{ den, lib, ... }:
let
  getPrimaryEmail =
    user:
    (lib.findFirst (email: email.primary) (throw "Missing primary email for ${user.userName}") (builtins.attrValues user.emails)).address;
in
{
  lux.bitwarden = den.lib.parametric {
    includes = [
      (
        { host, user }:
        {
          homeManager.programs.rbw.settings = {
            email = getPrimaryEmail user;
            base_url = "https://vault.${host.serviceDomain}";
          };
        }
      )
    ];

    homeManager = {
      programs.rbw.enable = true;
    };
  };
}