services: add tor.* options

Split `enforceTor` into `tor.proxy` and `tor.enforce`.
By enabling `tor.proxy` without `tor.enforce`, a service can accept
incoming clearnet connections.
E.g., this allows setting up a Tor-proxied bitcoind node that accepts
RPC connections from LAN.

modules/joinmarket-ob-watcher.nix

@@ -29,11 +29,9 @@ let
       default = cfg.user;
       description = "The group as which to run JoinMarket.";
     };
-    # This option is only used by netns-isolation
-    enforceTor = mkOption {
-      readOnly = true;
-      default = true;
-    };
+    # This option is only used by netns-isolation.
+    # Tor is always enabled.
+    tor.enforce = nbLib.tor.enforce;
   };
 
   cfg = config.services.joinmarket-ob-watcher;
@@ -100,7 +98,7 @@ in {
         SystemCallFilter = nbLib.defaultHardening.SystemCallFilter ++ [ "mbind" ] ;
         Restart = "on-failure";
         RestartSec = "10s";
-      } // nbLib.allowTor;
+      } // nbLib.allowedIPAddresses cfg.tor.enforce;
     };
 
     users.users.${cfg.user} = {