anchor.diff:          '';
         };
   
  -      enablePrivoxy = mkOption {
  -        default = true;
  -        description = ''
  -          Whether to enable a special instance of privoxy dedicated to Tor.
  -          To have anonymity, protocols need to be scrubbed of identifying 
  -          information.
  -          Most people using Tor want to anonymize their web traffic, so by 
  -          default we enable an special instance of privoxy specifically for
  -          Tor.
  -          However, if you are only going to use Tor only as a relay then you
  -          can disable this option.
  -        '';
  -      };
  -      
  -      privoxyListenAddress = mkOption {
  -        default = "127.0.0.1:8118";
  -        description = ''
  -          Address that Tor's instance of privoxy is listening to.
  -          *This does not configure the standard NixOS instance of privoxy.*  
  -          This is for Tor connections only! 
  -          See services.privoxy.listenAddress to configure the standard NixOS 
  -          instace of privoxy.
  -        '';
  -      };
  -
  -      privoxyConfig = mkOption {
  -        default = "";
  -        description = ''
  -          Extra configuration for Tor's instance of privoxy. Contents will be 
  -          added verbatim to the configuration file.
  -          *This does not configure the standard NixOS instance of privoxy.* 
  -          This is for Tor connections only! 
  -          See services.privoxy.extraConfig to configure the standard NixOS 
  -          instace of privoxy.
  -        '';
  -      };
  -
  -      enableRelay = mkOption {
  -        default = false;
  -        description = ''
  -          Whether to enable relaying traffic for others.
  -
  -          See https://www.torproject.org/docs/tor-doc-relay for details.
  -        '';
  -      };
  -
  -      isBridgeRelay = mkOption {
  -        default = false;
  -        description = ''
  -          Bridge relays (or "bridges" ) are Tor relays that aren't listed in the
  -          main directory. Since there is no complete public list of them, even if an
  -          ISP is filtering connections to all the known Tor relays, they probably
  -          won't be able to block all the bridges.
  -
  -          A bridge relay can't be an exit relay.
  -
  -          You need to set enableRelay to true for this option to take effect.
  -
  -          See https://www.torproject.org/bridges.html.en for more info.
  -        '';
  -      };
  -
  -      isExitRelay = mkOption {
  -        default = false;
  -        description = ''
  -          An exit relay allows Tor users to access regular Internet services.
  -
  -          Unlike running a non-exit relay, running an exit relay may expose
  -          you to abuse complaints. See https://www.torproject.org/faq.html.en#ExitPolicies for more info.
  -
  -          You can specify which services Tor users may access via your exit relay using exitPolicy option.
  -        '';
  -      };
  -
  -      nickname = mkOption {
  -        default = "anonymous";
  -        description = ''
  -          A unique handle for your TOR relay.
  -        '';
  -      };
  -
  -      relayBandwidthRate = mkOption {
  -        default = 0;
  -        example = 100;
  -        description = ''
  -          Specify this to limit the bandwidth usage of relayed (server)
  -          traffic. Your own traffic is still unthrottled. Units: bytes/second.
  -        '';
  -      };
  -
  -      relayBandwidthBurst = mkOption {
  -        default = 0;
  -        example = 200;
  -        description = ''
  -          Specify this to allow bursts of the bandwidth usage of relayed (server)
  -          traffic. The average usage will still be as specified in relayBandwidthRate.
  -          Your own traffic is still unthrottled. Units: bytes/second.
  -        '';
  -      };
  -
  -      relayPort = mkOption {
  -        default = 9001;
  -        description = ''
  -          What port to advertise for Tor connections.
  -        '';
  -      };
  -
  -      relayListenAddress = mkOption {
  -        default = "";
  -        example = "0.0.0.0:9090";
  -        description = ''
  -          Set this if you need to listen on a port other than the one advertised
  -          in relayPort (e.g. to advertise 443 but bind to 9090). You'll need to do
  -          ipchains or other port forwarding yourself to make this work.
  -        '';
  -      };
  -
  -      exitPolicy = mkOption {
  -        default = "";
  -        example = "accept *:6660-6667,reject *:*";
  -        description = ''
  -          A comma-separated list of exit policies. They're considered first
  -          to last, and the first match wins. If you want to _replace_
  -          the default exit policy, end this with either a reject *:* or an
  -          accept *:*. Otherwise, you're _augmenting_ (prepending to) the
  -          default exit policy. Leave commented to just use the default, which is
  -          available in the man page or at https://www.torproject.org/documentation.html
  -
  -          Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses
  -          for issues you might encounter if you use the default exit policy.
  -
  -          If certain IPs and ports are blocked externally, e.g. by your firewall,
  -          you should update your exit policy to reflect this -- otherwise Tor
  -          users will be told that those destinations are down.
  -        '';
  +      client = {
  +
  +        enable = mkOption {
  +          default = true;
  +          description = ''
  +            Whether to enable Tor daemon to route application connections.
  +            You might want to disable this if you plan running a dedicated Tor relay.
  +          '';
  +        };
  +
  +        socksListenAddress = mkOption {
  +          default = "127.0.0.1:9050";
  +          example = "127.0.0.1:9050, 192.168.0.1:9100";
  +          description = ''
  +            Bind to this address(es) to listen for connections from Socks-speaking 
  +            applications. You can also specify a port.
  +          '';
  +        };
  +
  +        socksPolicy = mkOption {
