anchor.diff:            instace of privoxy.
           '';
         };
  +
  +      enableRelay = mkOption {
  +        default = false;
  +        description = ''
  +          Whether to enable relaying traffic for others.
  +
  +          See https://www.torproject.org/docs/tor-doc-relay for details.
  +        '';
  +      };
  +
  +      isBridgeRelay = mkOption {
  +        default = false;
  +        description = ''
  +          Bridge relays (or "bridges" ) are Tor relays that aren't listed in the
  +          main directory. Since there is no complete public list of them, even if an
  +          ISP is filtering connections to all the known Tor relays, they probably
  +          won't be able to block all the bridges.
  +
  +          A bridge relay can't be an exit relay.
  +
  +          You need to set enableRelay to true for this option to take effect.
  +
  +          See https://www.torproject.org/bridges.html.en for more info.
  +        '';
  +      };
  +
  +      isExitRelay = mkOption {
  +        default = false;
  +        description = ''
  +          An exit relay allows Tor users to access regular Internet services.
  +
  +          Unlike running a non-exit relay, running an exit relay may expose
  +          you to abuse complaints. See https://www.torproject.org/faq.html.en#ExitPolicies for more info.
  +
  +          You can specify which services Tor users may access via your exit relay using exitPolicy option.
  +        '';
  +      };
  +
  +      nickname = mkOption {
  +        default = "anonymous";
  +        description = ''
  +          A unique handle for your TOR relay.
  +        '';
  +      };
  +
  +      relayBandwidthRate = mkOption {
  +        default = 0;
  +        example = 100;
  +        description = ''
  +          Specify this to limit the bandwidth usage of relayed (server)
  +          traffic. Your own traffic is still unthrottled. Units: kilobytes/second.
  +        '';
  +      };
  +
  +      relayBandwidthBurst = mkOption {
  +        default = 0;
  +        example = 200;
  +        description = ''
  +          Specify this to allow bursts of the bandwidth usage of relayed (server)
  +          traffic. The average usage will still be as specified in relayBandwidthRate.
  +          Your own traffic is still unthrottled. Units: kilobytes/second.
  +        '';
  +      };
  +
  +      relayPort = mkOption {
  +        default = 9001;
  +        description = ''
  +          What port to advertise for Tor connections.
  +        '';
  +      };
  +
  +      relayListenAddress = mkOption {
  +        default = "";
  +        example = "0.0.0.0:9090";
  +        description = ''
  +          Set this if you need to listen on a port other than the one advertised
  +          in relayPort (e.g. to advertise 443 but bind to 9090). You'll need to do
  +          ipchains or other port forwarding yourself to make this work.
  +        '';
  +      };
  +
  +      exitPolicy = mkOption {
  +        default = "";
  +        example = "accept *:6660-6667,reject *:*";
  +        description = ''
  +          A comma-separated list of exit policies. They're considered first
  +          to last, and the first match wins. If you want to _replace_
  +          the default exit policy, end this with either a reject *:* or an
  +          accept *:*. Otherwise, you're _augmenting_ (prepending to) the
  +          default exit policy. Leave commented to just use the default, which is
  +          available in the man page or at https://www.torproject.org/documentation.html
  +
  +          Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses
  +          for issues you might encounter if you use the default exit policy.
  +
  +          If certain IPs and ports are blocked externally, e.g. by your firewall,
  +          you should update your exit policy to reflect this -- otherwise Tor
  +          users will be told that those destinations are down.
  +        '';
  +      };
  +
       };
   
     };
  
positive.code:         '';
        };
  
        socksListenAddress = mkOption {
          default = "127.0.0.1:9050";
          example = "192.168.0.1";
          description = ''
            Bind to this address to listen for connections from Socks-speaking 
            applications. You can also specify a port.
          '';
        };
  
  
negative.code: 
    modprobe = config.system.sbin.modprobe;
  
    cfg = config.services.tor;
  
    torUser = "tor";
  
    opt = name: value: if value != "" then "${name} ${value}" else "";
    optint = name: value: if value != 0 then "${name} ${toString value}" else "";
  in
  
  {
  