After doing this (ctrl on hold and escape on tap) on every system I use, I wrote a blog post with instructions: https://www.dannyguo.com/blog/remap-caps-lock-to-escape-and-...
Turns out you can enable caps2esc, which is mentioned in the blog post, on NixOS with a single line:
services.interception-tools.enable = true;