anchor.diff:  
     ###### implementation
   
  -  config = mkIf config.services.tor.enable {
  +  config = mkIf cfg.enable {
       environment.systemPackages = [ tor ];  # provides tor-resolve and torify
  -  
  +
  +    assertions = [{
  +      assertion = cfg.enableRelay || cfg.enableClient;
  +      message = "Need to either enable TOR client or relay functionality";
  +    } {
  +      assertion = cfg.enableRelay -> !(cfg.isBridgeRelay && cfg.isExitRelay);
  +      message = "Can't be both an exit and a bridge relay at the same time";
  +    } ];
  +
       users.extraUsers = singleton
         { name = torUser;
           uid = config.ids.uids.tor;
  
positive.code:         debug   8192 # Errors - *we highly recommended enabling this*
          
          user-manual ${privoxy}/doc/privoxy/user-manual
          listen-address  ${config.services.tor.privoxyListenAddress}
          toggle  1
          enable-remote-toggle 0
          enable-edit-actions 0
  
negative.code:         '';
        };
  
        enableClient = mkOption {
          default = true;
          description = ''
            Whether to enable Tor daemon to route application connections.
            You might want to disable this if you plan running a dedicated Tor relay.
          '';
        };
  
        socksListenAddress = mkOption {
          default = "127.0.0.1:9050";
          example = "127.0.0.1:9050, 192.168.0.1:9100";
          description = ''
            Bind to this address(es) to listen for connections from Socks-speaking 
            applications. You can also specify a port.
          '';
        };
  
        socksPolicy = mkOption {
          default = "";
          example = "accept 192.168.0.0/16, reject *";
          description = ''
            Entry policies to allow/deny SOCKS requests based on IP address.
            First entry that matches wins. If no SocksPolicy is set, we accept
            all (and only) requests from SocksListenAddress.
          '';
        };
  
  