anchor.diff:          description = "Whether to enable the postsrsd SRS server for Postfix.";
         };
   
  +      secretsFile = mkOption {
  +        type = types.path;
  +        default = "/var/lib/postsrsd/postsrsd.secret";
  +        description = "Secret keys used for signing and verification";
  +      };
  +
         domain = mkOption {
           type = types.str;
           description = "Domain name for rewrite";
         };
   
  -      secretsFile = mkOption {
  -        type = types.path;
  -        default = "/var/lib/postsrsd/postsrsd.secret";
  -        description = "Secret keys used for signing and verification";
  +      separator = mkOption {
  +        type = types.enum ["-" "=" "+"];
  +        default = "=";
  +        description = "First separator character in generated addresses";
         };
  +
  +      # bindAddress = mkOption { # uncomment once 1.5 is released
  +      #   type = types.str;
  +      #   default = "127.0.0.1";
  +      #   description = "Socket listen address";
  +      # };
   
         forwardPort = mkOption {
           type = types.int;
  
positive.code:       path = [ pkgs.coreutils ];
  
        serviceConfig = {
          ExecStart = ''${pkgs.postsrsd}/sbin/postsrsd "-s${cfg.secretsFile}" "-d${cfg.domain}" -f${toString cfg.forwardPort} -r${toString cfg.reversePort}'';
          User = cfg.user;
          Group = cfg.group;
          PermissionsStartOnly = true;
  
negative.code:         type = types.int;
          default = 10002;
          description = "Port for the reverse SRS lookup";
        };
  
        timeout = mkOption {
          type = types.int;
          default = 1800;
          description = "Timeout for idle client connections in seconds";
        };
  
        excludeDomains = mkOption {
          type = types.listOf types.str;
          default = [];
          description = "Origin domains to exclude from rewriting in addition to primary domain";
        };
  
        user = mkOption {
  