anchor.diff:      database ${cfg.database}
       suffix ${cfg.suffix}
       rootdn ${cfg.rootdn}
  -    rootpw ${cfg.rootpw}
  +    ${if (cfg.rootpw != null) then ''
  +      rootpw ${cfg.rootpw}
  +    '' else ''
  +      include ${cfg.rootpwFile}
  +    ''}
       directory ${cfg.dataDir}
       ${cfg.extraDatabaseConfig}
     '');
  
positive.code:             include ${pkgs.openldap.out}/etc/schema/inetorgperson.schema
              include ${pkgs.openldap.out}/etc/schema/nis.schema
  
              database bdb 
              suffix dc=example,dc=org 
              rootdn cn=admin,dc=example,dc=org 
              # NOTE: change after first start
              rootpw secret
              directory /var/db/openldap
  
negative.code:       };
  
        rootpw = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = ''
            Password for the root user.
            This setting will be ignored if configDir is set.
            Using this option will store the root password in plain text in the
            world-readable nix store. To avoid this the <literal>rootpwFile</literal> can be used.
          '';
        };
  
        rootpwFile = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = ''
            Password file for the root user.
            The file should contain the string <literal>rootpw</literal> followed by the password.
            e.g.: <literal>rootpw mysecurepassword</literal>
          '';
        };
  
  