relaying mail to multiple smarthosts with opensmtpd

I like to use a local smtp daemon for sending email from my laptop, because that way i can send emails even while disconnected and, even when the network is up, because i don't have to wait for the network protocol to be completed with a remote smarthost. Oh, and i also need local mail delivery.

For many years i've used postfix to those ends; it has an acceptably simply-ish configuration; but recently i've become fond of VPNs (mullvad, if you want to know), and was annoyed by its getting confused when /etc/resolv.conf changes (for instance, because you get the VPN up after postfix's service has started). I've found a pleasantly simple alternative: OpenSMTPD.

Say i want to use the SMTP server fencepost.gnu.org when sending an email as jao@gnu.org and smtp.jao.io when writing with mail@jao.io or news@xmobar.org in my From header. OpenSMTPD let's you do that with a very simple configuration file in /etc/smtpd.conf¹:

table aliases file:/etc/aliases
table secrets db:/etc/mail/secrets.db

table sendergnu { jao@gnu.org }
table senderjao { mail@jao.io, news@xmobar.org }

listen on localhost

action "local" mbox alias <aliases>
action "relaygnu" relay host smtp+tls://gnu@fencepost.gnu.org:587 auth <secrets>
action "relayjao" relay host smtps://jao@smtp.jao.io:465 auth <secrets>

match for local action "local"
match for any from mail-from <sendergnu> action "relaygnu"
match for any from mail-from <senderjao> action "relaygan"

where we have also configured local delivery for a good measure. That's the full configuration file! The only other thing needed is generating the secrets.db file with the users and passwords corresponding to the keys gnu and jao (those are just arbitrary names). To that end, we create a plain text file with them, using entries of the form <key> <user>:<password>:

gnu  jao:my fencepost password
jao  mail@jao.io:xxxxxxxxxxxxxxxxx

where my user for fencepost.gnu.org is jao and for smtp.jao.io is mail@jao.io (you see there's no need of escaping spaces or ats). Then we use the program makemap to create the secrets db:

makemap secrets && rm secrets