{ pkgs, vars, ... }:

{
  services.tor = {
    enable = true;

    # Opens settings.ORPort (and DirPort, unset here) in the firewall —
    # see the nixpkgs tor module's own networking.firewall.mkIf block.
    openFirewall = true;

    relay = {
      enable = true;
      # Plain middle/guard relay, not "exit" — relays onion traffic between
      # other Tor nodes without ever making requests to the public internet
      # on a user's behalf, avoiding the abuse complaints and legal exposure
      # an exit node invites.
      role = "relay";
    };

    settings.ORPort = vars.ports.torRelayOrPort;

    # Unix control socket at /run/tor/control (GroupWritable, group "tor")
    # -- what nyx below actually monitors the relay through. Nyx's own
    # default control-socket path (/var/run/tor/control) resolves to the
    # same place, so no extra nyx config is needed.
    controlSocket.enable = true;
  };

  # Lets the primary user's shell session read/write the control socket
  # above without being root -- otherwise nyx fails to authenticate against
  # it at all.
  users.users.${vars.primaryUser}.extraGroups = [ "tor" ];

  environment.systemPackages = [ pkgs.nyx ];
}