Nix flake update with ssh key to access repository

Help
1

Background
The problem I am trying to solve (and I am happy to take suggestions for different approaches) is to have a NixOS machine that I manage with users who can edit their own Home Manager configurations separately from the NixOS configuration. The method suggested to me elsewhere was to create a per-user git repository containing a user flake that can be both integrated into the system-wide flake setup as an input and used standalone by the relevant end user.

Setup
NixOS unstable
Flakes
Home Manager

System flake.nix
The system-wide flake.nix contains the following (the $VARIABLES are only to remove identifying information):

inputs = {

    # ... SNIPPED IRRELEVANT STUFF

    # Home Manager User Flakes

    # $USER
    user-$USER = {
      url = "git+https://git.$REPOSITORY/$GIT-USER/user-$USER.git?ref=trunk";
      inputs.nixpkgs.follows = "nixpkgs";
    };

};

With this specific setup, I have to login with a username and password each time I want to update the input. If, however, I change the url to an ssh command and execute a nixos-rebuild, I get a failure related to permissions and my ssh key. A helpful person elsewhere suggested this was because sudo doesn’t have access to my user’s ssh keys, as I am executing nixos-rebuild with sudo.

  1. My assumption is that this won’t be an issue when updating through Home Manager as I don’t use sudo for that. I have only tried this in the **system **
  2. If sudo not having access to the user’s (my) ssh keys looks like a likely culprit, how can I (a) grant sudo access to user ssh keys or (b) otherwise solve the issue of not being able to access the git repository that is authenticated via ssh key?
2

You should be able to run nixos-rebuild switch --use-remote-sudo instead of sudo nixos-rebuild switch. Despite having “remote” in the flag, it works locally as well. It will just ask for sudo at the end when it needs the permissions.

3 
    security.sudo.extraConfig = ''
      Defaults    env_keep+=SSH_AUTH_SOCK
    '';

will pass the SSH_AUTH_SOCK to root. Assuming your agent is setup properly otherwise, this should do what you want.

4

Thank you. That appears to have worked (“appears to” because I’m getting an unrelated build error).

5

Might end up with two good answers in this thread. I will give this a shot once I can rebuild successfully.