Ahh, just spotted something else: tor's ExitPolicy entry has a couple extra plus signs in it, causing them to be in the output...
reject *:6699 reject *:6881-6999 accept *:* + + If you want to use a reduced exit policy rather than the default exit policy, set "ReducedExitPolicy 1". If you want to _replace_ the default
Sorry -- could you update (rebase?) this branch for the latest master? The ClientDNSRejectInternalAddresses option got un-deprecated with #21031 (moved), and now there's a merge conflict.
Also, a patch to fix the plus-sign issue would be welcome too.
Struggled with asciidoc for an hour but couldn't figure out how to make a properly indented paragraph appear after the exit policy example so just restructured it to come before.