anchor.diff:  
     modprobe = config.system.sbin.modprobe;
   
  +  cfg = config.services.tor;
  +
     torUser = "tor";
   
  +  opt = name: value: if value != "" then "${name} ${value}" else "";
  +  optint = name: value: if value != 0 then "${name} ${toString value}" else "";
   in
   
   {
  
positive.code:         '';
        };
  
        socksListenAddress = mkOption {
          default = "127.0.0.1:9050";
          example = "192.168.0.1";
          description = ''
            Bind to this address to listen for connections from Socks-speaking 
            applications. You can also specify a port.
          '';
        };
  
  
negative.code: 
    ###### implementation
  
    config = mkIf cfg.enable {
      environment.systemPackages = [ tor ];  # provides tor-resolve and torify
  
      assertions = [{
        assertion = cfg.enableRelay || cfg.enableClient;
        message = "Need to either enable TOR client or relay functionality";
      } {
        assertion = cfg.enableRelay -> !(cfg.isBridgeRelay && cfg.isExitRelay);
        message = "Can't be both an exit and a bridge relay at the same time";
      } ];
  
      users.extraUsers = singleton
        { name = torUser;
          uid = config.ids.uids.tor;
  