simple nixos wrapper module

nix/module.nix

@@ -0,0 +1,89 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (lib) mkOption mkPackageOption types;
+  strNotEmpty = s: lib.stringLength s != 0;
+  wrapperType = lib.types.submodule {
+    options = {
+      package = mkPackageOption "wrapped" { } {
+        nullable = false;
+      };
+      executable = mkOption {
+        type = types.str;
+        default = "";
+      };
+      args = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+      };
+      env = mkOption {
+        type = types.attrsOf (types.listOf types.str);
+        default = { };
+      };
+      retainEnv = mkOption {
+        type = types.bool;
+        default = false;
+      };
+      addPwd = mkOption {
+        type = types.bool;
+        default = false;
+      };
+    };
+  };
+in
+{
+  options = {
+    wrappers = mkOption {
+      type = types.attrsOf wrapperType;
+    };
+    wrapperPkg = mkPackageOption "wrapper" { } { nullable = false; };
+  };
+  config =
+    let
+      wrap =
+        name: opts:
+        let
+          envs = lib.concatStringsSep " " (
+            lib.mapAttrsToList (n: v: "${n}=${lib.concatStringsSep ":" v}") opts.env
+          );
+          sandboxArgs = pkgs.stdenvNoCC.mkDerivation {
+            name = "${name}-opts";
+            __structuredAttrs = true;
+            exportReferencesGraph.closure = [ opts.package ];
+            preferLocalBuild = true;
+            nativeBuildInputs = [
+              pkgs.coreutils
+              pkgs.jq
+            ];
+            buildCommand = ''
+              echo -n "--fs rx=" > $out
+              jq -r '.closure[].path' < "$NIX_ATTRS_JSON_FILE" \
+                | tr '\n' ':' | sed 's/:$//' >> $out
+              ${if (strNotEmpty envs) then "echo -n ' --env ${envs}' >> $out" else ""}
+            '';
+          };
+          command = lib.getExe' opts.package (
+            if (strNotEmpty opts.executable) then opts.executable else opts.package.pname
+          );
+          wrappedArgs = lib.concatStringsSep " " opts.args;
+          script = ''
+            #! /usr/bin/env bash
+            ${lib.getExe' config.wrapperPkg "yoke"} \
+              ${if opts.addPwd then "--fs rwx=$PWD" else ""} \
+              ${if opts.retainEnv then "--retain-env" else ""} \
+              --fd-args -- \
+              ${command} \
+              ${wrappedArgs} $@ \
+              3< ${sandboxArgs}
+          '';
+        in
+        pkgs.writeScriptBin "${name}" script;
+    in
+    {
+      environment.systemPackages = lib.mapAttrsToList wrap config.wrappers;
+    };
+}