anchor.diff:  
         serviceConfig = {
           ExecStart = "${pkgs.rmilter}/bin/rmilter ${optionalString cfg.debug "-d"} -n -c ${rmilterConfigFile}";
  +        ExecReload = "/bin/kill -USR1 $MAINPID";
           User = cfg.user;
           Group = cfg.group;
           PermissionsStartOnly = true;
           Restart = "always";
  -      };
  -
  -      preStart = ''
  -        ${pkgs.coreutils}/bin/mkdir -p /run/rmilter
  -        ${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} /run/rmilter
  -      '';
  -
  +        RuntimeDirectory = "rmilter";
  +        RuntimeDirectoryPermissions="0755";
  +      };
  +
  +    };
  +
  +    systemd.sockets.rmilter = mkIf cfg.socketActivation {
  +      description = "Rmilter service socket";
  +      wantedBy = [ "sockets.target" ];
  +      socketConfig = {
  +          ListenStream = cfg.bindUnixSockets ++ cfg.bindInetSockets;
  +          SocketUser = cfg.user;
  +          SocketGroup = config.ids.gids.adm;
  +          SocketMode = "0660";
  +      };
       };
   
       services.postfix.extraConfig = optionalString cfg.postfix.enable cfg.postfix.configFragment;
  
positive.code: 
          servers = mkOption {
            type = types.listOf types.str;
            default = ["r:0.0.0.0:11333"];
            description = ''
              Spamd socket definitions.
              Is server name is prefixed with r: it is rspamd server.
  
negative.code:   rspamdCfg = config.services.rspamd;
    cfg = config.services.rmilter;
  
    inetSockets = map (sock: let s = stringSplit ":" sock; in "inet:${last s}:${head s}") cfg.bindInetSockets;
    unixSockets = map (sock: "unix:${sock}") cfg.bindUnixSockets;
  
    allSockets = unixSockets ++ inetSockets;
  
    rmilterConf = ''
  pidfile = /run/rmilter/rmilter.pid;
  bind_socket = ${if cfg.socketActivation then "fd:3" else concatStringsSep ", " allSockets};
  tempdir = /tmp;
  
    '' + (with cfg.rspamd; if enable then ''
  