Chromium¶

Description¶

This Ansible role installs and configures the Chromium browser along with essential security and productivity extensions. It ensures that Chromium is installed and properly set up with forced installation of uBlock Origin and the KeePassXC browser extension via Enterprise Policies, providing a secure and streamlined browsing experience.

Overview¶

Designed for various Linux distributions, this role manages the installation of the Chromium browser using the system’s package manager. It configures Chromium’s managed policies to automatically deploy key browser extensions, ensuring that users always have a secure and consistent environment. This role integrates seamlessly with other system management roles for a holistic deployment.

Architecture¶

ARCHITECTURE.md draws Chromium from its own metadata: the containers it runs under compose, what changes under swarm, how each volume is backed, and every role it depends on or is depended upon by.

Section	Drawn from
Compose	`meta/services.yml`
Swarm	`meta/services.yml` replicas and placement
Volumes	`meta/volumes.yml` against the NFS decision chain
Dependencies	`meta/services.yml` and `meta/main.yml` of every role

Purpose¶

The purpose of this role is to automate the provisioning of a secure Chromium environment in a consistent and maintainable way. It reduces manual configuration steps and guarantees that critical browser extensions are enforced, making it ideal for both production and personal deployments.

Features¶

Installs Chromium Browser: Automatically installs the appropriate Chromium package based on the target system.
Installs KeePassXC: Ensures KeePassXC is installed for secure password management.
Enforces Browser Extensions: Configures Chromium Enterprise Policies to force-install uBlock Origin and the KeePassXC browser extension.
Cross-Platform Support: Handles package variations for multiple Linux distributions.
Seamless Integration: Provides a stable and secure browsing setup as part of broader system automation workflows.

Quick Setup¶

Development¶

Clone, set up the workstation, and deploy Chromium onto the local stack:

git clone https://github.com/infinito-nexus/core.git
cd core
make onboard
make compose-deploy mode=reinstall apps=dsk-chromium full_cycle=false

Production¶

Install Chromium directly onto the target machine: clone the repository, install the OS prerequisites and the repository toolchain, then deploy against localhost over a local connection (no SSH, no container):

git clone https://github.com/infinito-nexus/core.git
cd core
bash scripts/install/package.sh
make install
source scripts/meta/env/load.sh

APP=dsk-chromium
DOMAIN="<your-domain>"
TLS_MODE=self_signed
SSH_PUBLIC_KEY="<your-ssh-public-key>"
INVENTORY=inventories/production
infinito administration inventory provision "$INVENTORY" \
  --inventory-file "$INVENTORY/devices.yml" \
  --host localhost \
  --include "$APP" \
  --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}"
infinito administration deploy dedicated "$INVENTORY/devices.yml" \
  --password-file "$INVENTORY/.password" \
  --diff -vv

Credits¶

Kevin Veen-Birkenbach

Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

That licence covers this role. The software it deploys is a separate grant: BSD-3-Clause, under which commercial use is allowed. You owe its authors this much: keep the copyright notice and the licence text. Permission for one of the two is not permission for the other.

Addons¶

This role force-installs the following Chromium browser extensions via managed Enterprise Policies. They are declared in meta/addons/ and rendered into the CRX install list.

Addon	Mechanism	Default state	Bridges
ublock-origin	extension	enabled (required)	none
keepassxc-browser	extension	enabled (required)	none
privacy-badger	extension	enabled (required)	none

Playwright exemption: these are desktop browser extensions with no in-app web surface to drive, so no Playwright spec is required (requirement 026, Decision 11).