staging/cassandra: Fix paxos-repair service execStart

Related to swh/infra/sysadm-environment#5389

site-modules/profile/manifests/cassandra/instance.pp

@@ -18,6 +18,7 @@ define profile::cassandra::instance (
   $cassandra_config_dir = lookup('cassandra::base_config_directory')
   $cassandra_log_dir = lookup('cassandra::base_log_directory')
   $cassandra_user = lookup('cassandra::jmx::user')
+  $cassandra_password = lookup('cassandra::jmx::password')
 
   $base_data_dir = "${instance_base_data_dir}/data"
   $commitlog_dir = "${instance_base_data_dir}/commitlog"
@@ -141,6 +142,7 @@ define profile::cassandra::instance (
       service_unit    => 'paxos-repair.service',
       active          => true,
       enable          => true,
+      mode            => '0440',
     }
   }
 }

site-modules/profile/templates/cassandra/paxos-repair.service.erb

@@ -10,7 +10,7 @@ After=<%= @service_name %>
 User=<%= @cassandra_user %>
 Group=<%= @cassandra_user %>
 Type=simple
-ExecStart=/opt/cassandra/bin/nodetool -u $(awk '{print $1}' /etc/cassandra/jmxremote.password) -pw $(awk '{print $2}' /etc/cassandra/jmxremote.password) repair --paxos-only
+ExecStart=/opt/cassandra/bin/nodetool -u <%= @cassandra_user %> -pw <%= @cassandra_password %> repair --paxos-only
 
 [Install]
 WantedBy=multi-user.target