vpn eww and eww crash

modules/nixos/system/network/wireguard/default.nix

@@ -36,6 +36,20 @@ in
       };
     };
 
+    # Let the desktop (eww network panel, scripts/net/wg-toggle) bring the
+    # tunnel up and down.  eww runs as a user service outside the login
+    # session, where polkit cannot ask for a password, so wheel users may
+    # start/stop wireguard-* units without one.
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (action.id == "org.freedesktop.systemd1.manage-units" &&
+            subject.isInGroup("wheel") &&
+            /^wireguard-/.test(action.lookup("unit") || "")) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
+
     systemd.services."wireguard-wg0-peer-vpn-helcel" = {
       after = [ "network-online.target" "nss-lookup.target" ];
       bindsTo = [ "network-online.target" ];