anchor.diff:        serviceConfig = mkMerge [
           {
             User = "${cfg.user}";
  -          ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /etc/mpd.conf";
  -          ExecStartPre = pkgs.writeScript "mpd-start-pre" ''
  -            #!${pkgs.runtimeShell}
  -            set -euo pipefail
  -            cat ${mpdConf} ${cfg.credentialsFile} > /etc/mpd.conf
  +          ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /run/mpd/mpd.conf";
  +          ExecStartPre = pkgs.writeShellScript "mpd-start-pre" ''
  +            set -xeuo pipefail
  +            umask 077
  +            cat ${mpdConf} ${cfg.credentialsFile} > /run/mpd/mpd.conf
  +            ${pkgs.replace}/bin/replace-literal -fe ${
  +              concatStringsSep " -a " (imap0 (i: c: "\"{{password-${toString i}}}\" \"$(cat ${c.passwordFile})\"") cfg.credentials)
  +            } /run/mpd/mpd.conf
             '';
  +          RuntimeDirectory = "mpd";
             Type = "notify";
             LimitRTPRIO = 50;
             LimitRTTIME = "infinity";
  
positive.code:   uid = config.ids.uids.mpd;
    gid = config.ids.gids.mpd;
    cfg = config.services.mpd;
  
    mpdConf = pkgs.writeText "mpd.conf" ''
      # This file was automatically generated by NixOS. Edit mpd's configuration
  
negative.code:           The path to MPD's database. If set to <literal>null</literal> the
            parameter is omitted from the configuration.
          '';
        };
  
        credentials = mkOption {
          type = types.listOf (types.submodule {
            options = {
              passwordFile = mkOption {
                type = types.path;
                description = ''
                  Path to file containing the password.
                '';
              };
              permissions = let
                perms = ["read" "add" "control" "admin"];
              in mkOption {
                type = types.listOf (types.enum perms);
                default = [ "read" ];
                description = ''
                  List of permissions that are granted with this password.
                  Permissions can be "${concatStringsSep "\", \"" perms}".
                '';
              };
            };
          });
          description = ''
            Credentials and permissions for accessing the mpd server.
          '';
          default = [];
          example = [
            {passwordFile = "/var/lib/secrets/mpd_readonly_password"; permissions = [ "read" ];}
            {passwordFile = "/var/lib/secrets/mpd_admin_password"; permissions = ["read" "add" "control" "admin"];}
          ];
        };
  
        credentialsFile = mkOption {
  