anchor.diff:          '';
         };
   
  +      enableClient = mkOption {
  +        default = true;
  +        description = ''
  +          Whether to enable Tor daemon to route application connections.
  +          You might want to disable this if you plan running a dedicated Tor relay.
  +        '';
  +      };
  +
         socksListenAddress = mkOption {
           default = "127.0.0.1:9050";
  -        example = "192.168.0.1";
  -        description = ''
  -          Bind to this address to listen for connections from Socks-speaking 
  +        example = "127.0.0.1:9050, 192.168.0.1:9100";
  +        description = ''
  +          Bind to this address(es) to listen for connections from Socks-speaking 
             applications. You can also specify a port.
  +        '';
  +      };
  +
  +      socksPolicy = mkOption {
  +        default = "";
  +        example = "accept 192.168.0.0/16, reject *";
  +        description = ''
  +          Entry policies to allow/deny SOCKS requests based on IP address.
  +          First entry that matches wins. If no SocksPolicy is set, we accept
  +          all (and only) requests from SocksListenAddress.
           '';
         };
   
  
positive.code:             mkdir -m 0755 -p ${stateDir}
              chown ${torUser} ${stateDir}
            '';
          exec = "${tor}/bin/tor -f ${pkgs.writeText "torrc" config.services.tor.config}";
        };
  
      jobs.torPrivoxy = mkIf config.services.tor.enablePrivoxy 
        { name = "tor-privoxy";
  
          startOn = "starting tor";
  
negative.code:             # Needed to run privoxy as an unprivileged user?
              ${modprobe}/sbin/modprobe capability || true
            '';
          exec = "${privoxy}/sbin/privoxy --no-daemon --user ${torUser} ${pkgs.writeText "torPrivoxy.conf" cfg.privoxyConfig}";
        };
  
        services.tor.config = ''
          DataDirectory ${stateDir}
          User ${torUser}
        ''
        + optionalString cfg.enableClient  ''
          SocksListenAddress ${cfg.socksListenAddress}
          ${opt "SocksPolicy" cfg.socksPolicy}
        ''
        + optionalString cfg.enableRelay ''
          ORPort ${toString cfg.relayPort}
          ${opt "ORListenAddress" cfg.relayListenAddress }
          ${opt "Nickname" cfg.nickname}
          ${optint "RelayBandwidthRate" cfg.relayBandwidthRate}
          ${optint "RelayBandwidthBurst" cfg.relayBandwidthBurst}
          ${if cfg.isExitRelay then opt "ExitPolicy" cfg.exitPolicy else "ExitPolicy reject *:*"}
          ${if cfg.isBridgeRelay then "BridgeRelay 1" else ""}
        '';
      
        services.tor.privoxyConfig = ''
          # Generally, this file goes in /etc/privoxy/config
          #
          # Tor listens as a SOCKS4a proxy here:
          forward-socks4a / ${cfg.socksListenAddress} .
          confdir ${privoxy}/etc
          logdir ${privoxyDir}
          # actionsfile standard  # Internal purpose, recommended
  