{
  pkgs,
  config,
  lib,
  ...
}:
let
  inherit (config.grimmShared)
    enable
    firefox
    tooling
    locale
    sway
    ;
  inherit (lib)
    mkIf
    optionals
    mapAttrs
    optionalAttrs
    ;
in
{
  config = mkIf (enable && firefox.enable) {
    environment.systemPackages =
      [ ]
      ++ optionals config.services.desktopManager.plasma6.enable [ pkgs.plasma-browser-integration ];

    programs.firefox = {
      package = pkgs.firefox-beta;
      enable = true;
      nativeMessagingHosts.packages =
        [ ]
        ++ lib.optionals (tooling.enable && tooling.pass) [ pkgs.passff-host ];
      languagePacks = optionals locale [
        "de"
        "en-US"
      ];
      policies = {
        ExtensionSettings =
          (mkIf firefox.disableUserPlugins { "*".installation_mode = "blocked"; })
          // (mapAttrs (guid: shortId: {
            # explicit plugins by config 
            install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
            installation_mode = "force_installed";
          }) firefox.plugins)
          // (mkIf (tooling.enable && tooling.pass) {
            # password-store support
            "passff@invicem.pro" = {
              install_url = "https://addons.mozilla.org/firefox/downloads/latest/passff/latest.xpi";
              installation_mode = "force_installed";
            };
          });
        DisableTelemetry = true;
        DisableFirefoxStudies = true;
        EnableTrackingProtection = {
          Value = true;
          Locked = true;
          Cryptomining = true;
          Fingerprinting = true;
        };
        DisablePocket = true;
        DisableFirefoxAccounts = true;
        DisableAccounts = true;
        DisableFirefoxScreenshots = true;
        OverrideFirstRunPage = "";
        OverridePostUpdatePage = "";
        DontCheckDefaultBrowser = true;
        Preferences = {
          "pdfjs.enableScripting" = false;

          "media.hardware-video-decoding.enabled" = true;
          "media.ffmpeg.vaapi.enabled" = true;
          "media.rdd-ffmpeg.enabled" = true;
          "media.navigator.mediadatadecoder_vpx_enabled" = true;
        } // optionalAttrs sway.enable { "browser.tabs.inTitlebar" = 0; };
      };
    };
  };

  options.grimmShared.firefox = with lib; {
    enable = mkEnableOption "grimm-firefox";

    plugins = mkOption {
      type = types.attrsOf types.str;
      default = { };
      description = "set of plugins to install. Format: guid = short-id";
    };

    disableUserPlugins = mkEnableOption "disables user controlled plugins";
  };
}