anchor.diff:      services.mail.sendmailSetuidWrapper = mkIf config.services.postfix.setSendmail {
         program = "sendmail";
         source = "${pkgs.postfix}/bin/sendmail";
  -      owner = "nobody";
         group = setgidGroup;
         setuid = false;
         setgid = true;
  
positive.code:   group = cfg.group;
    setgidGroup = cfg.setgidGroup;
  
    mainCf =
      ''
        compatibility_level = 2
  
        queue_directory = /var/postfix/queue
        command_directory = ${pkgs.postfix}/sbin
        daemon_directory = ${pkgs.postfix}/libexec/postfix
  
        mail_owner = ${user}
        default_privs = nobody
  
negative.code:     + optionalString (cfg.recipientDelimiter != "") ''
        recipient_delimiter = ${cfg.recipientDelimiter}
      ''
      + optionalString haveAliases ''
        alias_maps = hash:/etc/postfix/aliases
      ''
      + optionalString haveTransport ''
        transport_maps = hash:/etc/postfix/transport
      ''
      + optionalString haveVirtual ''
        virtual_alias_maps = hash:/etc/postfix/virtual
      ''
      + cfg.extraConfig;
  
  