  +          default = "";
  +          example = "accept 192.168.0.0/16, reject *";
  +          description = ''
  +            Entry policies to allow/deny SOCKS requests based on IP address.
  +            First entry that matches wins. If no SocksPolicy is set, we accept
  +            all (and only) requests from SocksListenAddress.
  +          '';
  +        };
  +
  +        privoxy = {
  +
  +          enable = mkOption {
  +            default = true;
  +            description = ''
  +              Whether to enable a special instance of privoxy dedicated to Tor.
  +              To have anonymity, protocols need to be scrubbed of identifying 
  +              information.
  +              Most people using Tor want to anonymize their web traffic, so by 
  +              default we enable an special instance of privoxy specifically for
  +              Tor.
  +              However, if you are only going to use Tor only for other kinds of
  +              traffic then you can disable this option.
  +            '';
  +          };
  +
  +          listenAddress = mkOption {
  +            default = "127.0.0.1:8118";
  +            description = ''
  +              Address that Tor's instance of privoxy is listening to.
  +              *This does not configure the standard NixOS instance of privoxy.*  
  +              This is for Tor connections only! 
  +              See services.privoxy.listenAddress to configure the standard NixOS 
  +              instace of privoxy.
  +            '';
  +          };
  +
  +          config = mkOption {
  +            default = "";
  +            description = ''
  +              Extra configuration for Tor's instance of privoxy. Contents will be 
  +              added verbatim to the configuration file.
  +              *This does not configure the standard NixOS instance of privoxy.* 
  +              This is for Tor connections only! 
  +              See services.privoxy.extraConfig to configure the standard NixOS 
  +              instace of privoxy.
  +            '';
  +          };
  +
  +        };
  +
  +      };
  +
  +      relay = {      
  +
  +        enable = mkOption {
  +          default = false;
  +          description = ''
  +            Whether to enable relaying TOR traffic for others.
  +
  +            See https://www.torproject.org/docs/tor-doc-relay for details.
  +          '';
  +        };
  +
  +        isBridge = mkOption {
  +          default = false;
  +          description = ''
  +            Bridge relays (or "bridges" ) are Tor relays that aren't listed in the
  +            main directory. Since there is no complete public list of them, even if an
  +            ISP is filtering connections to all the known Tor relays, they probably
  +            won't be able to block all the bridges.
  +
  +            A bridge relay can't be an exit relay.
  +
  +            You need to set enableRelay to true for this option to take effect.
  +
  +            See https://www.torproject.org/bridges.html.en for more info.
  +          '';
  +        };
  +
  +        isExit = mkOption {
  +          default = false;
  +          description = ''
  +            An exit relay allows Tor users to access regular Internet services.
  +
  +            Unlike running a non-exit relay, running an exit relay may expose
  +            you to abuse complaints. See https://www.torproject.org/faq.html.en#ExitPolicies for more info.
  +
  +            You can specify which services Tor users may access via your exit relay using exitPolicy option.
  +          '';
  +        };
  +
  +        nickname = mkOption {
  +          default = "anonymous";
  +          description = ''
  +            A unique handle for your TOR relay.
  +          '';
  +        };
  +
  +        bandwidthRate = mkOption {
  +          default = 0;
  +          example = 100;
  +          description = ''
  +            Specify this to limit the bandwidth usage of relayed (server)
  +            traffic. Your own traffic is still unthrottled. Units: bytes/second.
  +          '';
  +        };
  +
  +        bandwidthBurst = mkOption {
  +          default = 0;
  +          example = 200;
  +          description = ''
  +            Specify this to allow bursts of the bandwidth usage of relayed (server)
  +            traffic. The average usage will still be as specified in relayBandwidthRate.
  +            Your own traffic is still unthrottled. Units: bytes/second.
  +          '';
  +        };
  +
  +        port = mkOption {
  +          default = 9001;
  +          description = ''
  +            What port to advertise for Tor connections.
  +          '';
  +        };
  +
  +        listenAddress = mkOption {
  +          default = "";
  +          example = "0.0.0.0:9090";
  +          description = ''
  +            Set this if you need to listen on a port other than the one advertised
  +            in relayPort (e.g. to advertise 443 but bind to 9090). You'll need to do
  +            ipchains or other port forwsarding yourself to make this work.
  +          '';
  +        };
  +
  +        exitPolicy = mkOption {
  +          default = "";
  +          example = "accept *:6660-6667,reject *:*";
  +          description = ''
  +            A comma-separated list of exit policies. They're considered first
  +            to last, and the first match wins. If you want to _replace_
  +            the default exit policy, end this with either a reject *:* or an
  +            accept *:*. Otherwise, you're _augmenting_ (prepending to) the
  +            default exit policy. Leave commented to just use the default, which is
  +            available in the man page or at https://www.torproject.org/documentation.html
  +
  +            Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses
  +            for issues you might encounter if you use the default exit policy.
  +
  +            If certain IPs and ports are blocked externally, e.g. by your firewall,
  +            you should update your exit policy to reflect this -- otherwise Tor
  +            users will be told that those destinations are down.
  +          '';
  +        };
  +
         };
   
