How to use chown in Nix derivations?

I'm trying to package a script to perform deployments with a git push in a Nix derivation. The goal is having a git repo that on post-receive run some actions.

I want to package it so that I can just keep it alongside my configuration and ship it easily, minimising the amount of manual tasks to do.

I've already setup a git user:

users.users.git = {
    isNormalUser = true;
    shell = "/run/current-system/sw/bin/git-shell";
    home = "/home/git";
    openssh.authorizedKeys.keys = [
      ...
    ];
  };

My derivation looks like this:

with import <nixpkgs> {};
let setupGitRepo = name : (
stdenv.mkDerivation {
  name = "setup-git-repo";
  dontUnpack = true;
  buildInputs = [
    git
  ];
  buildPhase = ''
git init --bare ${name}.git
mkdir -p ${name}.git/hooks
touch ${name}.git/hooks/post-receive
tee ${name}.git/hooks/post-receive <<EOF
GIT="/home/git/${name}.git"
WWW="/var/www/${name}"
TMP="/tmp/${name}"
ENV="/home/git/${name}.env"
rm -rf \$TMP
mkdir -p \$TMP
git --work-tree=\$TMP --git-dir=\$GIT checkout -f
cp -a \$ENV/.* \$TMP
cd \$TMP
# install deps, etc
rm -rf \$WWW/*
mv \$TMP/* \$WWW/*
# restart services here
rm -rf \$TMP
EOF 
  '';
  installPhase = ''
    mkdir -p $out/var/www/${name}
    mkdir -p $out/home/git
    mkdir -p $out/home/git/${name}.env
    chown -R git:users ${name}.git # doesn't work
    chown -R git:users $out/var/www/${name} # doesn't work
    cp -R ${name}.git $out/home/git
  '';
});
in setupGitRepo "test"

My problem is that I can't use chown git:users to set ownership during the build or install phase, I assume because of isolation in the build process.

Is there a way to overcome this? I wonder if the issue I'm getting is a signal I'm missing something obvious or misusing tools. Writing in /home from a package could be another code smell: I'm doing it to have a nicer url to add to git git remote add server git@mydomain:test.git)

Thanks

EDIT: I'll upload my nixos configuration here with the suggestions from David: https://github.com/framp/nixos-configs/blob/master/painpoint