services: add tor.* options

Split `enforceTor` into `tor.proxy` and `tor.enforce`.
By enabling `tor.proxy` without `tor.enforce`, a service can accept
incoming clearnet connections.
E.g., this allows setting up a Tor-proxied bitcoind node that accepts
RPC connections from LAN.

pkgs/lib.nix

@@ -55,13 +55,20 @@ let self = {
     then self.allowLocalIPAddresses
     else self.allowAllIPAddresses;
 
-  enforceTor = mkOption {
-    type = types.bool;
-    default = false;
-    description = ''
-      Whether to force Tor on a service by only allowing connections from and
-      to 127.0.0.1;
-    '';
+  tor = {
+    proxy = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to proxy outgoing connections with Tor.";
+    };
+    enforce = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enforce Tor on a service by only allowing connections
+        from and to localhost and link-local addresses.
+      '';
+    };
   };
 
   script = name: src: pkgs.writers.writeBash name ''