diff --git a/modules/security/default.nix b/modules/security/default.nix
index b6aae161..d6b784c6 100644
--- a/modules/security/default.nix
+++ b/modules/security/default.nix
@@ -1 +1 @@
-{ imports = [ ./age.nix ./certs ]; }
+{ imports = [ ./age.nix ./certs ./tor.nix ]; }
diff --git a/modules/security/tor.nix b/modules/security/tor.nix
new file mode 100644
index 00000000..c7481111
--- /dev/null
+++ b/modules/security/tor.nix
@@ -0,0 +1,13 @@
+{ outputs, options, config, lib, pkgs, ... }:
+let cfg = config.modules.security.tor;
+in {
+  options.modules.security.tor = { enable = lib.mkEnableOption false; };
+
+  config = lib.mkIf cfg.enable {
+    services.tor = {
+      enable = true;
+      torsocks.enable = true;
+      client = { enable = true; };
+    };
+  };
+}