This repository has no description
2.2 kB
89 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7let
8 # lass: personal calendars; tools/book reads free/busy from them and writes
9 # booking requests into lass/bookings.
10 users = [
11 "opencrow"
12 "lass"
13 ];
14
15 # Generate one var per user with random password
16 userGenerators = lib.listToAttrs (
17 map (user: {
18 name = "radicale-${user}";
19 value = {
20 files."htpasswd-line" = { };
21 files."password" = { };
22 runtimeInputs = with pkgs; [
23 apacheHttpd
24 coreutils
25 ];
26 script = ''
27 password=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 24)
28 echo "$password" > "$out/password"
29 htpasswd -nbB ${user} "$password" > "$out/htpasswd-line"
30 '';
31 };
32 }) users
33 );
34
35 loadCredentials = map (
36 user:
37 "radicale-${user}-htpasswd:${
38 config.clan.core.vars.generators."radicale-${user}".files."htpasswd-line".path
39 }"
40 ) users;
41
42 assembleHtpasswd = pkgs.writeShellScript "radicale-htpasswd" (
43 lib.concatMapStringsSep "\n" (user: "cat \${CREDENTIALS_DIRECTORY}/radicale-${user}-htpasswd") users
44 );
45in
46{
47 services.radicale = {
48 enable = true;
49 settings = {
50 server = {
51 hosts = [ "127.0.0.1:5232" ];
52 };
53 auth = {
54 type = "htpasswd";
55 htpasswd_filename = "/run/radicale/htpasswd";
56 htpasswd_encryption = "bcrypt";
57 };
58 storage = {
59 filesystem_folder = "/var/lib/radicale/collections";
60 };
61 web = {
62 type = "internal";
63 };
64 };
65 };
66
67 systemd.services.radicale.serviceConfig = {
68 RuntimeDirectory = "radicale";
69 LoadCredential = loadCredentials;
70 };
71 systemd.services.radicale.preStart = lib.mkBefore ''
72 ${assembleHtpasswd} > /run/radicale/htpasswd
73 '';
74
75 clan.core.vars.generators = userGenerators;
76
77 services.nginx.virtualHosts."cal.lassul.us" = {
78 forceSSL = true;
79 enableACME = true;
80 locations."/" = {
81 proxyPass = "http://127.0.0.1:5232";
82 extraConfig = ''
83 proxy_set_header X-Script-Name /;
84 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
85 proxy_set_header Host $host;
86 '';
87 };
88 };
89}