forked from
lass.pds.lassul.us/superconfig
This repository has no description
neoprism: add radicale CalDAV server at cal.lassul.us
- Radicale with htpasswd auth (bcrypt), proxied via nginx with ACME
- DNS CNAME for cal.lassul.us -> neoprism
- Auto-generated password stored in clan vars
- User: opencrow
- Compatible with DAVx5 (Android), Thunderbird, etc.
author
opencrow
committer
lassulus
date
(Feb 21, 2026, 7:39 PM CET)
commit
923dd275
923dd2755f2b31beb787f7940b9b14ec6e9066c5
parent
7dc0700e
7dc0700e16ba675563877ebc0dff016633697c32
+77
+73
2configs/radicale.nix
+73
2configs/radicale.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
users = [ "opencrow" ];
4
+
5
+
# Generate one var per user with random password
6
+
userGenerators = lib.listToAttrs (map (user: {
7
+
name = "radicale-${user}";
8
+
value = {
9
+
files."htpasswd-line" = { };
10
+
files."password" = { };
11
+
runtimeInputs = with pkgs; [ apacheHttpd coreutils ];
12
+
script = ''
13
+
password=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 24)
14
+
echo "$password" > "$out/password"
15
+
htpasswd -nbB ${user} "$password" > "$out/htpasswd-line"
16
+
'';
17
+
};
18
+
}) users);
19
+
20
+
loadCredentials = map (user:
21
+
"radicale-${user}-htpasswd:${config.clan.core.vars.generators."radicale-${user}".files."htpasswd-line".path}"
22
+
) users;
23
+
24
+
assembleHtpasswd = pkgs.writeShellScript "radicale-htpasswd" (
25
+
lib.concatMapStringsSep "\n" (user:
26
+
"cat \${CREDENTIALS_DIRECTORY}/radicale-${user}-htpasswd"
27
+
) users
28
+
);
29
+
in
30
+
{
31
+
services.radicale = {
32
+
enable = true;
33
+
settings = {
34
+
server = {
35
+
hosts = [ "127.0.0.1:5232" ];
36
+
};
37
+
auth = {
38
+
type = "htpasswd";
39
+
htpasswd_filename = "/run/radicale/htpasswd";
40
+
htpasswd_encryption = "bcrypt";
41
+
};
42
+
storage = {
43
+
filesystem_folder = "/var/lib/radicale/collections";
44
+
};
45
+
web = {
46
+
type = "internal";
47
+
};
48
+
};
49
+
};
50
+
51
+
systemd.services.radicale.serviceConfig = {
52
+
RuntimeDirectory = "radicale";
53
+
LoadCredential = loadCredentials;
54
+
};
55
+
systemd.services.radicale.preStart = lib.mkBefore ''
56
+
${assembleHtpasswd} > /run/radicale/htpasswd
57
+
'';
58
+
59
+
clan.core.vars.generators = userGenerators;
60
+
61
+
services.nginx.virtualHosts."cal.lassul.us" = {
62
+
forceSSL = true;
63
+
enableACME = true;
64
+
locations."/" = {
65
+
proxyPass = "http://127.0.0.1:5232";
66
+
extraConfig = ''
67
+
proxy_set_header X-Script-Name /;
68
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
69
+
proxy_set_header Host $host;
70
+
'';
71
+
};
72
+
};
73
+
}
+1
2configs/dns/lassul.us.zone
+1
2configs/dns/lassul.us.zone