system/modules/nixos/programs/browsers/tor-browser.nix

{ config, pkgs, lib, ... }:

let
  cfg = config.local.programs.browsers.tor-browser;

  policiesJson = pkgs.callPackage ./policies.nix { };

  finalTorBrowser = (cfg.package.override {
    mediaSupport = true;
    pulseaudioSupport = true;
  }).overrideAttrs (attrs: {
    postInstall = ''
      rm $out/share/tor-browser/distribution/policies.json
      install -Dvm644 ${policiesJson} $out/share/tor-browser/distribution/policies.json
    '';
  });
in
{
  options.local.programs.browsers.tor-browser = with lib; {
    enable = mkEnableOption "tor-browser";
    package = mkPackageOption pkgs "tor-browser-bundle-bin" {};
    finalPackage = mkOption {
      type = types.package;
      readOnly = true;
      default = finalTorBrowser;
    };
  };
}