dream2nix/v1/nix/modules/flake-parts/writers.nix

{
  perSystem = {
    config,
    lib,
    pkgs,
    ...
  }: {
    options.writers = {
      writePureShellScript = lib.mkOption {
        type = lib.types.functionTo lib.types.anything;
      };
      writePureShellScriptBin = lib.mkOption {
        type = lib.types.functionTo lib.types.anything;
      };
    };

    /*
    create a script that runs in a `pure` environment, in the sense that:
      - PATH only contains exactly the packages passed via the PATH arg
      - NIX_PATH is set to the path of the current `pkgs`
      - TMPDIR is set up and cleaned up even if the script fails
      - all environment variables are unset, except:
        - the ones listed in `keepVars` below
        - ones listed via the KEEP_VARS variable
      - the behavior is similar to `nix-shell --pure`
    */
    config.writers = let
      mkScript = PATH: script: ''
        #!${pkgs.bash}/bin/bash
        set -Eeuo pipefail
        export PATH="${lib.makeBinPath PATH}"
        export NIX_PATH=nixpkgs=${pkgs.path}
        TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
        trap '${pkgs.coreutils}/bin/chmod -R +w $TMPDIR;  ${pkgs.coreutils}/bin/rm -rf "$TMPDIR"' EXIT
        if [ -z "''${IMPURE:-}" ]; then
          ${cleanEnv}
        fi
        ${script}
      '';

      # list taken from nix source: src/nix-build/nix-build.cc
      keepVars = lib.concatStringsSep " " [
        "HOME"
        "XDG_RUNTIME_DIR"
        "USER"
        "LOGNAME"
        "DISPLAY"
        "WAYLAND_DISPLAY"
        "WAYLAND_SOCKET"
        "PATH"
        "TERM"
        "IN_NIX_SHELL"
        "NIX_SHELL_PRESERVE_PROMPT"
        "TZ"
        "PAGER"
        "NIX_BUILD_SHELL"
        "SHLVL"
        "http_proxy"
        "https_proxy"
        "ftp_proxy"
        "all_proxy"
        "no_proxy"

        # We want to keep our own variables as well
        "IMPURE"
        "KEEP_VARS"
        "NIX_PATH"
      ];

      cleanEnv = ''
        KEEP_VARS="''${KEEP_VARS:-}"
        unsetVars=$(
          PATH=${pkgs.coreutils}/bin:${pkgs.findutils}/bin \
            comm \
              <(env | cut -d = -f 1 | sort) \
              <(echo "${keepVars} $KEEP_VARS" | tr " " "\n" | sort) \
              -2 \
              -3
        )
        echo -e "unsetting ENV variables:\n$(echo $unsetVars | tr "\n" " ")"
        unset $unsetVars
      '';
    in {
      writePureShellScript = PATH: script:
        pkgs.writeScript "script.sh" (mkScript PATH script);

      writePureShellScriptBin = binName: PATH: script:
        pkgs.writeScriptBin binName (mkScript PATH script);
    };
  };
}