Fix dark mode in firefox.

The existing one does not seem to work.

ansible/roles/bhyve/files/bhyve_netgraph_bridge.bash

@@ -30,6 +30,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : ${BRIDGE_NAME:="bridge_$INTERFACE_NAME"} # or bridge_raw for RAW networks
 : ${VNC_ENABLE:="NO"}
 : ${VNC_LISTEN:="127.0.0.1:5900"}
+: ${VNC_WIDTH:="1920"}
+: ${VNC_HEIGHT:="1080"}
 
 if [ "$VERBOSE" = "YES" ]; then
     set -x
@@ -141,7 +143,7 @@ function start_vm {
         additional_args+=("-s" "5,ahci-cd,$mount_cd")
     fi
     if [ "$VNC_ENABLE" = "YES" ]; then
-        additional_args+=("-s" "29,fbuf,tcp=$VNC_LISTEN,w=1920,h=1080")
+        additional_args+=("-s" "29,fbuf,tcp=$VNC_LISTEN,w=$VNC_WIDTH,h=$VNC_HEIGHT")
     fi
     vms+=("$name")
     while true; do

ansible/roles/dummynet/files/dnctl.conf

@@ -1,2 +1,2 @@
-dnctl pipe 1 config bw 100KByte/s
-dnctl pipe 2 config
+pipe 1 config bw 100KByte/s
+pipe 2 config

ansible/roles/dummynet/files/dnctl_rc.conf

@@ -1,2 +0,0 @@
-dnctl_enable="YES"
-dnctl_rules="/etc/dnctl.conf"

ansible/roles/dummynet/files/dummynet

@@ -0,0 +1,28 @@
+#!/bin/sh
+#
+#
+
+# PROVIDE: dummynet
+# BEFORE: pf ipfw
+# KEYWORD: nojailvnet
+
+. /etc/rc.subr
+
+name="dummynet"
+desc="Dummynet packet queuing and scheduling"
+rcvar="${name}_enable"
+load_rc_config $name
+start_cmd="${name}_start"
+required_files="$dummynet_rules"
+required_modules="dummynet"
+
+dummynet_start()
+{
+	startmsg -n "Enabling ${name}"
+        cat "$dnctl_rules" | while read l; do
+          dnctl $l
+        done
+	startmsg '.'
+}
+
+run_rc_command $*

ansible/roles/dummynet/files/dummynet_rc.conf

@@ -0,0 +1,2 @@
+dummynet_enable="YES"
+dummynet_rules="/etc/dnctl.conf"

ansible/roles/dummynet/tasks/freebsd.yaml

@@ -9,6 +9,16 @@
     - src: "{{ dummynet_config }}"
       dest: /etc/dnctl.conf
 
+- name: Install rc script
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "/usr/local/etc/rc.d/{{ item.dest|default(item.src) }}"
+    owner: root
+    group: wheel
+    mode: 0755
+  loop:
+    - src: dummynet
+
 - name: Install service configuration
   copy:
     src: "files/{{ item }}_rc.conf"
@@ -17,4 +27,4 @@
     owner: root
     group: wheel
   loop:
-    - dnctl
+    - dummynet

ansible/roles/firefox/defaults/main.yaml

@@ -21,3 +21,20 @@ firefox_config:
   privacy.globalprivacycontrol.enabled: true
   # Disable "studies" (slice testing)
   app.shield.optoutstudies.enabled: false
+  # Disable attribution which is used by advertisers to track you.
+  dom.private-attribution.submission.enabled: false
+  # Disable battery status, used to track users.
+  dom.battery.enabled: false
+  # Disable that websites can get notifications if you copy, paste, or cut something from a web page, and it lets them know which part of the page had been selected.
+  dom.event.clipboardevents.enabled: false
+  # Isolates all browser identifier sources (e.g. cookies) to the first party domain, with the goal of preventing tracking across different domains.
+  privacy.firstparty.isolate: true
+  # Do not preload URLs that auto-complete in the address bar.
+  browser.urlbar.speculativeConnect.enabled: false
+  # Do not resist fingerprinting because that tells websites to use light mode.
+  # https://bugzilla.mozilla.org/show_bug.cgi?id=1732114
+  privacy.resistFingerprinting: true
+  # Instead, enable fingerprinting protection, which allows configuring an override.
+  privacy.fingerprintingProtection: true
+  # Allow sending dark mode preference to websites.
+  privacy.fingerprintingProtection.overrides: "+AllTargets,-CSSPrefersColorScheme"

