anchor.diff:              # Needed to run privoxy as an unprivileged user?
               ${modprobe}/sbin/modprobe capability || true
             '';
  -        exec = "${privoxy}/sbin/privoxy --no-daemon --user ${torUser} ${pkgs.writeText "torPrivoxy.conf" cfg.privoxyConfig}";
  +        exec = "${privoxy}/sbin/privoxy --no-daemon --user ${torUser} ${pkgs.writeText "torPrivoxy.conf" cfg.client.privoxy.config}";
         };
   
         services.tor.config = ''
           DataDirectory ${stateDir}
           User ${torUser}
         ''
  -      + optionalString cfg.enableClient  ''
  -        SocksListenAddress ${cfg.socksListenAddress}
  -        ${opt "SocksPolicy" cfg.socksPolicy}
  +      + optionalString cfg.client.enable  ''
  +        SocksListenAddress ${cfg.client.socksListenAddress}
  +        ${opt "SocksPolicy" cfg.client.socksPolicy}
         ''
  -      + optionalString cfg.enableRelay ''
  -        ORPort ${toString cfg.relayPort}
  -        ${opt "ORListenAddress" cfg.relayListenAddress }
  -        ${opt "Nickname" cfg.nickname}
  -        ${optint "RelayBandwidthRate" cfg.relayBandwidthRate}
  -        ${optint "RelayBandwidthBurst" cfg.relayBandwidthBurst}
  -        ${if cfg.isExitRelay then opt "ExitPolicy" cfg.exitPolicy else "ExitPolicy reject *:*"}
  -        ${if cfg.isBridgeRelay then "BridgeRelay 1" else ""}
  +      + optionalString cfg.relay.enable ''
  +        ORPort ${toString cfg.relay.port}
  +        ${opt "ORListenAddress" cfg.relay.listenAddress }
  +        ${opt "Nickname" cfg.relay.nickname}
  +        ${optint "RelayBandwidthRate" cfg.relay.bandwidthRate}
  +        ${optint "RelayBandwidthBurst" cfg.relay.bandwidthBurst}
  +        ${if cfg.relay.isExit then opt "ExitPolicy" cfg.relay.exitPolicy else "ExitPolicy reject *:*"}
  +        ${if cfg.relay.isBridge then "BridgeRelay 1" else ""}
         '';
       
  -      services.tor.privoxyConfig = ''
  +      services.tor.client.privoxy.config = ''
           # Generally, this file goes in /etc/privoxy/config
           #
           # Tor listens as a SOCKS4a proxy here:
  -        forward-socks4a / ${cfg.socksListenAddress} .
  +        forward-socks4a / ${cfg.client.socksListenAddress} .
           confdir ${privoxy}/etc
           logdir ${privoxyDir}
           # actionsfile standard  # Internal purpose, recommended
  
positive.code:         debug   8192 # Errors - *we highly recommended enabling this*
          
          user-manual ${privoxy}/doc/privoxy/user-manual
          listen-address  ${cfg.privoxyListenAddress}
          toggle  1
          enable-remote-toggle 0
          enable-edit-actions 0
  
negative.code: 
    ###### implementation
  
    config = mkIf (cfg.client.enable || cfg.relay.enable) {
      environment.systemPackages = [ tor ];  # provides tor-resolve and torify
  
      assertions = [ {
        assertion = cfg.relay.enable -> !(cfg.relay.isBridge && cfg.relay.isExit);
        message = "Can't be both an exit and a bridge relay at the same time";
      } ];
  
  