From 6d25f77a643762d718c49ab3fc86e0262d2d38fd Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Sat, 11 Mar 2017 17:55:12 +0000
Subject: [PATCH 1/2] nixos: tor: add enableGeoIP

---
 nixos/modules/services/security/tor.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix
index 47f863b96df2..3b4d77a6f7b1 100644
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -12,6 +12,10 @@ let
   torRc = ''
     User tor
     DataDirectory ${torDirectory}
+    ${optionalString cfg.enableGeoIP ''
+      GeoIPFile ${pkgs.tor.geoip}/share/tor/geoip
+      GeoIPv6File ${pkgs.tor.geoip}/share/tor/geoip6
+    ''}
 
     ${optint "ControlPort" cfg.controlPort}
   ''
@@ -58,6 +62,18 @@ in
         '';
       };
 
+      enableGeoIP = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whenever to configure Tor daemon to use GeoIP databases.
+
+          Disabling this will disable by-country statistics for
+          bridges and relays and some client and third-party software
+          functionality.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";

From a04782581a96d5ee8b4001701432599959ac2dc2 Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Sat, 11 Mar 2017 18:04:08 +0000
Subject: [PATCH 2/2] nixos: torify: disable by default, add some documentation
 as of why

This `tsocks` wrapper leaks DNS requests to clearnet, meanwhile Tor comes with
`torsocks` which doesn't.

Previous commits to this file state that all of this still useful somehow.
Assuming that it's true, at least let's not confuse users with two different tools
and don't clash with the `tsocks` binary from nixpkgs by disabling this by default.
---
 nixos/modules/services/security/torify.nix | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/security/torify.nix b/nixos/modules/services/security/torify.nix
index a81cdbbc172f..a29cb3f33dae 100644
--- a/nixos/modules/services/security/torify.nix
+++ b/nixos/modules/services/security/torify.nix
@@ -19,15 +19,23 @@ in
 {
 
   ###### interface
-  
+
   options = {
-  
+
     services.tor.tsocks = {
 
       enable = mkOption {
-        default = cfg.enable && cfg.client.enable;
+        default = false;
         description = ''
-          Whether to build tsocks wrapper script to relay application traffic via TOR.
+          Whether to build tsocks wrapper script to relay application traffic via Tor.
+
+          <important>
+            <para>You shouldn't use this unless you know what you're
+            doing because your installation of Tor already comes with
+            its own superior (doesn't leak DNS queries)
+            <literal>torsocks</literal> wrapper which does pretty much
+            exactly the same thing as this.</para>
+          </important>
         '';
       };