anchor.diff:    imports = [
      (mkRemovedOptionModule [ "services" "postfix" "sslCACert" ]
        "services.postfix.sslCACert was replaced by services.postfix.tlsTrustedAuthorities. In case you intend that your server should validate requested client certificates use services.postfix.extraConfig.")
  +
  +   (mkChangedOptionModule [ "services" "postfix" "useDane" ]
  +     [ "services" "postfix" "config" "smtp_tls_security_level" ]
  +     (config: mkIf config.services.postfix.useDane "dane"))
     ];
   }
  
positive.code:       (map (s: "reject_rbl_client " + s) cfg.dnsBlacklists);
  
    clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
  
    smtpTlsSecurityLevel = if cfg.useDane then "dane" else mkDefault "may";
  
    mainCf = let
      escape = replaceStrings ["$"] ["$$"];
  
negative.code:       // optionalAttrs cfg.enableHeaderChecks { header_checks = [ "regexp:/etc/postfix/header_checks" ]; }
        // optionalAttrs (cfg.tlsTrustedAuthorities != "") {
          smtp_tls_CAfile = cfg.tlsTrustedAuthorities;
          smtp_tls_security_level = mkDefault "may";
        }
        // optionalAttrs (cfg.sslCert != "") {
          smtp_tls_cert_file = cfg.sslCert;
          smtp_tls_key_file = cfg.sslKey;
  
          smtp_tls_security_level = mkDefault "may";
  
          smtpd_tls_cert_file = cfg.sslCert;
          smtpd_tls_key_file = cfg.sslKey;
  