hail: add hosts blacklist to work around restricted mode

hail.nix

@@ -3,6 +3,11 @@
 
 with pkgs;
 let
+  # TODO: make these work in restricted mode
+  blacklist = {
+    mucbot = true;
+    spacemsg = true;
+  };
   physicalHost = host: {
     inherit host;
     configuration = <nix-config> + "/hosts/${host}/configuration.nix";
@@ -46,5 +51,9 @@ in
         };
       in
       [ (part "config")  (part "activator") ]
-    ) hosts
+    ) (
+      builtins.filter ({ host, ... }:
+        ! (builtins.hasAttr host blacklist)
+      ) hosts
+    )
   )