Expose the config in the passthru and move values into the config.

nix/modules/default.nix

@@ -1,5 +1,7 @@
 { lib
 , config
+, pkgs
+, system-manager
 , ...
 }:
 {
@@ -109,6 +111,28 @@
           default = { };
         };
       };
+
+      build = {
+        scripts = lib.mkOption {
+          type = lib.types.attrsOf lib.types.package;
+        };
+
+        etc = {
+          staticEnv = lib.mkOption {
+            type = lib.types.package;
+          };
+
+          entries = lib.mkOption {
+            # TODO: better type
+            type = lib.types.attrsOf lib.types.raw;
+          };
+        };
+
+        services = lib.mkOption {
+          # TODO: better type
+          type = lib.types.attrsOf lib.types.raw;
+        };
+      };
     };
 
   config = {
@@ -132,5 +156,116 @@
           '';
         };
     };
+
+    build = {
+      scripts = {
+        registerProfileScript = pkgs.writeShellScript "register-profile" ''
+          ${system-manager}/bin/system-manager register \
+            --store-path "$(dirname $(realpath $(dirname ''${0})))" \
+            "$@"
+        '';
+
+        activationScript = pkgs.writeShellScript "activate" ''
+          ${system-manager}/bin/system-manager activate \
+            --store-path "$(dirname $(realpath $(dirname ''${0})))" \
+            "$@"
+        '';
+
+        prepopulateScript = pkgs.writeShellScript "prepopulate" ''
+          ${system-manager}/bin/system-manager pre-populate \
+            --store-path "$(dirname $(realpath $(dirname ''${0})))" \
+            "$@"
+        '';
+
+        deactivationScript = pkgs.writeShellScript "deactivate" ''
+          ${system-manager}/bin/system-manager deactivate "$@"
+        '';
+
+        preActivationAssertionScript =
+          let
+            mkAssertion = { name, script, ... }: ''
+              # ${name}
+
+              echo -e "Evaluating pre-activation assertion ${name}...\n"
+              (
+                set +e
+                ${script}
+              )
+              assertion_result=$?
+
+              if [ $assertion_result -ne 0 ]; then
+                failed_assertions+=${name}
+              fi
+            '';
+
+            mkAssertions = assertions:
+              lib.concatStringsSep "\n" (
+                lib.mapAttrsToList (name: mkAssertion) (
+                  lib.filterAttrs (name: cfg: cfg.enable)
+                    assertions
+                )
+              );
+          in
+          pkgs.writeShellScript "preActivationAssertions" ''
+            set -ou pipefail
+
+            declare -a failed_assertions=()
+
+            ${mkAssertions config.system-manager.preActivationAssertions}
+
+            if [ ''${#failed_assertions[@]} -ne 0 ]; then
+              for failed_assertion in ''${failed_assertions[@]}; do
+                echo "Pre-activation assertion $failed_assertion failed."
+              done
+              echo "See the output above for more details."
+              exit 1
+            else
+              echo "All pre-activation assertions succeeded."
+              exit 0
+            fi
+          '';
+      };
+
+      # TODO: handle globbing
+      etc =
+        let
+          addToStore = name: file: pkgs.runCommandLocal "${name}-etc-link" { } ''
+            mkdir -p "$out/$(dirname "${file.target}")"
+            ln -s "${file.source}" "$out/${file.target}"
+
+            if [ "${file.mode}" != symlink ]; then
+              echo "${file.mode}" > "$out/${file.target}.mode"
+              echo "${file.user}" > "$out/${file.target}.uid"
+              echo "${file.group}" > "$out/${file.target}.gid"
+            fi
+          '';
+
+          filteredEntries = lib.filterAttrs
+            (_name: etcFile: etcFile.enable)
+            config.environment.etc;
+
+          srcDrvs = lib.mapAttrs addToStore filteredEntries;
+
+          entries = lib.mapAttrs
+            (name: file: file // { source = "${srcDrvs.${name}}"; })
+            filteredEntries;
+
+          staticEnv = pkgs.buildEnv {
+            name = "etc-static-env";
+            paths = lib.attrValues srcDrvs;
+          };
+        in
+        { inherit entries staticEnv; };
+
+      services =
+        lib.mapAttrs'
+          (unitName: unit:
+            lib.nameValuePair unitName {
+              storePath =
+                ''${unit.unit}/${unitName}'';
+            })
+          (lib.filterAttrs (_: unit: unit.enable)
+            config.systemd.units);
+    };
   };
 }