anchor.diff:    options = {
     
       services.tor = {
  -
  -      enable = mkOption {
  -        default = false;
  -        description = ''
  -          Whether to enable the Tor anonymous routing daemon.
  -        '';
  -      };
  -
  -      enableClient = mkOption {
  -        default = true;
  -        description = ''
  -          Whether to enable Tor daemon to route application connections.
  -          You might want to disable this if you plan running a dedicated Tor relay.
  -        '';
  -      };
  -
  -      socksListenAddress = mkOption {
  -        default = "127.0.0.1:9050";
  -        example = "127.0.0.1:9050, 192.168.0.1:9100";
  -        description = ''
  -          Bind to this address(es) to listen for connections from Socks-speaking 
  -          applications. You can also specify a port.
  -        '';
  -      };
  -
  -      socksPolicy = mkOption {
  -        default = "";
  -        example = "accept 192.168.0.0/16, reject *";
  -        description = ''
  -          Entry policies to allow/deny SOCKS requests based on IP address.
  -          First entry that matches wins. If no SocksPolicy is set, we accept
  -          all (and only) requests from SocksListenAddress.
  -        '';
  -      };
   
         config = mkOption {
           default = "";
  
positive.code: 
    ###### implementation
  
    config = mkIf cfg.enable {
      environment.systemPackages = [ tor ];  # provides tor-resolve and torify
  
      assertions = [{
        assertion = cfg.enableRelay || cfg.enableClient;
        message = "Need to either enable TOR client or relay functionality";
      } {
        assertion = cfg.enableRelay -> !(cfg.isBridgeRelay && cfg.isExitRelay);
        message = "Can't be both an exit and a bridge relay at the same time";
      } ];
  
  
negative.code:             # Needed to run privoxy as an unprivileged user?
              ${modprobe}/sbin/modprobe capability || true
            '';
          exec = "${privoxy}/sbin/privoxy --no-daemon --user ${torUser} ${pkgs.writeText "torPrivoxy.conf" cfg.client.privoxy.config}";
        };
  
        services.tor.config = ''
          DataDirectory ${stateDir}
          User ${torUser}
        ''
        + optionalString cfg.client.enable  ''
          SocksListenAddress ${cfg.client.socksListenAddress}
          ${opt "SocksPolicy" cfg.client.socksPolicy}
        ''
        + optionalString cfg.relay.enable ''
          ORPort ${toString cfg.relay.port}
          ${opt "ORListenAddress" cfg.relay.listenAddress }
          ${opt "Nickname" cfg.relay.nickname}
          ${optint "RelayBandwidthRate" cfg.relay.bandwidthRate}
          ${optint "RelayBandwidthBurst" cfg.relay.bandwidthBurst}
          ${if cfg.relay.isExit then opt "ExitPolicy" cfg.relay.exitPolicy else "ExitPolicy reject *:*"}
          ${if cfg.relay.isBridge then "BridgeRelay 1" else ""}
        '';
      
        services.tor.client.privoxy.config = ''
          # Generally, this file goes in /etc/privoxy/config
          #
          # Tor listens as a SOCKS4a proxy here:
          forward-socks4a / ${cfg.client.socksListenAddress} .
          confdir ${privoxy}/etc
          logdir ${privoxyDir}
          # actionsfile standard  # Internal purpose, recommended
  