Thanks for your answers.
For reference, here are the options I added to disable the services:
systemd.services.nginx.wantedBy = lib.mkForce [];
systemd.services.nginx-config-reload.wantedBy = lib.mkForce [];
systemd.services.libvirtd.wantedBy = lib.mkForce [];
systemd.services.libvirt-guests.wantedBy = lib.mkForce [];
systemd.services.docker.wantedBy = lib.mkForce [];
systemd.services.lxd.wantedBy = lib.mkForce [];
libvirtd
, docker
and lxd
can be activated by their sockets, so a docker ps
for instance launches the daemon.