Access tokens are not picked up by `nix-build`

Help
1

I put an access token in my nix.conf:

access-tokens = gitlab.myconmpany.com=PAT:MyTokenXxX123

nix show-config also outputs it correctly.

Now I am trying to build an example derivation:

# default.nix
{ pkgs ? import <nixpkgs> {} }:

let
  # Define the source for the company's GitLab repository with a fakesha
  companyRepo = pkgs.fetchgit {
    url = "https://gitlab.mycompany.com/UserName/example.git";
    rev = "foo";
    sha256 = "faa8f83dc92671033e284ff66a9883681abdaf85b5e239ab9799d76451c71c79";
  };

  # Import the company's package set
  companyPkgs = import companyRepo { inherit pkgs; };
in
  # Use a package from the company's package set
  companyPkgs.example-package

I get the error:

fatal: could not read Username for 'https://gitlab.mycompany.com': No such device or address
fatal: could not read Username for 'https://gitlab.mycompany.com': No such device or address
fatal: could not read Username for 'https://gitlab.mycompany.com': No such device or address
fatal: could not read Username for 'https://gitlab.mycompany.com': No such device or address
Unable to checkout refs/tags/foo from https://gitlab.mycompany.com/UserName/example.git.

It seems that nix-build can’t resolve the token. If I put the auth string directly into the URI:

https://PAT:MyTokenXxX123@gitlab.mycompany.com/UserName/example.git

it works. But obviously, I don’t want to do that.

Maybe it has to do because the nix build users used for building the derivation are different from my logged-in users, and indeed, sudo nix show-config doesn’t list my token either.

However, since the system-wide config is in the store, that would possibly mean I would have to store the token somewehere in configuration.nix or go all-in with sops-nix or something like that… for an extremely simple task of just supplying credentials to build something…

Is there anything I am missing here or do I really have to go the sops-nix etc. route?