anchor.diff:            };
           };
         });
  +    };
  +    jmxRolesFile = mkOption {
  +      type = types.nullOr types.path;
  +      default = if (lib.versionAtLeast cfg.package.version "3.11")
  +                then pkgs.writeText "jmx-roles-file" defaultJmxRolesFile
  +                else null;
  +      example = "/var/lib/cassandra/jmx.password";
  +      description = ''
  +        Specify your own jmx roles file.
  +
  +        Make sure the permissions forbid "others" from reading the file if
  +        you're using Cassandra below version 3.11.
  +      '';
       };
     };
   
  
positive.code:         sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
        '';
      };
    jmxPasswordFile = builtins.foldl'
       (left: right: left + right) ""
       (map (role: "${role.username} ${role.password}") cfg.jmxRoles);
    fullJvmOptions = cfg.jvmOpts
      ++ lib.optionals (cfg.jmxRoles != []) [
        "-Dcom.sun.management.jmxremote.authenticate=true"
        "-Dcom.sun.management.jmxremote.password.file=${pkgs.writeText "jmxremote.password" jmxPasswordFile}"
      ]
      ++ lib.optionals cfg.remoteJmx [
        "-Djava.rmi.server.hostname=${cfg.rpcAddress}"
  
negative.code:       default = [];
        description = ''
          Roles that are allowed to access the JMX (e.g. nodetool)
          BEWARE: The passwords will be stored world readable in the nix-store.
  
          Doesn't work in versions older than 3.11 because they don't like that
          it's world readable.
        '';
        type = types.listOf (types.submodule {
          options = {
  