Why can't nixos-rebuild see files that aren't in the git repository?

I had planned to have a private directory to store the config that writes my .ssh directory, sublime text licence, creates the users with passwords, etc. Then share the rest of my (non-sensitive) config on github.

So I put private in .gitignore and suddenly nixos-rebuild switch can’t see the private directory. Why does nixos-rebuild switch pay attention to what is or isn’t tracked by git? These seem like two very different tasks, why are they so heavily coupled?

Is there any way around this?

I’m using flakes if it makes any difference.

There’s the answer. Nothing to do with nixos-rebuild, it’s nix’s design.
When using flakes in a git repo, nix only copies files that are part of the git index to the store, so you must git-add any new files.

But from a pragmatic perspective why does running git init change the behaviour of nixos-rebuild? These are fundamentally different applications with different use-cases.

It’s “Spooky action at a distance” in OS terms and incredibly unintuitive.

As I just said, it’s nothing to do with nixos-rebuild, it’s nix’s design.

There is a PR to fix that Don't ignore unstaged files in local flakes by SuperSandro2000 · Pull Request #6858 · NixOS/nix · GitHub

  • We should wait for lazy trees before changing the behavior.

I wouldn’t hold my breath on this getting merged soon. And nevertheless, the default will still be the current behaviour, so this would still require at minimum a settings change.

The other option today is to use path: type reference to the flake which will copy the entire thing to the store (including the .git). I think having .git in the store is a bit silly, but it technically works.