Add nix-index database and tidy base system

modules/system/base.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   time.timeZone = "UTC";
@@ -6,12 +11,34 @@
   i18n.defaultLocale = "en_US.UTF-8";
   console.keyMap = "us";
 
-  boot.supportedFilesystems = [ "btrfs" "ext4" "vfat" "xfs" ];
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  boot.supportedFilesystems = [
+    "btrfs"
+    "ext4"
+    "vfat"
+    "xfs"
+  ];
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      # Only keep 10 generations maximum
+      configurationLimit = lib.mkDefault 10;
+    };
+    efi.canTouchEfiVariables = true;
+  };
 
   nix.settings = {
-    experimental-features = [ "nix-command" "flakes" ];
+
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    # Only allow root and sudoers to run Nix commands
+    allowed-users = [
+      "root"
+      "@wheel"
+    ];
+
     substituters = lib.mkBefore [
       "https://cache.lix.systems"
     ];
@@ -26,6 +53,27 @@
 
   nixpkgs.config.allowUnfree = true;
 
+  programs = {
+    nix-index = {
+      enable = lib.mkDefault true;
+      enableBashIntegration = lib.mkDefault true;
+    };
+    nix-index-database.comma.enable = lib.mkDefault true;
+  };
+
+  # Optimise the Nix store once a day
+  nix.optimise = lib.mkDefault {
+    automatic = true;
+    dates = [ "daily" ];
+  };
+
+  # Clean the Nix store once a day
+  nix.gc = lib.mkDefault {
+    automatic = true;
+    dates = "daily";
+    options = "--delete-older-than 30d";
+  };
+
   system.stateVersion = "25.11";
 
   virtualisation = {
@@ -38,4 +86,20 @@
       defaultNetwork.settings.dns_enabled = true;
     };
   };
+
+  security.sudo = {
+    enable = lib.mkDefault true;
+    wheelNeedsPassword = lib.mkForce false;
+  };
+
+  # Locked down root user as a default
+  users.users.root = lib.mkDefault {
+    shell = pkgs.zsh;
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+    hashedPassword = lib.mkDefault "!";
+    initialHashedPassword = lib.mkDefault "!";
+  };
 }