       };
  
positive.code:         exec = "${tor}/bin/tor -f ${pkgs.writeText "torrc" cfg.config}";
        };
  
      jobs.torPrivoxy = mkIf (cfg.enablePrivoxy && cfg.enableClient)
        { name = "tor-privoxy";
  
          startOn = "starting tor";
  
negative.code:             # Needed to run privoxy as an unprivileged user?
              ${modprobe}/sbin/modprobe capability || true
            '';
          exec = "${privoxy}/sbin/privoxy --no-daemon --user ${torUser} ${pkgs.writeText "torPrivoxy.conf" cfg.client.privoxy.config}";
        };
  
        services.tor.config = ''
          DataDirectory ${stateDir}
          User ${torUser}
        ''
        + optionalString cfg.client.enable  ''
          SocksListenAddress ${cfg.client.socksListenAddress}
          ${opt "SocksPolicy" cfg.client.socksPolicy}
        ''
        + optionalString cfg.relay.enable ''
          ORPort ${toString cfg.relay.port}
          ${opt "ORListenAddress" cfg.relay.listenAddress }
          ${opt "Nickname" cfg.relay.nickname}
          ${optint "RelayBandwidthRate" cfg.relay.bandwidthRate}
          ${optint "RelayBandwidthBurst" cfg.relay.bandwidthBurst}
          ${if cfg.relay.isExit then opt "ExitPolicy" cfg.relay.exitPolicy else "ExitPolicy reject *:*"}
          ${if cfg.relay.isBridge then "BridgeRelay 1" else ""}
        '';
      
        services.tor.client.privoxy.config = ''
          # Generally, this file goes in /etc/privoxy/config
          #
          # Tor listens as a SOCKS4a proxy here:
          forward-socks4a / ${cfg.client.socksListenAddress} .
          confdir ${privoxy}/etc
          logdir ${privoxyDir}
          # actionsfile standard  # Internal purpose, recommended
  