anchor.diff:        { addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; }
       ];
   
  +    services.privoxy.settings = {
  +      user-manual = "${pkgs.privoxy}/share/doc/privoxy/user-manual";
  +      filterfile = [ "default.filter" ];
  +      actionsfile =
  +        [ "match-all.action"
  +          "default.action"
  +        ] ++ optional cfg.inspectHttps (toString inspectAction);
  +    } // (optionalAttrs cfg.enableTor {
  +      forward-socks5 = "127.0.0.1:9063 .";
  +      toggle = true;
  +      enable-remote-toggle = false;
  +      enable-edit-actions = false;
  +      enable-remote-http-toggle = false;
  +    }) // (optionalAttrs cfg.inspectHttps {
  +      # This allows setting absolute key/crt paths
  +      ca-directory = "/var/empty";
  +      certificate-directory = "/run/privoxy/certs";
  +      trusted-cas-file = "/etc/ssl/certs/ca-certificates.crt";
  +    });
  +
     };
   
  +  imports =
  +    let
  +      top = x: [ "services" "privoxy" x ];
  +      setting = x: [ "services" "privoxy" "settings" x ];
  +    in
  +    [ (mkRenamedOptionModule (top "enableEditActions") (setting "enable-edit-actions"))
  +      (mkRenamedOptionModule (top "listenAddress") (setting "listen-address"))
  +      (mkRenamedOptionModule (top "actionsFiles") (setting "actionsfile"))
  +      (mkRenamedOptionModule (top "filterFiles") (setting "filterfile"))
  +      (mkRemovedOptionModule (top "extraConfig")
  +      ''
  +        Use services.privoxy.settings instead.
  +        This is part of the general move to use structured settings instead of raw
  +        text for config as introduced by RFC0042:
  +        https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
  +      '')
  +    ];
  +
     meta.maintainers = with lib.maintainers; [ rnhmjoj ];
   
   }
  
positive.code: 
  let
  
    inherit (pkgs) privoxy;
  
    cfg = config.services.privoxy;
  
    confFile = pkgs.writeText "privoxy.conf" (''
      user-manual ${privoxy}/share/doc/privoxy/user-manual
      confdir ${privoxy}/etc/
      listen-address  ${cfg.listenAddress}
      enable-edit-actions ${if (cfg.enableEditActions == true) then "1" else "0"}
      ${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles}
      ${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles}
    '' + optionalString cfg.enableTor ''
      forward-socks5t / 127.0.0.1:9063 .
      toggle 1
      enable-remote-toggle 0
      enable-edit-actions 0
      enable-remote-http-toggle 0
    '' + ''
      ${cfg.extraConfig}
    '');
  
  in
  
  
negative.code:   config = mkIf cfg.enable {
  
      users.users.privoxy = {
        description = "Privoxy daemon user";
        isSystemUser = true;
        group = "privoxy";
      };
  
      users.groups.privoxy = {};
  
      systemd.tmpfiles.rules = with cfg.settings; [
        "d ${certificate-directory} 0770 privoxy privoxy ${cfg.certsLifetime}"
      ];
  
      systemd.services.privoxy = {
        description = "Filtering web proxy";
        after = [ "network.target" "nss-lookup.target" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          User = "privoxy";
          Group = "privoxy";
          ExecStart = "${pkgs.privoxy}/bin/privoxy --no-daemon ${configFile}";
          PrivateDevices = true;
          PrivateTmp = true;
          ProtectHome = true;
          ProtectSystem = "full";
        };
        unitConfig =  mkIf cfg.inspectHttps {
          ConditionPathExists = with cfg.settings;
            [ ca-cert-file ca-key-file ];
        };
      };
  
      services.tor.settings.SOCKSPort = mkIf cfg.enableTor [
  