{
  config,
  lib,
  ...
}:
let
  inherit (config.grimmShared)
    enable
    tooling
    network
    ;
  inherit (lib)
    mkIf
    ;

  created = "1970-01-01T00:00:00.0+00:00";
in
{

  config = mkIf (enable && tooling.enable && network) {
    services.opensnitch.rules = {
      tor = mkIf (config.services.tor.enable) {
        name = "tor";
        enabled = true;
        action = "allow";
        duration = "always";
        inherit created;
        operator = {
          type = "simple";
          sensitive = false;
          operand = "process.path";
          data = lib.getExe' config.services.tor.package "tor";
        };
      };
    };
  };
}