anchor.diff:        };
   
         rootpw = mkOption {
  -        type = types.str;
  +        type = types.nullOr types.str;
  +        default = null;
           description = ''
             Password for the root user.
             This setting will be ignored if configDir is set.
  +          Using this option will store the root password in plain text in the
  +          world-readable nix store. To avoid this the <literal>rootpwFile</literal> can be used.
  +        '';
  +      };
  +
  +      rootpwFile = mkOption {
  +        type = types.nullOr types.str;
  +        default = null;
  +        description = ''
  +          Password file for the root user.
  +          The file should contain the string <literal>rootpw</literal> followed by the password.
  +          e.g.: <literal>rootpw mysecurepassword</literal>
           '';
         };
   
  
positive.code:     database ${cfg.database}
      suffix ${cfg.suffix}
      rootdn ${cfg.rootdn}
      rootpw ${cfg.rootpw}
      directory ${cfg.dataDir}
      ${cfg.extraDatabaseConfig}
    '');
  
negative.code:             include ${pkgs.openldap.out}/etc/schema/inetorgperson.schema
              include ${pkgs.openldap.out}/etc/schema/nis.schema
  
              database bdb
              suffix dc=example,dc=org
              rootdn cn=admin,dc=example,dc=org
              # NOTE: change after first start
              rootpw secret
              directory /var/db/openldap
  