I need to generate a number of scripts in my configuration and make them into a single package (for ease of reference, because there are a lot of them).

So far, I'm creating the scripts via writeShellApplication, making them into packages via an overlay, merging them with buildEnv and then adding the resulting package to `systemPackages.

Something like:

nixpkgs.overlays = [ (final: prev: {
  my-hello-1 = final.writeShellApplication {
    name = "my-hello-1-script";
    text = "echo my hello wolrd 1";
  };
  my-hello-2 = final.writeShellApplication {
    name = "my-hello-2-script";
    text = "echo my hello wolrd 1";
  };
  my-hello-scripts = final.buildEnv {
    name = "my-hello-scripts";
    paths = [ final.my-hello-1 final.my-hello-2 ];
  };
}) ];

environment.systemPackages = [ pkgs.my-hello-scripts ];

This works, but I don't really need the my-hello-1 and my-hello-2 packages... can you think of a way to make do without needing them?

I'm migrating my NAS to nixos, and I got to the point of setting up my restic backups.

services.restic.backups is great, but -- on top of the systemd timers/services -- I also want some helper scripts (eg. one to easily mount the backups, stuff that with ansible I currently generate into /usr/local/sbin).

These scripts would be entirely generated from the services.restic.backups config and would reference sops secrets also from configuration.nix, so... I don't think it would make sense to make a package out of them?

What should I use to make these scripts? Should I use nixpkgs.writeShellApplication and then alter the PATH?

Since I need to run a few apps that won't work on LineageOS (because dumb developer security stance), I need to buy a "regular" android device that includes all the google "services".

Ideally, it should be a cheap second-hand phone that will still receive security updates for a long time.

Are there bands that are better (well, "less worse") than others from a privacy perspective?