{user}: {
  lib,
  pkgs,
  config,
  ...
}:
with lib; {
  options.roles.work = {
    enable = mkEnableOption "work packages";
  };

  config = mkIf config.roles.work.enable {
    home-manager.users.${user}.imports = [
      {
        roles.email = {
          enable = true;
          email = "tristan.beedell@cryoserver.com";
          terminal = false;
        };

        programs.editor = {
          package = pkgs.vscode;
        };

        home.packages = with pkgs; [
          onedrive
          kubectl
          awscli2
          docker-compose
          minikube
          kubernetes-helm
          thunderbird
          (import ../../lib/mkapp.nix "slack" {
            inherit pkgs;
            desktopName = "Slack";
            app-id = "mpagibdhafmlkgpemeicgogjnhclenoc";
            browser = "${brave}/opt/brave.com/brave/brave-browser";
          })
          (import ../../lib/mkapp.nix "teams" {
            inherit pkgs;
            browser = "${brave}/opt/brave.com/brave/brave-browser";
            app-id = "cifhbcnohmdccbgoicgdjpfamggdegmo";
            desktopName = "Microsoft Teams";
          })
          (pkgs.writeShellScriptBin "codex11" ''
            NIXOS_OZONE_WL= ${pkgs.vscode}/bin/code $@
          '')
          remmina
        ];

        gtk.gtk3.bookmarks = [
          "file:///home/tristan/OneDrive/Documents/ OneDrive"
        ];

        programs.vscode = {
          extensions = with pkgs; [
            vscode-extensions.ms-azuretools.vscode-docker
          ];
          userSettings = {
            "aws.telemetry" = false;
            "gitlens.telemetry.enabled" = false;
            "redhat.telemetry.enabled" = false;
          };
        };

        wayland.windowManager.hyprland = {
          extraConfig = ''
            # === WORK MODULE ===
            bind = SUPER, E, focuswindow, thunderbird
            bind = SUPER, t, focuswindow, brave-cifhbcnohmdccbgoicgdjpfamggdegmo-Profile_2
          '';
        };
      }
    ];

    nixpkgs.config.allowUnfreePredicate = pkg:
      builtins.elem (lib.getName pkg) [
        # nonfree vscode required for dev containers
        "vscode"
        "steam-run"
      ];

    networking = {
      networkmanager = {
        plugins = [pkgs.networkmanager-openvpn];
      };
    };

    users.users.tristan.extraGroups = ["docker"];
    virtualisation.docker = {
      enable = true;
      storageDriver = "btrfs";
      rootless = {
        enable = false;
        setSocketVariable = true;
        daemon.settings = {
          "userns-remap" = "default";
        };
      };
    };
  };
}