anchor.diff:        default = [];
         description = ''
           Roles that are allowed to access the JMX (e.g. nodetool)
  +        BEWARE: The passwords will be stored world readable in the nix-store.
  +
  +        Doesn't work in versions older than 3.11 because they don't like that
  +        it's world readable.
         '';
         type = types.listOf (types.submodule {
           options = {
  
positive.code:        data_file_directories = [ "${cfg.homeDir}/data" ];
         commitlog_directory = "${cfg.homeDir}/commitlog";
         saved_caches_directory = "${cfg.homeDir}/saved_caches";
       } // (if builtins.compareVersions cfg.package.version "3" >= 0
               then { hints_directory = "${cfg.homeDir}/hints"; }
               else {})
      );
  
negative.code:         sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
        '';
      };
    defaultJmxRolesFile = builtins.foldl'
       (left: right: left + right) ""
       (map (role: "${role.username} ${role.password}") cfg.jmxRoles);
    fullJvmOptions = cfg.jvmOpts
      ++ lib.optionals (cfg.jmxRoles != []) [
        "-Dcom.sun.management.jmxremote.authenticate=true"
        "-Dcom.sun.management.jmxremote.password.file=${cfg.jmxRolesFile}"
      ]
      ++ lib.optionals cfg.remoteJmx [
        "-Djava.rmi.server.hostname=${cfg.rpcAddress}"
  