Fix esphome build issues

The package from nixpkgs master seems to fix the build issues.

hosts/iron/services/esphome/default.nix

@@ -2,7 +2,6 @@ args@{ lib, pkgs, config, custom-utils, ... }:
 let
   ports = import ../../ports.nix args;
   cfg = config.services.esphome;
-  stateDir = "/var/lib/esphome";
   devices = [
     ./yeelight-meteorite.yaml
   ];
@@ -13,7 +12,6 @@ let
     installPhase = ''
       mkdir $out
       cp -r * $out
-      ln -snf "${config.sops.secrets.esphome.path}" "$out/secrets.yaml"
     '';
   };
   esphomeParams =
@@ -33,31 +31,43 @@ in
     enable = true;
     address = "127.0.0.1";
     port = ports.esphome.tcp;
-    package = pkgs.esphome.overrideAttrs (attrs: {
-      makeWrapperArgs = attrs.makeWrapperArgs ++ [
-        "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
-      ];
-    });
+    package = pkgs.master.esphome;
+    #package = pkgs.esphome.overrideAttrs (attrs: {
+    #  makeWrapperArgs = attrs.makeWrapperArgs ++ [
+    #    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
+    #  ];
+    #});
   };
 
-  system.activationScripts.esphome-custom = {
-    deps = [ "users" "groups" ];
-    text = ''
-      ${pkgs.rsync}/bin/rsync \
-        -a \
-        --delete \
-        --exclude=.esphome \
-        --exclude=.platformio \
-        --exclude=.gitignore \
-        "${cfgdir}/" "${stateDir}/"
-      mkdir -p \
-        "${stateDir}/.esphome" \
-        "${stateDir}/.platformio"
-      touch "${stateDir}/.gitignore"
-      chown esphome:esphome \
-        "${stateDir}/" \
-        "${stateDir}/.esphome" \
-        "${stateDir}/.platformio"
-    '';
+  systemd.services.esphome = {
+    environment = {
+      "PLATFORMIO_CORE_DIR" = lib.mkForce "/tmp/.platformio";
+    };
+    serviceConfig = {
+      BindPaths = [
+        "/var/lib/esphome"
+        "/var/lib/private/esphome"
+      ];
+      BindReadOnlyPaths = [
+        "/nix/store"
+        "${cfgdir}"
+      ];
+      DeviceAllow = [
+        "char-ttyACM rw"
+        "char-ttyAMA rw"
+        "char-ttyUSB rw"
+      ];
+      ExecStartPre = [
+        "${pkgs.rsync}/bin/rsync -a --delete --exclude=.esphome --exclude=.platformio --exclude=.gitignore '${cfgdir}/' '/var/lib/esphome/'"
+        "${pkgs.coreutils}/bin/ln -snf '%d/secrets.yaml' '/var/lib/esphome/secrets.yaml'"
+      ];
+      LoadCredential = "secrets.yaml:${config.sops.secrets.esphome.path}";
+      PrivateTmp = true;
+      RootDirectory = "/run/esphome";
+      RuntimeDirectory = "esphome";
+      StateDirectory = "esphome";
+      SupplementaryGroups = [ "dialout" ];
+      WorkingDirectory = lib.mkForce "/tmp";
+    };
   };
 }