systemd: allow ordinary users to invoke shutdown/reboot

hosts/common/systemd.nix

@@ -13,4 +13,23 @@
     # disable journal compression because the underlying fs is compressed
     Compress=no
   '';
+
+  # allow ordinary users to `reboot` or `shutdown`.
+  # source: <https://nixos.wiki/wiki/Polkit>
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (
+        subject.isInGroup("users")
+          && (
+            action.id == "org.freedesktop.login1.reboot" ||
+            action.id == "org.freedesktop.login1.reboot-multiple-sessions" ||
+            action.id == "org.freedesktop.login1.power-off" ||
+            action.id == "org.freedesktop.login1.power-off-multiple-sessions"
+          )
+        )
+      {
+        return polkit.Result.YES;
+      }
+    })
+  '';
 }