fix(#2422): tighten Nix module polish

nix/nixosModules.nix

@@ -85,7 +85,6 @@ let
       cfg.extraEnvironment));
 
   needsWritableStateDir = cfg.stateDir != defaultStateDir;
-  writableServiceDirs = lib.optionals needsWritableStateDir [ cfg.stateDir ];
   tmpfilesRules = lib.optionals needsWritableStateDir [
     "d ${cfg.stateDir} 0700 ${cfg.user} ${cfg.group} - -"
   ];
@@ -194,7 +193,6 @@ in
           Restart = "on-failure";
           Environment = mappedEnvironment;
           EnvironmentFile = map builtins.toString cfg.environmentFiles;
-          ReadWritePaths = map builtins.toString writableServiceDirs;
           StateDirectoryMode = "0700";
           UMask = "0077";
         }
@@ -213,7 +211,6 @@ in
       ${cfg.user} = {
         isSystemUser = true;
         group = cfg.group;
-        createHome = true;
         home = cfg.stateDir;
       };
     };

nix/packages.nix

@@ -1,4 +1,4 @@
-{ pkgs, version ? "0.51.0" }:
+{ pkgs, version ? "unstable" }:
 
 let
   pythonEnv = pkgs.python3.withPackages (
@@ -29,6 +29,7 @@ pkgs.stdenv.mkDerivation {
     cp "${./../requirements.txt}" "$out/${runtimeDir}/requirements.txt"
     cp -r "${./../api}" "$out/${runtimeDir}/api"
     cp -r "${./../static}" "$out/${runtimeDir}/static"
+    printf "__version__ = '%s'\n" "$version" > "$out/${runtimeDir}/api/_version.py"
 
     makeWrapper ${pythonEnv}/bin/python3 "$out/bin/hermes-webui" \
       --set HERMES_WEBUI_DISABLE_LOCAL_VENV 1 \