modules/nixos: nix wrapperino take 2

The previous nix wrapper wasn't quite "elegantly" crafted. This one attempts to modify arguments in a slightly more durable and extendible manner, and sets `exec` a bit more precisely to ensure proper usage in pretty much all cases. I tried using `nixos-rebuild build --flake .#ref` and it was successful. I also tried `nixos-install --root /random/mount/on/my/live/system --flake .#ref`, and this _also_ worked. These aren't the most durable tests, but it's sufficient for me to know that both are working here, and gives me the confidence to bring it back.

modules/nixos/programs/nix/module.nix

@@ -19,8 +19,7 @@ in {
 
       # Wrap the official nix binary with a snippet to allow
       # rapid repl access to `pkgs.*` and `lib.*` attributes.
-      #nix.package = pkgs.callPackage ./package.nix { nix = pkgs.lix; };
-      nix.package = pkgs.lix;
+      nix.package = pkgs.callPackage ./package.nix { nix = pkgs.lix; };
     }
     {
       # Throttle the nix-daemon so it doesn't consume

modules/nixos/programs/nix/package.nix

@@ -1,42 +1,20 @@
 {
-  lib,
-  runCommandLocal,
-  writeShellScriptBin,
+  callPackage,
+  buildEnv,
 
   nix,
 }:
 let
-  nix-wrapped = writeShellScriptBin "nix" ''
-    declare -a args
-    
-    if [ "$1" = "repl" ]; then
-      # https://wiki.nixos.org/wiki/Flakes#Getting_Instant_System_Flakes_Repl
-      args+=(repl --expr "builtins // { inherit (import <nixpkgs> { config.allowUnfree = true; }) pkgs lib; }")
-      shift 1
-    fi
+  wrapper = callPackage ./wrapper { inherit nix; };
+in buildEnv {
+  inherit (nix) name;
 
-    # https://discourse.nixos.org/t/how-do-nix-legacy-commands-work-when-they-are-just-symbolic-links-to-nix/52797
-    cmd=(
-      "$(basename $0)"
-      "''${args[@]}"
-      "$@"
-    )
-
-    PATH="${nix}/bin:$PATH" exec "''${cmd[@]}"
-  '';
-in runCommandLocal "wrap-nix" {
-  pname = lib.getName nix;
-  version = lib.getVersion nix;
-
-  outputs = nix.outputs;
+  paths = [
+    wrapper
+    nix
+  ];
 
+  ignoreCollisions = true;
+  extraOutputsToInstall = nix.meta.outputsToInstall;
   meta.mainProgram = "nix";
-} ''
-  install -Dm755 -t $out/bin ${lib.getExe nix-wrapped}
-
-  ${lib.concatStringsSep "\n" (map (output: ''
-    mkdir -p ${placeholder output}
-    cp --update=none -rt ${placeholder output} ${nix.${output}}/*
-  ''
-  ) nix.outputs)}
-''
+}

modules/nixos/programs/nix/wrapper/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenvNoCC,
+
+  nix,
+}:
+stdenvNoCC.mkDerivation {
+  inherit (nix) name;
+
+  src = with lib.fileset; toSource {
+    root = ./.;
+    fileset = unions [
+      ./nix.sh
+    ];
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 nix.sh $out/bin/nix
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    substituteInPlace $out/bin/nix \
+      --subst-var-by nix ${lib.getExe nix}
+  '';
+
+  meta = with lib; {
+    description = "Very bare-bones wrapper around the Nix CLI";
+
+    license = licenses.free;
+    maintainers = with maintainers; [ frontear ];
+    platforms = platforms.linux;
+
+    mainProgram = "nix";
+  };
+}

modules/nixos/programs/nix/wrapper/nix.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+origArgs=("$@")
+newArgs=()
+
+for i in "${!origArgs[@]}"; do
+  newArgs+=("${origArgs[$i]}")
+
+  if [ $i -eq 0 ]; then
+    case "${origArgs[0]}" in
+      repl)
+        newArgs+=("--expr" "builtins // { inherit (import <nixpkgs> { config.allowUnfree = true; }) pkgs lib; }")
+        ;;
+    esac
+  fi
+done
+
+# The official Nix binary resolves nix-legacy binary calls through
+# disambiguating $0. This means we must set it directly here in the
+# exec call in order to help it out.
+exec -a "$0" "@nix@" "${newArgs[@]}"