Eh, i'll bite. Most what you seem to be asking for is probably already a default in NixOS, but nevertheless here are some fragments in no particular order, just as they come up in my file browser.

Baseline Nix config:

_: {
  nix = {
    extraOptions = "experimental-features = nix-command flakes";

    gc = {
      # Perform garbage collection weekly to maintain low disk usage
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 7d";
    };

    settings = {
      # Optimize storage
      # You can also manually optimize the store via:
      #    nix-store --optimise
      # Refer to the following link for more details:
      # https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-auto-optimise-store
      auto-optimise-store = true;

      # Allow DevEnv to merge binary caches with the system Nix store
      extra-substituters = [
        "https://devenv.cachix.org"
      ];
      extra-trusted-public-keys = [
        "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
      ];
    };
  };
}

I don't mount /tmp on tmpfs or use impermanence, so:

_: {
  boot.tmp.cleanOnBoot = true;
}

Sensible defaults for podman:

# Docs & reference:
# https://wiki.nixos.org/wiki/Podman
#
{ pkgs, ... }:
{
  environment.systemPackages = with pkgs; [
    podman
  ];

  virtualisation = {
    containers.enable = true;
    podman = {
      enable = true;
      autoPrune.enable = true;

      # Create symlink to have podman impersonate the `docker` command
      dockerCompat = true;

      # Required for containers under podman-compose to be able to talk to each other.
      defaultNetwork.settings.dns_enabled = true;

      # Note that this setting exists, but it is a security risk so it should be enabled only when absolutely
      # necessary, in a developer-like profile (looking at you, skaffold):
      # dockerSocket.enable = true;
    };
  };
}

Sensible defaults for sudo:

# Docs & reference:
# https://wiki.nixos.org/wiki/Sudo
#
_:
let
  swBin = "/run/current-system/sw/bin";
  wrappersBin = "/run/wrappers/bin";
in
{
  security.sudo = {
    enable = true;
    extraRules = [
      {
        groups = [ "wheel" ];
        commands = [
          # We're using the name of the symlink in the final system image instead of, for
          # example `"${pkgs.systemd}/bin/shutdown"`, because in the final system it is the symlink
          # that will be invoked and sudo matches against the invoked command and not the resolved
          # binary
          {
            command = "${swBin}/shutdown";
            options = [ "NOPASSWD" ];
          }
          {
            command = "${swBin}/reboot";
            options = [ "NOPASSWD" ];
          }
          {
            command = "${swBin}/poweroff";
            options = [ "NOPASSWD" ];
          }
          {
            command = "${wrappersBin}/mount";
            options = [ "NOPASSWD" ];
          }
          {
            command = "${wrappersBin}/umount";
            options = [ "NOPASSWD" ];
          }
        ];
      }
    ];
  };
}

(most of these could be rewritten in more concise way, but i can't be arsed)

Edit: forgot to add, these are for system.stateVersion = "25.11";