ext

modules/home/desktop/gnome/default.nix

@@ -33,6 +33,7 @@ in
       gnomeExtensions.boatman-winboat-monitor
       papirus-icon-theme
       pop-gtk-theme
+      pkgs.mjallen.gnome-nebula-vpn
     ];
 
     dconf = {
@@ -68,6 +69,7 @@ in
           "dash-to-dock@micxgx.gmail.com"
           "BingWallpaper@ineffable-gmail.com"
           "gsconnect@andyholmes.github.io"
+          "nebula-vpn-status@mjallen"
         ];
         "org/gnome/shell/extensions/bingwallpaper" = {
           override-lockscreen-blur = true;

modules/nixos/services/nebula/default.nix

@@ -89,6 +89,21 @@ let
     moduleConfig = {
       environment.systemPackages = with pkgs; [ nebula ];
 
+      # Allow users in the wheel group to start/stop the nebula service without
+      # a password prompt (used by the GNOME panel extension toggle).
+      security.polkit.extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.systemd1.manage-units" &&
+              action.lookup("unit") == "nebula@${cfg.networkName}.service" &&
+              (action.lookup("verb") == "start" || action.lookup("verb") == "stop") &&
+              subject.local == true &&
+              subject.active == true &&
+              subject.isInGroup("wheel")) {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+
       services.nebula.networks.${cfg.networkName} = {
         enable = true;
         enableReload = true;