system/hosts/tatos/services/wireguard/update_ru_routes.nix

{ writeShellScriptBin
, substituteAll
, symlinkJoin
, makeWrapper
, bind
, iptables
, ipcalc
, jq
, gawk
, curl
}:
let
  update_ru_routes_unwrapped = writeShellScriptBin "update_ru_routes"
    (builtins.readFile (substituteAll {
      src = ./update_ru_routes.sh;
      subnetsUserList = "${./subnets_user_list.secret.txt}";
    }));
in
symlinkJoin {
  name = "update_ru_routes";

  paths = [ update_ru_routes_unwrapped ] ++ [ bind.dnsutils iptables jq gawk curl ipcalc ];
  buildInputs = [ makeWrapper ];

  postBuild = ''
    wrapProgram $out/bin/update_ru_routes --prefix PATH : $out/bin
  '';
}