feat: enable persistent local Tor client and network helpers

network.nix

@@ -23,6 +23,33 @@ in
     };
   };
 
+  # Local, opt-in SOCKS client only. Keep the daemon on the system package pin.
+  # No relay/exit, control listener, transparent proxy or host DNS changes.
+  services.tor = {
+    enable = true;
+    openFirewall = false;
+    relay.enable = false;
+    client = {
+      enable = true;
+      socksListenAddress = {
+        addr = "127.0.0.1";
+        port = 9050;
+        IsolateDestAddr = true;
+        IsolateSOCKSAuth = true;
+      };
+    };
+    settings.ClientOnly = true;
+  };
+  # The NixOS module enables tor.service at boot and supplies its sandbox/user.
+  # Retry even after a clean daemon exit; never exhaust systemd's start limit.
+  systemd.services.tor = {
+    unitConfig.StartLimitIntervalSec = 0;
+    serviceConfig = {
+      Restart = lib.mkForce "always";
+      RestartSec = "5s";
+    };
+  };
+
   programs.mtr = {
     enable = true;
     package = latest.mtr;
@@ -39,10 +66,14 @@ in
     ethtool
     netcat-openbsd
     socat
+    fping
+    ldns # drill and DNS/DNSSEC inspection utilities.
+    torsocks
+    proxychains-ng # Opt-in wrappers; no global proxy environment is set.
     doggo
     iftop
     bandwhich
     wireshark-cli # tshark; no capture group/capabilities or daemon.
   ];
-  # Client tools only: no VPN services, peers, keys, routes or firewall ports.
+  # No VPN services, peers, keys, routes or opened firewall ports.
 }