This repository has no description
2.1 kB
84 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7let
8 users = [ "opencrow" ];
9
10 # Generate one var per user with random password
11 userGenerators = lib.listToAttrs (
12 map (user: {
13 name = "radicale-${user}";
14 value = {
15 files."htpasswd-line" = { };
16 files."password" = { };
17 runtimeInputs = with pkgs; [
18 apacheHttpd
19 coreutils
20 ];
21 script = ''
22 password=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 24)
23 echo "$password" > "$out/password"
24 htpasswd -nbB ${user} "$password" > "$out/htpasswd-line"
25 '';
26 };
27 }) users
28 );
29
30 loadCredentials = map (
31 user:
32 "radicale-${user}-htpasswd:${
33 config.clan.core.vars.generators."radicale-${user}".files."htpasswd-line".path
34 }"
35 ) users;
36
37 assembleHtpasswd = pkgs.writeShellScript "radicale-htpasswd" (
38 lib.concatMapStringsSep "\n" (user: "cat \${CREDENTIALS_DIRECTORY}/radicale-${user}-htpasswd") users
39 );
40in
41{
42 services.radicale = {
43 enable = true;
44 settings = {
45 server = {
46 hosts = [ "127.0.0.1:5232" ];
47 };
48 auth = {
49 type = "htpasswd";
50 htpasswd_filename = "/run/radicale/htpasswd";
51 htpasswd_encryption = "bcrypt";
52 };
53 storage = {
54 filesystem_folder = "/var/lib/radicale/collections";
55 };
56 web = {
57 type = "internal";
58 };
59 };
60 };
61
62 systemd.services.radicale.serviceConfig = {
63 RuntimeDirectory = "radicale";
64 LoadCredential = loadCredentials;
65 };
66 systemd.services.radicale.preStart = lib.mkBefore ''
67 ${assembleHtpasswd} > /run/radicale/htpasswd
68 '';
69
70 clan.core.vars.generators = userGenerators;
71
72 services.nginx.virtualHosts."cal.lassul.us" = {
73 forceSSL = true;
74 enableACME = true;
75 locations."/" = {
76 proxyPass = "http://127.0.0.1:5232";
77 extraConfig = ''
78 proxy_set_header X-Script-Name /;
79 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
80 proxy_set_header Host $host;
81 '';
82 };
83 };
84}