anchor.diff:    config = mkIf cfg.enable {
   
       users.users.privoxy = {
  +      description = "Privoxy daemon user";
         isSystemUser = true;
  -      home = "/var/empty";
         group = "privoxy";
       };
   
       users.groups.privoxy = {};
  +
  +    systemd.tmpfiles.rules = with cfg.settings; [
  +      "d ${certificate-directory} 0770 privoxy privoxy ${cfg.certsLifetime}"
  +    ];
   
       systemd.services.privoxy = {
         description = "Filtering web proxy";
         after = [ "network.target" "nss-lookup.target" ];
         wantedBy = [ "multi-user.target" ];
  -      serviceConfig.ExecStart = "${privoxy}/bin/privoxy --no-daemon --user privoxy ${confFile}";
  -
  -      serviceConfig.PrivateDevices = true;
  -      serviceConfig.PrivateTmp = true;
  -      serviceConfig.ProtectHome = true;
  -      serviceConfig.ProtectSystem = "full";
  +      serviceConfig = {
  +        User = "privoxy";
  +        Group = "privoxy";
  +        ExecStart = "${pkgs.privoxy}/bin/privoxy --no-daemon ${configFile}";
  +        PrivateDevices = true;
  +        PrivateTmp = true;
  +        ProtectHome = true;
  +        ProtectSystem = "full";
  +      };
  +      unitConfig =  mkIf cfg.inspectHttps {
  +        ConditionPathExists = with cfg.settings;
  +          [ ca-cert-file ca-key-file ];
  +      };
       };
   
       services.tor.settings.SOCKSPort = mkIf cfg.enableTor [
  
positive.code: 
    ###### interface
  
    options = {
  
      services.privoxy = {
  
        enable = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Whether to enable the Privoxy non-caching filtering proxy.
          '';
        };
  
        listenAddress = mkOption {
          type = types.str;
          default = "127.0.0.1:8118";
          description = ''
            Address the proxy server is listening to.
          '';
        };
  
        actionsFiles = mkOption {
          type = types.listOf types.str;
          example = [ "match-all.action" "default.action" "/etc/privoxy/user.action" ];
          default = [ "match-all.action" "default.action" ];
          description = ''
            List of paths to Privoxy action files.
            These paths may either be absolute or relative to the privoxy configuration directory.
          '';
        };
  
        filterFiles = mkOption {
          type = types.listOf types.str;
          example = [ "default.filter" "/etc/privoxy/user.filter" ];
          default = [ "default.filter" ];
          description = ''
            List of paths to Privoxy filter files.
            These paths may either be absolute or relative to the privoxy configuration directory.
          '';
        };
  
        enableEditActions = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Whether or not the web-based actions file editor may be used.
          '';
        };
  
        enableTor = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Whether to configure Privoxy to use Tor's faster SOCKS port,
            suitable for HTTP.
          '';
        };
  
        extraConfig = mkOption {
          type = types.lines;
          default = "" ;
          description = ''
            Extra configuration. Contents will be added verbatim to the configuration file.
          '';
        };
      };
  
    };
  
negative.code: 
  let
  
    cfg = config.services.privoxy;
  
    serialise = name: val:
           if isList val then concatMapStrings (serialise name) val
      else if isBool val then serialise name (if val then "1" else "0")
      else "${name} ${toString val}\n";
  
    configType = with types;
      let atom = oneOf [ int bool string path ];
      in attrsOf (either atom (listOf atom))
      // { description = ''
            privoxy configuration type. The format consists of an attribute
            set of settings. Each setting can be either a value (integer, string,
            boolean or path) or a list of such values.
          '';
         };
  
    ageType = types.str // {
      check = x:
        isString x &&
        (builtins.match "([0-9]+([smhdw]|min|ms|us)*)+" x != null);
      description = "tmpfiles.d(5) age format";
    };
  
    configFile = pkgs.writeText "privoxy.conf"
      (concatStrings (
        # Relative paths in some options are relative to confdir. Privoxy seems
        # to parse the options in order of appearance, so this must come first.
        # Nix however doesn't preserve the order in attrsets, so we have to
        # hardcode confdir here.
        [ "confdir ${pkgs.privoxy}/etc\n" ]
        ++ mapAttrsToList serialise cfg.settings
      ));
  
    inspectAction = pkgs.writeText "inspect-all-https.action"
      ''
        # Enable HTTPS inspection for all requests
        {+https-inspection}
        /
      '';
  
  in
  
  