anchor.diff:          { assertion = (cfg.maxHeapSize == null) == (cfg.heapNewSize == null);
             message = "If you set either of maxHeapSize or heapNewSize you have to set both";
           }
  -        { assertion = cfg.remoteJmx -> (cfg.jmxRoles != {});
  -          message = "If you want JMX available remotely you need to set a password.";
  +        { assertion = cfg.remoteJmx -> cfg.jmxRolesFile != null;
  +          message = ''
  +            If you want JMX available remotely you need to set a password using
  +            `jmxRoles` or `jmxRolesFile` if using Cassandra older than v3.11.
  +          '';
           }
         ];
       users = mkIf (cfg.user == defaultUser) {
  
positive.code:           };
          };
        });
      };
    };
  
  
negative.code:       default = [];
        description = ''
          Roles that are allowed to access the JMX (e.g. nodetool)
          BEWARE: The passwords will be stored world readable in the nix-store.
  
          Doesn't work in versions older than 3.11 because they don't like that
          it's world readable.
        '';
        type = types.listOf (types.submodule {
          options = {
  