ops/nixos/blade: honey I shrunk the closure

ops/nixos/lib/blade.nix

@@ -49,6 +49,7 @@ in {
     ];
 
     my.rundeck.tags = [ "blade" ];
+    my.home-manager.imports = lib.mkAfter [ ./home-manager/blade.nix ];
 
     fileSystems = let
       zfs = device: {
@@ -143,8 +144,6 @@ in {
       ATTR{address}=="${config.my.blade.macAddress.public}", NAME="en-public"
     '');
 
-    virtualisation.podman.enable = true;
-
     environment.systemPackages = with pkgs; [
       ceph
       xfsprogs
@@ -185,7 +184,18 @@ in {
       enable = true;
       qemu = {
         runAsRoot = true;
-        package = pkgs.qemu_full;
+        package = pkgs.qemu.override {
+          gtkSupport = false;
+          sdlSupport = false;
+          spiceSupport = false;
+          cephSupport = true;
+          smartcardSupport = false;
+          pulseSupport = false;
+          alsaSupport = false;
+          libiscsiSupport = false;
+
+          hostCpuOnly = true;
+        };
       };
       package = pkgs.libvirt.override {
         enableCeph = true;
@@ -204,6 +214,12 @@ in {
       ProcessSizeMax=0
     '';
 
+    fonts.fontconfig.enable = false;
+    programs.ssh.setXAuthLocation = false;
+    security.pam.services.su.forwardXAuth = lib.mkForce false;
+    services.fwupd.enable = lib.mkForce false;
+    xdg.sounds.enable = false;
+
     system.stateVersion = "21.05";
   };
 }

ops/nixos/lib/home-manager/blade.nix

@@ -0,0 +1,7 @@
+{ depot, lib, pkgs, ... }:
+{
+  imports = [ ./common.nix ];
+
+  programs.bash.enableVteIntegration = lib.mkForce false;
+  programs.ntfy.enable = lib.mkForce false;
+}

ops/nixos/lib/home-manager/common.nix

@@ -111,6 +111,9 @@ in
     '';
   };
   programs.vim.enable = true;
+  programs.vim.packageConfigurable = pkgs.vim_configurable.override {
+    guiSupport = false;
+  };
 
   home.packages = (with pkgs; ([
     ripgrep