caldav config

4 files changed, 80 insertions, 0 deletions

diff --git a/nix/.sops.yaml b/nix/.sops.yaml
index dbe2155..c0f2315 100644
--- a/nix/.sops.yaml
+++ b/nix/.sops.yaml
@@ -5,6 +5,7 @@ keys:
   - &server_rproxy_2 age1h58rh5q0d7rg984g3e3qfrgwzu3ujzkkcg8f0ls5jlsvdy44f5ls3aywyx
   - &server_git age152as4m0ytaq0dd78lhs7yla2twgkucun9ew02q5xhgffehgsmczqdl4trg
   - &server_photos age1zdy4saxtcs6y90mrjlmz6hnknk67w0cd3n79g2y6fvtzzfsq6f6shwamzj
+  - &server_caldav age1mhugjsg0pz45p56p5vc6hz05zrnk630j6p5xu4n2nsskvtxg8cqsndqr90
 
 creation_rules:
   - path_regex: 'secrets/torrents.*\.yaml$'
@@ -34,3 +35,10 @@ creation_rules:
           - *admin_me
           - *admin_me_2
           - *server_photos
+
+  - path_regex: 'secrets/caldav.*\.yaml$'
+    key_groups:
+      - age:
+          - *admin_me
+          - *admin_me_2
+          - *server_caldav
diff --git a/nix/flake.nix b/nix/flake.nix
index 72c53d3..3e4be37 100644
--- a/nix/flake.nix
+++ b/nix/flake.nix
@@ -18,6 +18,15 @@
         ];
       };
 
+      "caldav" = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./per-host/base/configuration.nix
+          ./per-host/caldav/configuration.nix
+          sops-nix.nixosModules.sops
+        ];
+      };
+
       "git" = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
diff --git a/nix/per-host/caldav/configuration.nix b/nix/per-host/caldav/configuration.nix
new file mode 100644
index 0000000..627310a
--- /dev/null
+++ b/nix/per-host/caldav/configuration.nix
@@ -0,0 +1,27 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+  config = {
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    sops.defaultSopsFile = ../../secrets/caldav.yaml;
+    sops.secrets."radicale/users" = {
+      owner = "radicale";
+      restartUnits = [ "radicale.service" ];
+    };
+
+    networking.hostName = "caldav";
+    networking.firewall.allowedTCPPorts = [ 5232 ];
+
+    services.radicale = {
+      enable = true;
+      settings = {
+        server.hosts = [ "0.0.0.0:5232" ];
+        auth = {
+          type = "htpasswd";
+          htpasswd_filename = config.sops.secrets."radicale/users".path;
+          htpasswd_encryption = "bcrypt";
+        };
+      };
+    };
+  };
+}
diff --git a/nix/secrets/caldav.yaml b/nix/secrets/caldav.yaml
new file mode 100644
index 0000000..e44ea2c
--- /dev/null
+++ b/nix/secrets/caldav.yaml
@@ -0,0 +1,36 @@
+radicale:
+    users: ENC[AES256_GCM,data:2JG+cf/dbzvSxzUhMK7i50pTyw0dWgjP8I/HGxyScOk+nbRgps+aAaQe5kogJ5hqKe+RLVbuyC8wROll4DvOrG0=,iv:9qU7Xm9mpDaDjKElO6lv8gaRE66ItfZ1cV/+wwEWUyI=,tag:C2+FGCTGICgkp0PdHeVY+A==,type:str]
+    jefe-password: ENC[AES256_GCM,data:CYPq6ZXb4/O/ErBrccLyC+SvFqEr6GiE,iv:ntv86T4vvJGhkSvzUbGY6Vp9UUBdlBkctAC2N9CUodQ=,tag:rjO4dxQNWGmtux2HubGXZQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdUxWK3dpZi9qbnQ3Uk5u
+            NUFPalBCK1kzcTZqc3c4TXlKYnFualliU0FzCldTdjFmYUQ4K0tEWTE2dlZIdExn
+            Ym5sa3l6TEVmdzVyNGRMZUlJeHVja1EKLS0tIG1JRG85VVJsWGVXd2hNV3k3OHZB
+            M3dqL056WFJjZUQ1dUNrSDBwUGhJMmMKbbz3+xAjuHEL8sq26oAExHFL3rVwShtn
+            WSpvPXugq+FFBtRza6iXnPSLmraAqqt3QqByoELIOX7o9EqQ2Xyu4A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age12teny70e5cm3992z7atx9g9606d4a60dsl8nskzkpp234uelnctq82mqaa
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWWV6a1VkSHU0UktXQ0pP
+            QVNWRjllaEZWSG9EUk8xR21NWDArN003d0hNCmlWdGZsL0wyRC84dnFpYnBNRWZv
+            M0xOaXF3Mk5qZzdZYkZ3VTZRSmVFTW8KLS0tIHJoMDNjelVUZ2VTV3dSWElUdFlp
+            WjNJRVZycjFydEpMUENrWGhENEcyMlUKg0WTUI3XwCDNGOpTWsaX+pp2dSYFnuJK
+            Im7NiUWeei/zr+wJ1WCwmUg0BBrmdEidvpEWlJajcjVPmkyfcyC9DA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age183q00vnssxx9ksdktsave78js2yggtcaahkf3qqh9j3yj88w54xq722xhy
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuN0FhZXpnTlZrZDY5WDlG
+            bExPNTR5SkhaQkFaUFphendwano4OWs0WUJJCmh6c0dvY0RzRXFYRmU4SDNvYWpC
+            aXQrRFltL1drRDVtWHZ3S3c2R0FSdjAKLS0tIHVhSlk0d3NqWEhhU2haSTZJeUlS
+            SmxRRnFoU0JUc1doWHRTRnRPQ1RYME0KM3OLq6w/rRg9wXlDvrfZbcj0AAPYNd80
+            DFiiLWIMXgK01Pk4J6YPHVkRv9+7qwhrZUFM4aPiIW3Bav4ltnAUZw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mhugjsg0pz45p56p5vc6hz05zrnk630j6p5xu4n2nsskvtxg8cqsndqr90
+    lastmodified: "2026-09-14T17:56:24Z"
+    mac: ENC[AES256_GCM,data:2FUxQeh43WeZ1vVc+bkU7d0tVTHmgrScEhH9ik+LGE136LBHoGVb2a9OBtAeZ/3c4TPGjbTPZiTpxfh9IMOHfT0N1pVesYZe9zm5ZX45qAeni4w8BHyW5nHl9KIw8slOGITKpsSXbZHPbi47GnNaKFybxTCT341WhONL3gi8p8w=,iv:zAbaQIVnpBho88zaDLWzDItUa0CCpPdp5wg9O5tRy9g=,tag:kNq8K2EoLVS6YbTKCmYY4w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3