ansible/roles/firewall/files/homeserver_pf.conf

@@ -52,13 +52,12 @@ nat pass on jail_nat proto {tcp, udp} from any to 10.215.1.216 port 22 -> 10.215
 rdr pass on $ext_if inet proto {udp, tcp} from any to any port $unifi_ports -> 10.215.1.202
 
 # filtering
+# match in on jail_nat from any to any dnpipe(1, 2)
+# match in on restricted_nat from any to any dnpipe(1, 2)
+
 block log all
 pass out on $ext_if
 
-# match in on jail_nat from any to any dnpipe 1
-# match in on jail_nat from any to $rfc1918 dnpipe 2
-# match in on restricted_nat from any to any dnpipe 1
-
 pass in on jail_nat
 # Allow traffic from my machine to the jails/virtual machines
 pass out on jail_nat from $jail_nat_v4

ansible/roles/media/files/cast_file_vaapi

@@ -16,6 +16,8 @@ function main {
         h264 "${@}"
     elif [ "$cmd" = "software_h264" ]; then
         software_h264 "${@}"
+    elif [ "$cmd" = "software_vp8" ]; then
+        software_vp8 "${@}"
     elif [ "$cmd" = "preprocess_h264" ]; then
         preprocess_h264 "${@}"
     elif [ "$cmd" = "preprocess_vp8" ]; then
@@ -69,9 +71,9 @@ function h264 {
         -vf 'format=nv12|vaapi,hwupload' \
         -c:v h264_vaapi \
         -bf 0 \
-        -c:a aac \
-        -b:a 160k \
-        -ar 44100 \
+        -c:a opus \
+        -b:a 320k \
+        -ar 48000 \
         -f rtsp \
         -rtsp_transport udp \
         "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
@@ -92,9 +94,9 @@ function software_h264 {
         -i "$file_to_cast" \
         -c:v h264 \
         -bf 0 \
-        -c:a aac \
-        -b:a 160k \
-        -ar 44100 \
+        -c:a opus \
+        -b:a 320k \
+        -ar 48000 \
         -f rtsp \
         -rtsp_transport udp \
         "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
@@ -110,9 +112,9 @@ function preprocess_h264 {
         -i "$file_to_cast" \
         -c:v h264 \
         -bf 0 \
-        -c:a aac \
-        -b:a 160k \
-        -ar 44100 \
+        -c:a opus \
+        -b:a 320k \
+        -ar 48000 \
         "$file_to_save"
 }
 
@@ -138,6 +140,35 @@ function preprocess_vp8 {
         "$file_to_save"
 }
 
+function software_vp8 {
+    local USERNAME PASSWORD
+    USERNAME="$1"
+    PASSWORD="$2"
+
+    local file_to_cast
+    file_to_cast="$3"
+
+    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
+    # -strict -2 :: Enable support for experimental codecs like opus.
+    # -b:v 1M :: Target 1 megabit/s
+    # -crf 10 :: Target a quality level and adjust bitrate accordingly. This should be preferred, but ideally both should be used.
+    exec ffmpeg \
+        -re \
+        -stream_loop -1 \
+        -i "$file_to_cast" \
+        -c:v vp8 \
+        -b:v 1M \
+        -crf 10 \
+        -bf 0 \
+        -c:a opus \
+        -b:a 320k \
+        -ar 48000 \
+        -strict -2 \
+        -f rtsp \
+        -rtsp_transport udp \
+        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
+}
+
 function webcam {
     # Uses on-webcam h264 encoding.
 

ansible/roles/network/files/main.conf

@@ -1,10 +1,3 @@
-[Network]
-# NameResolvingService=resolvconf
-NameResolvingService=systemd
-
 [General]
-EnableNetworkConfiguration=True
-# route_priority_offset=300
-
-# [Scan]
-# DisablePeriodicScan=true
+EnableNetworkConfiguration=true
+# AddressRandomization=network