{config, ...}: let
  owner = config.customOps.owner.username;
  domain = config.customOps.domain.fqdn;
in {
  imports = [./snowflake.nix];

  services.tor = {
    enable = true;
    openFirewall = true;
    enableGeoIP = false;
    torsocks.enable = true;
    client.enable = true;

    relay = {
      enable = true;
      role = "relay";
    };

    settings = {
      Nickname = "${owner}";
      ContactInfo = "admin.tor@${domain}";

      ExitRelay = false;

      MaxAdvertisedBandwidth = "100 MB";
      BandWidthRate = "100 MB";
      RelayBandwidthRate = "100 MB";
      RelayBandwidthBurst = "100 MB";

      CookieAuthentication = true;
      AvoidDiskWrites = 1;
      HardwareAccel = 0;
      SafeLogging = 1;
      NumCPUs = 4;

      ORPort = [
        9001
        {
          addr = "[2a0a:4cc0:c1:cf00::10]";
          port = 9030;
        }
      ];
    };
  };
}