anchor.diff:              mkdir -m 0755 -p ${stateDir}
               chown ${torUser} ${stateDir}
             '';
  -        exec = "${tor}/bin/tor -f ${pkgs.writeText "torrc" config.services.tor.config}";
  -      };
  -
  -    jobs.torPrivoxy = mkIf config.services.tor.enablePrivoxy 
  +        exec = "${tor}/bin/tor -f ${pkgs.writeText "torrc" cfg.config}";
  +      };
  +
  +    jobs.torPrivoxy = mkIf (cfg.enablePrivoxy && cfg.enableClient)
         { name = "tor-privoxy";
   
           startOn = "starting tor";
  
positive.code: 
    modprobe = config.system.sbin.modprobe;
  
    torUser = "tor";
  
  in
  
  {
  
negative.code:         '';
        };
  
        enableClient = mkOption {
          default = true;
          description = ''
            Whether to enable Tor daemon to route application connections.
            You might want to disable this if you plan running a dedicated Tor relay.
          '';
        };
  
        socksListenAddress = mkOption {
          default = "127.0.0.1:9050";
          example = "127.0.0.1:9050, 192.168.0.1:9100";
          description = ''
            Bind to this address(es) to listen for connections from Socks-speaking 
            applications. You can also specify a port.
          '';
        };
  
        socksPolicy = mkOption {
          default = "";
          example = "accept 192.168.0.0/16, reject *";
          description = ''
            Entry policies to allow/deny SOCKS requests based on IP address.
            First entry that matches wins. If no SocksPolicy is set, we accept
            all (and only) requests from SocksListenAddress.
          '';
        };
  
  