anchor.diff:          type = types.int;
           default = 10002;
           description = "Port for the reverse SRS lookup";
  +      };
  +
  +      timeout = mkOption {
  +        type = types.int;
  +        default = 1800;
  +        description = "Timeout for idle client connections in seconds";
  +      };
  +
  +      excludeDomains = mkOption {
  +        type = types.listOf types.str;
  +        default = [];
  +        description = "Origin domains to exclude from rewriting in addition to primary domain";
         };
   
         user = mkOption {
  
positive.code:       path = [ pkgs.coreutils ];
  
        serviceConfig = {
          ExecStart = ''${pkgs.postsrsd}/sbin/postsrsd "-s${cfg.secretsFile}" "-d${cfg.domain}" -f${toString cfg.forwardPort} -r${toString cfg.reversePort}'';
          User = cfg.user;
          Group = cfg.group;
          PermissionsStartOnly = true;
  
negative.code:         description = "Whether to enable the postsrsd SRS server for Postfix.";
        };
  
        secretsFile = mkOption {
          type = types.path;
          default = "/var/lib/postsrsd/postsrsd.secret";
          description = "Secret keys used for signing and verification";
        };
  
        domain = mkOption {
          type = types.str;
          description = "Domain name for rewrite";
        };
  
        separator = mkOption {
          type = types.enum ["-" "=" "+"];
          default = "=";
          description = "First separator character in generated addresses";
        };
  
        # bindAddress = mkOption { # uncomment once 1.5 is released
        #   type = types.str;
        #   default = "127.0.0.1";
        #   description = "Socket listen address";
        # };
  
        forwardPort = mkOption {
          type = types.int;
  