anchor.diff:        };
         password = mkOption {
           type = types.str;
  -        description = "Password for the postgresql connection";
  +        description = "Password for the postgresql connection. Do not use: the password will be stored world readable in the store; use <literal>passwordFile</literal> instead.";
  +        default = "";
  +      };
  +      passwordFile = mkOption {
  +        type = types.str;
  +        description = "Password file for the postgresql connection. Must be readable by user <literal>nginx</literal>. Ignored if <literal>database.host</literal> is set to <literal>localhost</literal>, as peer authentication will be used.";
         };
         dbname = mkOption {
           type = types.str;
  
positive.code:     };
      systemd.services.phpfpm-roundcube.after = [ "roundcube-setup.service" ];
  
      systemd.services.roundcube-setup = let
        pgSuperUser = config.services.postgresql.superUser;
      in mkMerge [
        (mkIf (cfg.database.host == "localhost") {
          requires = [ "postgresql.service" ];
          after = [ "postgresql.service" ];
  
negative.code: let
    cfg = config.services.roundcube;
    fpm = config.services.phpfpm.pools.roundcube;
    localDB = cfg.database.host == "localhost";
    user = cfg.database.username;
  in
  {
    options.services.roundcube = {
  