anchor.diff:            The path to MPD's database. If set to <literal>null</literal> the
             parameter is omitted from the configuration.
           '';
  +      };
  +
  +      credentials = mkOption {
  +        type = types.listOf (types.submodule {
  +          options = {
  +            passwordFile = mkOption {
  +              type = types.path;
  +              description = ''
  +                Path to file containing the password.
  +              '';
  +            };
  +            permissions = let
  +              perms = ["read" "add" "control" "admin"];
  +            in mkOption {
  +              type = types.listOf (types.enum perms);
  +              default = [ "read" ];
  +              description = ''
  +                List of permissions that are granted with this password.
  +                Permissions can be "${concatStringsSep "\", \"" perms}".
  +              '';
  +            };
  +          };
  +        });
  +        description = ''
  +          Credentials and permissions for accessing the mpd server.
  +        '';
  +        default = [];
  +        example = [
  +          {passwordFile = "/var/lib/secrets/mpd_readonly_password"; permissions = [ "read" ];}
  +          {passwordFile = "/var/lib/secrets/mpd_admin_password"; permissions = ["read" "add" "control" "admin"];}
  +        ];
         };
   
         credentialsFile = mkOption {
  
positive.code:       serviceConfig = mkMerge [
          {
            User = "${cfg.user}";
            ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /etc/mpd.conf";
            ExecStartPre = pkgs.writeScript "mpd-start-pre" ''
              #!${pkgs.runtimeShell}
              set -euo pipefail
              cat ${mpdConf} ${cfg.credentialsFile} > /etc/mpd.conf
            '';
            Type = "notify";
            LimitRTPRIO = 50;
            LimitRTTIME = "infinity";
  
negative.code:   uid = config.ids.uids.mpd;
    gid = config.ids.gids.mpd;
    cfg = config.services.mpd;
  
    credentialsPlaceholder = (creds:
      let
        placeholders = (imap0
          (i: c: ''password "{{password-${toString i}}}@${concatStringsSep "," c.permissions}"'')
          creds);
      in
        concatStringsSep "\n" placeholders);
  
    mpdConf = pkgs.writeText "mpd.conf" ''
      # This file was automatically generated by NixOS. Edit mpd's configuration
  