ext

modules/nixos/services/nebula/default.nix

@@ -89,6 +89,21 @@ let
     moduleConfig = {
       environment.systemPackages = with pkgs; [ nebula ];
 
+      # Allow users in the wheel group to start/stop the nebula service without
+      # a password prompt (used by the GNOME panel extension toggle).
+      security.polkit.extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.systemd1.manage-units" &&
+              action.lookup("unit") == "nebula@${cfg.networkName}.service" &&
+              (action.lookup("verb") == "start" || action.lookup("verb") == "stop") &&
+              subject.local == true &&
+              subject.active == true &&
+              subject.isInGroup("wheel")) {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+
       services.nebula.networks.${cfg.networkName} = {
         enable = true;
         enableReload = true;