anchor.diff:    config = mkIf cfg.enable {
   
       users.users.privoxy = {
  +      description = "Privoxy daemon user";
         isSystemUser = true;
  -      home = "/var/empty";
         group = "privoxy";
       };
   
       users.groups.privoxy = {};
  +
  +    systemd.tmpfiles.rules = with cfg.settings; [
  +      "d ${certificate-directory} 0770 privoxy privoxy ${cfg.certsLifetime}"
  +    ];
   
       systemd.services.privoxy = {
         description = "Filtering web proxy";
         after = [ "network.target" "nss-lookup.target" ];
         wantedBy = [ "multi-user.target" ];
  -      serviceConfig.ExecStart = "${privoxy}/bin/privoxy --no-daemon --user privoxy ${confFile}";
  -
  -      serviceConfig.PrivateDevices = true;
  -      serviceConfig.PrivateTmp = true;
  -      serviceConfig.ProtectHome = true;
  -      serviceConfig.ProtectSystem = "full";
  +      serviceConfig = {
  +        User = "privoxy";
  +        Group = "privoxy";
  +        ExecStart = "${pkgs.privoxy}/bin/privoxy --no-daemon ${configFile}";
  +        PrivateDevices = true;
  +        PrivateTmp = true;
  +        ProtectHome = true;
  +        ProtectSystem = "full";
  +      };
  +      unitConfig =  mkIf cfg.inspectHttps {
  +        ConditionPathExists = with cfg.settings;
  +          [ ca-cert-file ca-key-file ];
  +      };
       };
   
       services.tor.settings.SOCKSPort = mkIf cfg.enableTor [
  
positive.code: 
  let
  
    inherit (pkgs) privoxy;
  
    cfg = config.services.privoxy;
  
    confFile = pkgs.writeText "privoxy.conf" (''
      user-manual ${privoxy}/share/doc/privoxy/user-manual
      confdir ${privoxy}/etc/
      listen-address  ${cfg.listenAddress}
      enable-edit-actions ${if (cfg.enableEditActions == true) then "1" else "0"}
      ${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles}
      ${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles}
    '' + optionalString cfg.enableTor ''
      forward-socks5t / 127.0.0.1:9063 .
      toggle 1
      enable-remote-toggle 0
      enable-edit-actions 0
      enable-remote-http-toggle 0
    '' + ''
      ${cfg.extraConfig}
    '');
  
  in
  
  
negative.code:       { addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; }
      ];
  
      services.privoxy.settings = {
        user-manual = "${pkgs.privoxy}/share/doc/privoxy/user-manual";
        filterfile = [ "default.filter" ];
        actionsfile =
          [ "match-all.action"
            "default.action"
          ] ++ optional cfg.inspectHttps (toString inspectAction);
      } // (optionalAttrs cfg.enableTor {
        forward-socks5 = "127.0.0.1:9063 .";
        toggle = true;
        enable-remote-toggle = false;
        enable-edit-actions = false;
        enable-remote-http-toggle = false;
      }) // (optionalAttrs cfg.inspectHttps {
        # This allows setting absolute key/crt paths
        ca-directory = "/var/empty";
        certificate-directory = "/run/privoxy/certs";
        trusted-cas-file = "/etc/ssl/certs/ca-certificates.crt";
      });
  
    };
  
    imports =
      let
        top = x: [ "services" "privoxy" x ];
        setting = x: [ "services" "privoxy" "settings" x ];
      in
      [ (mkRenamedOptionModule (top "enableEditActions") (setting "enable-edit-actions"))
        (mkRenamedOptionModule (top "listenAddress") (setting "listen-address"))
        (mkRenamedOptionModule (top "actionsFiles") (setting "actionsfile"))
        (mkRenamedOptionModule (top "filterFiles") (setting "filterfile"))
        (mkRemovedOptionModule (top "extraConfig")
        ''
          Use services.privoxy.settings instead.
          This is part of the general move to use structured settings instead of raw
          text for config as introduced by RFC0042:
          https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
        '')
      ];
  
    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
  
  }
  