anchor.diff:      };
   
       systemd.services.postgrey = let
  -      bind-flag = if isNull cfg.inetAddr then
  -        "--unix=/var/run/postgrey.sock"
  +      bind-flag = if cfg.socket ? "path" then
  +        ''--unix=${cfg.socket.path} --socketmode=${cfg.socket.mode}''
         else
  -        "--inet=${cfg.inetAddr}:${cfg.inetPort}";
  +        ''--inet=${optionalString (cfg.socket.addr != null) (cfg.socket.addr + ":")}${cfg.socket.port}'';
       in {
         description = "Postfix Greylisting Service";
         wantedBy = [ "multi-user.target" ];
  
positive.code:       '';
        serviceConfig = {
          Type = "simple";
          ExecStart = ''${pkgs.postgrey}/bin/postgrey ${bind-flag} --pidfile=/var/run/postgrey.pid --group=postgrey --user=postgrey --dbdir=/var/postgrey --greylist-text="${cfg.greylistText}"'';
          Restart = "always";
          RestartSec = 5;
          TimeoutSec = 10;
  
negative.code:         default = false;
          description = "Whether to run the Postgrey daemon";
        };
        socket = mkOption {
          type = socket;
          default = { path = "/var/run/postgrey.sock"; };
          example = {
            addr = "127.0.0.1";
            port = 10030;
          };
          description = "Socket to bind to";
        };
        greylistText = mkOption {
          type = string;
          default = "Greylisted for %%s seconds";
          description = "Response status text for greylisted messages; use %%s for seconds left until greylisting is over and %%r for mail domain of recipient";
        };
        greylistAction = mkOption {
          type = string;
          default = "DEFER_IF_PERMIT";
          description = "Response status for greylisted messages (see access(5))";
        };
        greylistHeader = mkOption {
          type = string;
          default = "X-Greylist: delayed %%t seconds by postgrey-%%v at %%h; %%d";
          description = "Prepend header to greylisted mails; use %%t for seconds delayed due to greylisting, %%v for the version of postgrey, %%d for the date, and %%h for the host";
        };
        delay = mkOption {
          type = natural;
          default = 300;
          description = "Greylist for N seconds";
        };
        maxAge = mkOption {
          type = natural;
          default = 35;
          description = "Delete entries from whitelist if they haven't been seen for N days";
        };
        retryWindow = mkOption {
          type = either string natural;
          default = 2;
          example = "12h";
          description = "Allow N days for the first retry. Use string with appended 'h' to specify time in hours";
        };
        lookupBySubnet = mkOption {
          type = bool;
          default = true;
          description = "Strip the last N bits from IP addresses, determined by IPv4CIDR and IPv6CIDR";
        };
        IPv4CIDR = mkOption {
          type = natural;
          default = 24;
        };
        IPv6CIDR = mkOption {
          type = natural;
          default = 64;
        };
        privacy = mkOption {
          type = bool;
          default = true;
          description = "Store data using one-way hash functions (SHA1)";
        };
        autoWhitelist = mkOption {
          type = nullOr natural';
          default = 5;
          description = "Whitelist clients after successful delivery of N messages";
        };
      };
    };
  