Setting LD_LIBRARY_PATH for Nix dev shells might be bad advice

[isomorpheme]

Location of the documentation

https://docs.haskellstack.org/en/stable/nix_integration/#supporting-both-nix-and-non-nix-developers

Is it inaccurate?

I currently have a devShell in a flake.nix defined along the lines of the docs linked above. This works well for building and running the project, but interacts poorly with nix develop and direnv: tools not specified in the devshell will break because of libc version mismatches. For example, the devshell puts openssl in LD_LIBRARY_PATH, but this breaks tools which (indirectly) depend on it like git fetch, which will fail with a dynamic linking error like

/home/${USER}/.nix-profile/bin/ssh: /nix/store/vq3sdi8l15rzfl5zvmwpafrzis4sm6xf-glibc-2.37-8/lib/libc.so.6: version `GLIBC_2.38' not found (required by /nix/store/vzajrlhsdv2d39s7v6zv09ggajs05gwj-openssl-3.0.11/lib/libcrypto.so.3)

(My ssh happens to be installed via Nix, but I've also seen it happen with Ubuntu's own /usr/bin/ssh.)

Is it incomplete?

There's probably a better way to do things. I don't know if the old-fashioned approach using haskell.lib.buildStackProject has the same issue. It ought to be possible to set up things with --extra-lib-dirs and --extra-include-dirs instead, but I haven't gotten this to work myself yet and I suspect that would actually just be duplicating the functionality of buildStackProject.