anchor.diff:                '';
               };
   
  +            passwordFile = mkOption {
  +              type = with types; uniq (nullOr str);
  +              example = "/path/to/file";
  +              default = null;
  +              description = ''
  +                Specifies the path to a file containing the
  +                clear text password for the MQTT user.
  +              '';
  +            };
  +
               hashedPassword = mkOption {
                 type = with types; uniq (nullOr str);
                 default = null;
                 description = ''
                   Specifies the hashed password for the MQTT User.
  -                <option>hashedPassword</option> overrides <option>password</option>.
  +                To generate hashed password install <literal>mosquitto</literal>
  +                package and use <literal>mosquitto_passwd</literal>.
  +              '';
  +            };
  +
  +            hashedPasswordFile = mkOption {
  +              type = with types; uniq (nullOr str);
  +              example = "/path/to/file";
  +              default = null;
  +              description = ''
  +                Specifies the path to a file containing the
  +                hashed password for the MQTT user.
                   To generate hashed password install <literal>mosquitto</literal>
                   package and use <literal>mosquitto_passwd</literal>.
                 '';
  
positive.code:   ###### Implementation
  
    config = mkIf cfg.enable {
  
      systemd.services.mosquitto = {
        description = "Mosquitto MQTT Broker Daemon";
  
negative.code:         touch ${cfg.dataDir}/passwd
        '' + concatStringsSep "\n" (
          mapAttrsToList (n: c:
            if c.hashedPasswordFile != null then
              "echo '${n}:'$(cat '${c.hashedPasswordFile}') >> ${cfg.dataDir}/passwd"
            else if c.passwordFile != null then
              "${pkgs.mosquitto}/bin/mosquitto_passwd -b ${cfg.dataDir}/passwd ${n} $(cat '${c.passwordFile}')"
            else if c.hashedPassword != null then
              "echo '${n}:${c.hashedPassword}' >> ${cfg.dataDir}/passwd"
            else optionalString (c.password != null)
              "${pkgs.mosquitto}/bin/mosquitto_passwd -b ${cfg.dataDir}/passwd ${n} '${c.password}'"
  