This repository has no description
configs.radicale: one shared calendar for lass, book and hermes
author
lassulus
date
(Oct 9, 2026, 8:03 PM CEST)
commit
0ca559ae
0ca559aeb560e81acc1c93adf7fccb9975b710ae
parent
1ce35a24
1ce35a242b06656e73828e23cb3525b2b55a7a3f
+66
-22
+4
-3
configs/book.nix
+4
-3
configs/book.nix
···
33
33
bufferMinutes = 15;
34
34
minNoticeHours = 24;
35
35
horizonDays = 28;
36
-
# Free/busy is read from every calendar of this radicale user; requests
37
-
# and bookings are written to its `calendar` collection (created on demand).
36
+
# lass/calendar is the only calendar (configs/radicale.nix): free/busy is
37
+
# read from it, and requests and bookings are mirrored into it, next to
38
+
# lass's own events and whatever Hermes adds.
38
39
caldav = {
39
40
url = "http://127.0.0.1:5232";
40
41
user = "lass";
41
-
calendar = "bookings";
42
+
calendar = "calendar";
42
43
};
43
44
# Local postfix (configs/mailserver.nix) accepts from localhost and DKIM-signs.
44
45
smtp = {
+17
configs/radicale-user-generator.nix
+17
configs/radicale-user-generator.nix
···
1
+
# clan vars generator for one radicale user: a random password plus its
2
+
# bcrypt htpasswd line. Imported by configs/radicale.nix for every user, and
3
+
# by the machines of users whose generator is shared (hermes on coaxmetal):
4
+
# a shared generator must be defined identically on every machine using it.
5
+
pkgs: user: {
6
+
files."htpasswd-line" = { };
7
+
files."password" = { };
8
+
runtimeInputs = with pkgs; [
9
+
apacheHttpd
10
+
coreutils
11
+
];
12
+
script = ''
13
+
password=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 24)
14
+
echo "$password" > "$out/password"
15
+
htpasswd -nbB ${user} "$password" > "$out/htpasswd-line"
16
+
'';
17
+
}
+45
-19
configs/radicale.nix
+45
-19
configs/radicale.nix
···
6
6
...
7
7
}:
8
8
let
9
-
# lass: personal calendars; tools/book reads free/busy from them and writes
10
-
# booking requests into lass/bookings.
11
-
users = [
12
-
"opencrow"
13
-
"lass"
14
-
];
9
+
# The one and only calendar, lass/calendar: own events (phone via DAVx⁵,
10
+
# calendar.lassul.us), booking requests and bookings mirrored by tools/book
11
+
# (configs/book.nix), and whatever Hermes adds. The rights below make it the
12
+
# only writable collection: nobody can create, delete or replace calendars.
13
+
calendar = "lass/calendar";
15
14
16
-
# Generate one var per user with random password
15
+
# lass: phone, web client and tools/book.
16
+
# hermes: the agent on coaxmetal (machines/coaxmetal/hermes.nix). Its var is
17
+
# shared (and declared there too) so coaxmetal's hermes-env can read the
18
+
# password without radicale running there.
19
+
users = [
20
+
"lass"
21
+
"hermes"
22
+
];
23
+
sharedUsers = [ "hermes" ];
24
+
25
+
# One var per user with a random password.
17
26
userGenerators = lib.listToAttrs (
18
27
map (user: {
19
28
name = "radicale-${user}";
20
-
value = {
21
-
files."htpasswd-line" = { };
22
-
files."password" = { };
23
-
runtimeInputs = with pkgs; [
24
-
apacheHttpd
25
-
coreutils
26
-
];
27
-
script = ''
28
-
password=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 24)
29
-
echo "$password" > "$out/password"
30
-
htpasswd -nbB ${user} "$password" > "$out/htpasswd-line"
31
-
'';
29
+
value = import ./radicale-user-generator.nix pkgs user // {
30
+
share = lib.elem user sharedUsers;
32
31
};
33
32
}) users
34
33
);
···
88
87
type = "internal";
89
88
};
90
89
};
90
+
# Whitelist, first match wins (sections are emitted sorted by name, hence
91
+
# the numeric prefixes); anything unmatched is denied. Every user reads and
92
+
# writes the events of the one calendar (d/o: but may not delete or
93
+
# overwrite the collection itself) and may only read the root and lass's
94
+
# home, which is enough for CalDAV discovery. No W/w anywhere else, so no
95
+
# MKCALENDAR and no auto-created principals.
96
+
rights =
97
+
let
98
+
anyUser = lib.concatStringsSep "|" users;
99
+
in
100
+
{
101
+
"10-calendar" = {
102
+
user = anyUser;
103
+
collection = calendar;
104
+
permissions = "rwdo";
105
+
};
106
+
"20-root" = {
107
+
user = anyUser;
108
+
collection = "";
109
+
permissions = "R";
110
+
};
111
+
"21-home" = {
112
+
user = anyUser;
113
+
collection = lib.head (lib.splitString "/" calendar);
114
+
permissions = "R";
115
+
};
116
+
};
91
117
};
92
118
93
119
systemd.services.radicale.serviceConfig = {