Add nix-index database and tidy base system

flake.lock

@@ -147,6 +147,26 @@
         "url": "https://git.lix.systems/lix-project/nixos-module"
       }
     },
+    "nix-index-database": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765267181,
+        "narHash": "sha256-d3NBA9zEtBu2JFMnTBqWj7Tmi7R5OikoU2ycrdhQEws=",
+        "owner": "nix-community",
+        "repo": "nix-index-database",
+        "rev": "82befcf7dc77c909b0f2a09f5da910ec95c5b78f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-index-database",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1769741972,
@@ -190,6 +210,7 @@
       "inputs": {
         "lanzaboote": "lanzaboote",
         "lix-module": "lix-module",
+        "nix-index-database": "nix-index-database",
         "nixpkgs": "nixpkgs"
       }
     },

flake.nix

@@ -3,6 +3,10 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     lix-module.url = "git+https://git.lix.systems/lix-project/nixos-module?ref=release-2.93";
     lix-module.inputs.nixpkgs.follows = "nixpkgs";
     lanzaboote.url = "github:nix-community/lanzaboote";

hosts/nanuqsaurus.nix

@@ -3,6 +3,7 @@
 {
   imports = [
     inputs.lix-module.nixosModules.lixFromNixpkgs
+    inputs.nix-index-database.nixosModules.nix-index
     ../modules/system/base.nix
     ../modules/system/packages.nix
     ../modules/system/shell.nix

modules/system/base.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   time.timeZone = "UTC";
@@ -6,12 +11,34 @@
   i18n.defaultLocale = "en_US.UTF-8";
   console.keyMap = "us";
 
-  boot.supportedFilesystems = [ "btrfs" "ext4" "vfat" "xfs" ];
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  boot.supportedFilesystems = [
+    "btrfs"
+    "ext4"
+    "vfat"
+    "xfs"
+  ];
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      # Only keep 10 generations maximum
+      configurationLimit = lib.mkDefault 10;
+    };
+    efi.canTouchEfiVariables = true;
+  };
 
   nix.settings = {
-    experimental-features = [ "nix-command" "flakes" ];
+
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    # Only allow root and sudoers to run Nix commands
+    allowed-users = [
+      "root"
+      "@wheel"
+    ];
+
     substituters = lib.mkBefore [
       "https://cache.lix.systems"
     ];
@@ -26,6 +53,27 @@
 
   nixpkgs.config.allowUnfree = true;
 
+  programs = {
+    nix-index = {
+      enable = lib.mkDefault true;
+      enableBashIntegration = lib.mkDefault true;
+    };
+    nix-index-database.comma.enable = lib.mkDefault true;
+  };
+
+  # Optimise the Nix store once a day
+  nix.optimise = lib.mkDefault {
+    automatic = true;
+    dates = [ "daily" ];
+  };
+
+  # Clean the Nix store once a day
+  nix.gc = lib.mkDefault {
+    automatic = true;
+    dates = "daily";
+    options = "--delete-older-than 30d";
+  };
+
   system.stateVersion = "25.11";
 
   virtualisation = {
@@ -38,4 +86,20 @@
       defaultNetwork.settings.dns_enabled = true;
     };
   };
+
+  security.sudo = {
+    enable = lib.mkDefault true;
+    wheelNeedsPassword = lib.mkForce false;
+  };
+
+  # Locked down root user as a default
+  users.users.root = lib.mkDefault {
+    shell = pkgs.zsh;
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+    hashedPassword = lib.mkDefault "!";
+    initialHashedPassword = lib.mkDefault "!";
+  };
 }

modules/system/packages.nix

@@ -5,6 +5,7 @@
   config.environment.systemPackages = lib.mkAfter [
     pkgs.distrobox
     pkgs.distroshelf
+    pkgs.fastfetch
     pkgs.ghostty
     pkgs.git
     pkgs.home-manager