configuration.nix

{
  users.users.grahamc = {
    home = "/Users/grahamc";
    symlinks = {
      ".emacs.d/init.el" = my-emacs-init;
      ".ssh/config" = my-ssh-config;
      ".zshrc" = my-zsh-rc;
    };
  };
}

symlinks.nix

{ config, lib, pkgs, ... }:

with lib;

let
usersWithKeys = attrValues (flip filterAttrs config.users.users (n: u:
      u.symlinks != {}
));

activationScriptForUser = user: flip mapAttrsToList user.symlinks (reltarget: src:
  "update_symlink \"${src}\" \"${user.home}/${reltarget}\""
);

activationScript = ''
    ${builtins.readFile ./update-symlinks.sh}
    ${concatStringsSep "\n" (flatten (map activationScriptForUser usersWithKeys))}
'';

in {
  ###### interface

  options = {

    users.users = mkOption {
      options = [{
        symlinks = mkOption {
          default = {};
          description = ''
            An attrset of relative paths and targets to symlink in to
            the user's HOME.
          '';
        };
      }];
    };
  };

  ###### implementation

  config = {
    system.activationScripts.usersymlinks.text = activationScript;
  } // (mkIf (builtins.currentSystem == "x86_64-darwin") {
    system.activationScripts.extraActivation.text = activationScript;
  });

}

update-symlinks.sh

scratch=$(mktemp -d -t tmp.XXXXXXXXXX)
update_symlink() {
    local SRC
    local DEST
    local OUTDIR

    SRC="$1"
    DEST="$2"
    OUTDIR=$(dirname "$DEST");
    if [ ! -d "$OUTDIR" ]; then
        if [ ! -z "${SUDO:-}" ]; then
            sudo mkdir -p "$OUTDIR"
        else
            mkdir -p "$OUTDIR"
        fi
    fi

    if [ ! -h "$DEST" ] && [ -d "$DEST" ]; then
        echo "DEST ($DEST) is a directory??"
        return 1
    fi

    if [ -f "$DEST" ]; then
        local CURSRC
        CURSRC=$(realpath "$DEST")
        if [ "x$CURSRC" == "x$SRC" ]; then
            return 0
        fi
    fi

    if [ -d "$DEST" ]; then
        rm "$DEST"
    fi

    ln -s "$SRC" "$scratch/tmp"
    if [ ! -z "${SUDO:-}" ]; then
        sudo mv "$scratch/tmp" "$DEST"
    else
        mv "$scratch/tmp" "$DEST"
    fi
}