{ config, lib, pkgs, ... }:
let cfg = config.nix;
    inherit (lib) types;
    /* Alternative which does not need to re-export envvars when called via sudo.
       But this is maybe more clear to just (re-)export envvars.
    nix = pkgs.writeShellScriptBin "nix" ''
      NIX_CONF_DIR=${cfg.nixConf} \
      NIX_SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" \
      SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" \
      ${pkgs.nix}/bin/nix "$@"
    '';
    */
in
{
  options.nix = {
    enable = lib.mkEnableOption "nix";
    nixConf = lib.mkOption {
      type = types.lines;
      apply = s: pkgs.writeText "nix.conf" s;
      default = ''
        auto-optimise-store = true
      '';
      description = ''
        Nix's nix.conf content.
      '';
    };
  };
  config = lib.mkIf cfg.enable {
    #shell.buildInputs = [ nix ];
    nix-shell.shellHook = ''
      # nix
      export NIX_CONF_DIR=${cfg.nixConf}
      export NIX_SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
      export SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
    '';
  };
}