Now using pkgs.writeText

this places header cleanup rules into /store out of /etc and avoids the name clash.

mail-server/postfix.nix

@@ -48,6 +48,17 @@ let
   # address though
   vaccounts_file = builtins.toFile "vaccounts" (lib.concatStringsSep "\n" (vaccounts_identity ++ valiases_postfix));
   
+  submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
+     ### Removes sensitive headers from mails handed in via the submission port.
+     ### See https://thomas-leister.de/mailserver-debian-stretch/
+     ### Uses "pcre" style regex.
+
+     /^Received:/            IGNORE
+     /^X-Originating-IP:/    IGNORE
+     /^X-Mailer:/            IGNORE
+     /^User-Agent:/          IGNORE
+     /^X-Enigmail:/          IGNORE
+  '';
 in
 {
   config = with cfg; lib.mkIf enable {
@@ -102,22 +113,8 @@ in
 
       extraMasterConf = ''
         submission-header-cleanup unix n - n    -       0       cleanup
-            -o header_checks=regexp:/etc/postfixsupport/submission_header_cleanup
+            -o header_checks=pcre:${submissionHeaderCleanupRules}
       '';
     };
-    
-    environment.etc = {
-      "postfixsupport/submission_header_cleanup" = {
-        text = ''
-          ### Removes sensitive headers from mails handed in via the submission port.
-          ### Thanks to https://thomas-leister.de/mailserver-debian-stretch/
-
-          /^Received:/            IGNORE
-          /^X-Originating-IP:/    IGNORE
-          /^X-Mailer:/            IGNORE
-          /^User-Agent:/          IGNORE
-        '';
-      };
-    };
   };
 }