anchor.diff:            The path to MPD's database. If set to <literal>null</literal> the
             parameter is omitted from the configuration.
           '';
  +      };
  +
  +      credentials = mkOption {
  +        type = types.listOf (types.submodule {
  +          options = {
  +            passwordFile = mkOption {
  +              type = types.path;
  +              description = ''
  +                Path to file containing the password.
  +              '';
  +            };
  +            permissions = let
  +              perms = ["read" "add" "control" "admin"];
  +            in mkOption {
  +              type = types.listOf (types.enum perms);
  +              default = [ "read" ];
  +              description = ''
  +                List of permissions that are granted with this password.
  +                Permissions can be "${concatStringsSep "\", \"" perms}".
  +              '';
  +            };
  +          };
  +        });
  +        description = ''
  +          Credentials and permissions for accessing the mpd server.
  +        '';
  +        default = [];
  +        example = [
  +          {passwordFile = "/var/lib/secrets/mpd_readonly_password"; permissions = [ "read" ];}
  +          {passwordFile = "/var/lib/secrets/mpd_admin_password"; permissions = ["read" "add" "control" "admin"];}
  +        ];
         };
   
         credentialsFile = mkOption {
  
positive.code:               soundfont "${pkgs.soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2"
        }
      ''}
  
      ${cfg.extraConfig}
    '';
  
negative.code:         })
        ];
      };
  
      users.users = optionalAttrs (cfg.user == name) {
        ${name} = {
  