{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.os.srv.tor;
in
{
  options.os.srv.tor = {
    enable = lib.mkEnableOption "enables tor services";
    enableBrowser = lib.mkEnableOption "enables the tor browser";
  };

  config = lib.mkMerge [
    (lib.mkIf cfg.enable {
      services.tor = {
        enable = true;
        client = {
          enable = true;
          dns.enable = true;
          transparentProxy.enable = true;
        };
        settings = {
          Sandbox = true;
          DisableAllSwap = true;
        };
      };
    })
    (lib.mkIf cfg.enableBrowser {
      environment.systemPackages = [ pkgs.tor-browser ];
    })
  ];
}