nixos/hosts/hadouken/modules/calendar.nix at master · noisesfromspace/nixos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
{
  config,
  lib,
  inputs,
  ...
}:
with lib;
let
  cfg = config.hosts.calendar;
  radicaleListenAddress = "0.0.0.0:5232";
in
{
  options.hosts.calendar = {
    enable = mkEnableOption "WebDAV + CardDAV + web calendar";
  };

  config = mkIf cfg.enable {
    services.caddy.virtualHosts = {
      "cal.thuis".extraConfig = ''
        import headscale
        handle @internal {
          reverse_proxy http://${radicaleListenAddress}
        }
        respond 403
      '';
      "cal-http.thuis:80".extraConfig = ''
        import headscale
        handle @internal {
          reverse_proxy http://${radicaleListenAddress}
        }
        respond 403
      '';
    };

    systemd.services.caddy = {
      serviceConfig = {
        # Required to use ports < 1024
        AmbientCapabilities = "cap_net_bind_service";
        CapabilityBoundingSet = "cap_net_bind_service";
        TimeoutStartSec = "5m";
      };
    };

    services.borgbackup.jobs.default.paths = [ "/var/lib/radicale/collections/" ];

    age.secrets.radicale = {
      file = "${inputs.secrets}/radicale.age";
      owner = "radicale";
      group = "radicale";
    };

    services.radicale = {
      enable = true;
      settings.server.hosts = [ radicaleListenAddress ];
      settings.auth = {
        type = "htpasswd";
        htpasswd_filename = config.age.secrets.radicale.path;
        htpasswd_encryption = "autodetect";
      };
    };
  };
}