@bjornfor, thanks for your PR! By analyzing the history of the files in this pull request, we identified @edolstra, @abbradar and @peti to be potential reviewers.

CC @jerith666

I'm not sure I represent an "advanced user" or a user familiar with the upstream config language :) ... but since you asked ...

In my opinion, it's clearer, cleaner, and more self-documenting, while not that big of a departure from the raw upstream syntax, to use an attrset. Here are the two changes I had to make to my configuration.nix in reaction to #27276:

-  extraMasterConf = ''
-    autoreply unix  -       n       n       -       -       pipe flags= user=nobody argv=${speakeasy-autoreply} ''${sender}
-    alumnireply unix  -       n       n       -       -       pipe flags= user=nobody argv=${alumni-autoreply} ''${sender}
-  '';
+  masterConfig = {
+    autoreply = {
+      privileged = true;
+      command = "pipe flags= user=nobody argv=${speakeasy-autoreply} \${sender}";
+    };
+    alumnireply = {
+      privileged = true;
+      command = "pipe flags= user=nobody argv=${alumni-autoreply} \${sender}";
+    };
+  };

This is much clearer: the old way had a bunch of -s and ys and ns whose meaning was totally unclear. In order to come up with the new version, I had to go read the postfix documentation to figure out what those two ns were about, learn that the defaults changed in postfix 3.0, etc. etc.

The new way very simply and explicitly says privileged = true and command = ... -- I won't ever have to remind myself what those mean in the future.

-  extraConfig = ''
+  config = {
     # enable TLS when available, for delivering outbound (forwarded) messages
     # dane: use DNS records to authenticate servers when available
-    smtp_tls_security_level = dane
-    smtp_dns_support_level = dnssec
+    smtp_tls_security_level = "dane";
+    smtp_dns_support_level = "dnssec";
     # allow messages larger (~40 MB) than default (~10 MB)
-    message_size_limit = 40960000
+    message_size_limit = "40960000";
     # per amavisd docs, to ensure we can send bounces
-    strict_rfc821_envelopes = yes
-  '';
+    strict_rfc821_envelopes = "yes";
+  };

This one is pretty much a wash -- a straightforward transformation of the upstream config language. Even if it doesn't provide any "benefit", anyone who's deep enough into nix to be doing this will be totally comfortable with this kind of trivial translation, I expect.