• and hundreds more settings

Natively Supported Policies

By default NixOS provides a few policies that can be enabled directly, a simple example is given below to understand how these are implemented

  programs.chromium = {
    enable = true;
    homepageLocation = "https://www.startpage.com/";
    extensions = [
      "eimadpbcbfnmbkopoojfekhnkhdbieeh;https://clients2.google.com/service/update2/crx" # dark reader
      "aapbdbdomjkkjkaonfhkkikfgjllcleb;https://clients2.google.com/service/update2/crx" # google translate
    ];
    extraOpts = {
      "WebAppInstallForceList" = [
        {
          "custom_name" = "Youtube";
          "create_desktop_shortcut" = false;
          "default_launch_container" = "window";
          "url" = "https://youtube.com";
        }
      ];
    };
  };

• homepageLocation option allows you to set the site that the homepage will open on
• extensions allows for the download of extensions directly in the browser through a simple list of the extension ID's that can be obtained from the Chrome Web Store by opening an extension page and copying the last part of the URL
  • In the example however there is another component, the download source from which the extensions will be downloaded
  • The URL provided in the list is the link that is used by google for managing, checking and updating extensions
  • So the method of just placing the extension ID can work like this: "fnpbehpgglbfnpimkachnpnecjncndgm"
  • But just in case that method does not automatically function the second method is shown above, where you place ; and then the URL https //clients2.google.com/service/update2/crx to explicitly tell NixOS where to install the extension from
• There are many more options that are natively supported and you can learn about them through man configuration.nix
• But as shown above there is also an extraOpts option and that is used for policies that are not supported for direct setup, such as the policy to install web-apps

Non-natively Supported Policies

As stated beforehand, there are hundreds of policies that are in chromium based browsers and not all of them can be supported directly and so the extraOpts option allows for the declaration of all the other policies

There is no one place to find all the policies and some places you can find a "list" are given below:

• A good number of commonly used policies are present and explained within man configuration.nix under programs.chromium
• If you require a more comprehensive list then you can go to chrome://policy and click on the checkbox at the top of the page that says "Show policies with no value set", from there you can click on any of the policies to go to the documentation page for that policy to get details on how to use it
• If you just want to see the list of all policies supported by chromium then you cant really do that, unfortunately google does not provide documentation on every single policy in the chromium browser base and if you wish to see the list of every single policy then you can do so by going directly to the source code and figuring out how a policy works
• To see the most up-to-date file on all policies you can go here

Accelerated video playback

Make sure Accelerated Video Playback is setup on the system properly. Check chrome://gpu to see if Chromium has enabled hardware acceleration.

If accelerated video playback is not working, check relevant flags at chrome://flags, or enable them using the cli:

❄︎ /etc/nixos/configuration.nix

{
  environment.systemPackages = with pkgs; [
    (chromium.override {
      commandLineArgs = [
        "--enable-features=AcceleratedVideoEncoder"
        "--ignore-gpu-blocklist"
        "--enable-zero-copy"
      ];
    })
  ];
}

In some cases, chrome://gpu will show Video Decode as enabled, but Video Acceleration Information as blank, with chrome://media-internals using FFmpeg Video Decoder (software decoding). If this happens, try to enable the following features:

❄︎ /etc/nixos/configuration.nix

{
  environment.systemPackages = with pkgs; [
    (chromium.override {
      commandLineArgs = [
        "--enable-features=AcceleratedVideoEncoder,VaapiOnNvidiaGPUs,VaapiIgnoreDriverChecks,Vulkan,DefaultANGLEVulkan,VulkanFromANGLE"
        "--enable-features=VaapiIgnoreDriverChecks,VaapiVideoDecoder,PlatformHEVCDecoderSupport"
        "--enable-features=UseMultiPlaneFormatForHardwareVideo"
        "--ignore-gpu-blocklist"
        "--enable-zero-copy"
      ];
    })
  ];
}

Enabling native Wayland support

You can turn on native Wayland support in all chrome and most electron apps by setting an environment variable: environment.sessionVariables.NIXOS_OZONE_WL = "1".

Enabling ManifestV2 support

To enable manifest v2 support ExtensionManifestV2Availability can be set to 2.

❄︎ /etc/nixos/configuration.nix

{
  programs.chromium = {
    extraOpts = {
	"ExtensionManifestV2Availability" = 2;
    };
  };
}

Enabling DRM (Widevine support)

By default, chromium does not support playing DRM protected media. However, there is a build time flag to include the unfree Widevine blob from nixpkgs:

❄︎ /etc/nixos/configuration.nix

{
  environment.systemPackages = with pkgs; [
    (chromium.override { enableWideVine = true; })
  ];
}

KeePassXC support in Flatpak

To enable browser integration between KeePassXC and Chromium-based browsers when running in Flatpak, configure the following filesystem access:

# NativeMessagingHost directory (browser-specific)
# Brave Browser
xdg-config/BraveSoftware/Brave-Browser/NativeMessagingHosts:ro
# Chromium
xdg-config/chromium/NativeMessagingHosts:ro
# Google Chrome
xdg-config/google-chrome/NativeMessagingHosts:ro

# KeePassXC server socket and Nix store
xdg-run/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer
/nix/store:ro

Using libc memory allocator

Chromium may not work when an alternative system-wide memory allocator like scudo is used. To use libc on Chromium, the following firejail wrap is required:

programs.firejail = {
  enable = true;
  wrappedBinaries = {
    chromium = {
      executable = "${pkgs.chromium}/bin/chromium-browser";
      profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";
      extraArgs = [
        "--blacklist=/etc/ld-nix.so.preload"
      ];
    };
  };
};