A guide for SSH authed package fetches?

I'm currently struggling with the following:

- Server with x amount of users, each can use SSH to log in
- Each user has a generated Satis repo in their home directory at ~/satis
- Each user has different PHP packages available and they should not be able to download packages from each others' package repos.

Generating the packages and creating the users is no problem. The problem arises with Composer:

How can I define a composer.json `repositories` configuration to fetch Satis packages from a certain users home directory under a certain directory? The following errors:

```json
"repositories": [
{
"type": "composer",
"url": "ssh2.sftp://packages.example.com:/home/username/satis",
"options": {
"ssh2": { "user": "username", "pubkey_file": "...", "privkey_file": "..." }
}
}
]
```

So does `ssh2.sftp://packages.example.com/home/username/satis`, `ssh2.sftp://packages.example.com/satis` and other variants. Every time the error is `file could not be downloaded: failed to open stream: operation failed`.

Any ideas how to make this work? Or is the users home directory root intended to be the actual Satis repository in order for this to work? Any pointers where to start debugging this?

`ssh2.scp` results in the same error.