anchor.diff:  
     ###### implementation
   
  -  config = mkIf cfg.enable {
  +  config = mkIf (cfg.client.enable || cfg.relay.enable) {
       environment.systemPackages = [ tor ];  # provides tor-resolve and torify
   
  -    assertions = [{
  -      assertion = cfg.enableRelay || cfg.enableClient;
  -      message = "Need to either enable TOR client or relay functionality";
  -    } {
  -      assertion = cfg.enableRelay -> !(cfg.isBridgeRelay && cfg.isExitRelay);
  +    assertions = [ {
  +      assertion = cfg.relay.enable -> !(cfg.relay.isBridge && cfg.relay.isExit);
         message = "Can't be both an exit and a bridge relay at the same time";
       } ];
   
  
positive.code:   options = {
    
      services.tor = {
  
        enable = mkOption {
          default = false;
          description = ''
            Whether to enable the Tor anonymous routing daemon.
          '';
        };
  
        enableClient = mkOption {
          default = true;
          description = ''
            Whether to enable Tor daemon to route application connections.
            You might want to disable this if you plan running a dedicated Tor relay.
          '';
        };
  
        socksListenAddress = mkOption {
          default = "127.0.0.1:9050";
          example = "127.0.0.1:9050, 192.168.0.1:9100";
          description = ''
            Bind to this address(es) to listen for connections from Socks-speaking 
            applications. You can also specify a port.
          '';
        };
  
        socksPolicy = mkOption {
          default = "";
          example = "accept 192.168.0.0/16, reject *";
          description = ''
            Entry policies to allow/deny SOCKS requests based on IP address.
            First entry that matches wins. If no SocksPolicy is set, we accept
            all (and only) requests from SocksListenAddress.
          '';
        };
  
        config = mkOption {
          default = "";
  
negative.code:         exec = "${tor}/bin/tor -f ${pkgs.writeText "torrc" cfg.config}";
        };
  
      jobs.torPrivoxy = mkIf (cfg.client.privoxy.enable && cfg.client.enable)
        { name = "tor-privoxy";
  
          startOn = "starting tor";
  