feat(nixos): add neogaia WireGuard client

configs/nixos/modules/desktop/session/waybar.nix

@@ -7,6 +7,7 @@
 # Waybar: a top status bar reading system state at a glance.
 let
   cfg = config.modules.desktop.session.waybar;
+  vpnClient = config.modules.network.vpn-client;
   user = config.user.name;
 
   # A Nerd Font Private-Use-Area codepoint as a literal character, decoded
@@ -48,6 +49,23 @@ let
     fi
   '';
 
+  vpnStatus = pkgs.writeShellScript "waybar-vpn-status" ''
+    interface=${lib.escapeShellArg vpnClient.interface}
+
+    if ! ${pkgs.iproute2}/bin/ip link show dev "$interface" >/dev/null 2>&1; then
+      printf '{"text":"","class":"idle"}\n'
+      exit 0
+    fi
+
+    ipaddr=$(${pkgs.iproute2}/bin/ip -4 -o addr show dev "$interface" | ${pkgs.gawk}/bin/awk '{ print $4; exit }')
+
+    ${pkgs.jq}/bin/jq -cn \
+      --arg text "󰲝" \
+      --arg tooltip "VPN $interface: ''${ipaddr:-no IPv4}" \
+      --arg class "active" \
+      '{ text: $text, tooltip: $tooltip, class: $class }'
+  '';
+
   networkStatus = pkgs.writeShellScript "waybar-network-status" ''
     active=$(
       ${pkgs.networkmanager}/bin/nmcli -t -f DEVICE,TYPE,STATE,CONNECTION device status \
@@ -118,6 +136,9 @@ in
           "custom/idle-lock"
           "mpris"
           "wireplumber"
+        ]
+        ++ lib.optional vpnClient.enable "custom/vpn"
+        ++ [
           "custom/network"
           "battery"
           "custom/dnd"
@@ -173,6 +194,12 @@ in
           on-click = "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
         };
 
+        "custom/vpn" = {
+          return-type = "json";
+          exec = "${vpnStatus}";
+          interval = 5;
+        };
+
         "custom/network" = {
           return-type = "json";
           exec = "${networkStatus}";