foo.nix

  users.extraUsers.grahamc = rec {
    # ...
    symlinks = {
      ".mbsyncrc" = pkgs.email.mbsyncrc;
      ".msmtprc" = pkgs.email.msmtprc;
      ".notmuch-config" = pkgs.email.notmuch-config;
      ".gitconfig" = pkgs.gitconfig;
      ".gnupg/gpg.conf" = pkgs.gnupgconfig.gpgconf;
      ".gnupg/scdaemon.conf" = pkgs.gnupgconfig.scdaemonconf;
      ".mail/grahamc/.notmuch/hooks/pre-new" = pkgs.email.pre-new;
      ".mail/grahamc/.notmuch/hooks/post-new" = pkgs.email.post-new;
    } // (if (builtins.pathExists "${home}/projects/nixpkgs") then {
      "projects/nixpkgs/.git/hooks/pre-push" = pkgs.nixpkgs-pre-push;
    } else {});
  };

module.nix

{ config, lib, pkgs, ... }:

with lib;

let
usersWithKeys = attrValues (flip filterAttrs config.users.users (n: u:
    u.symlinks != {}
));

activationScriptForUser = user: flip mapAttrsToList user.symlinks (reltarget: src:
  "update_symlink \"${src}\" \"${user.home}/${reltarget}\""
);

activationScript = ''
    ${builtins.readFile ./update-symlinks.sh}
    ${concatStringsSep "\n" (flatten (map activationScriptForUser usersWithKeys))}
'';

in {
  ###### interface

  options = {

    users.users = mkOption {
      options = [{
        symlinks = mkOption {
          default = {};
          description = ''
            An attrset of relative paths and targets to symlink in to
            the user's HOME.
          '';
        };
      }];
    };
  };

  ###### implementation

  config = ({
    system.activationScripts.usersymlinks = activationScript;
  });
}

update-symlinks.sh

scratch=$(mktemp -d -t tmp.XXXXXXXXXX)
update_symlink() {
    local SRC
    local DEST
    local OUTDIR

    SRC="$1"
    DEST="$2"
    OUTDIR=$(dirname "$DEST");
    if [ ! -d "$OUTDIR" ]; then
        if [ ! -z "${SUDO:-}" ]; then
            sudo mkdir -p "$OUTDIR"
        else
            mkdir -p "$OUTDIR"
        fi
    fi

    if [ ! -h "$DEST" ] && [ -d "$DEST" ]; then
        echo "DEST ($DEST) is a directory??"
        return 1
    fi

    if [ -f "$DEST" ]; then
        local CURSRC
        CURSRC=$(realpath "$DEST")
        if [ "x$CURSRC" == "x$SRC" ]; then
            return 0
        fi
    fi

    if [ -d "$DEST" ]; then
        rm "$DEST"
    fi

    ln -s "$SRC" "$scratch/tmp"
    if [ ! -z "${SUDO:-}" ]; then
        sudo mv "$scratch/tmp" "$DEST"
    else
        mv "$scratch/tmp" "$DEST"
    fi
}