anchor.diff:  
   
           # handle database.passwordFile & permissions
  -        DBPASS=$(head -n1 ${cfg.database.passwordFile})
  +        DBPASS=${optionalString (cfg.database.passwordFile != null) "$(head -n1 ${cfg.database.passwordFile})"}
           cp -f ${databaseYml} "${cfg.stateDir}/config/database.yml"
           sed -e "s,#dbpass#,$DBPASS,g" -i "${cfg.stateDir}/config/database.yml"
           chmod 440 "${cfg.stateDir}/config/database.yml"
  
positive.code:           description = "Database user.";
          };
  
          password = mkOption {
            type = types.str;
            default = "";
            description = ''
              The password corresponding to <option>database.user</option>.
              Warning: this is stored in cleartext in the Nix store!
              Use <option>database.passwordFile</option> instead.
            '';
          };
  
          passwordFile = mkOption {
            type = types.nullOr types.path;
            default = null;
  
negative.code:   config = mkIf cfg.enable {
  
      assertions = [
        { assertion = cfg.database.passwordFile != null || cfg.database.socket != null;
          message = "one of services.redmine.database.socket or services.redmine.database.passwordFile must be set";
        }
        { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
          message = "services.redmine.database.user must be set to ${cfg.user} if services.redmine.database.createLocally is set true";
  