{ config, pkgs, modulesPath, lib, system, ... }:

{
  config = {
    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
    sops.defaultSopsFile = ../../secrets/caldav.yaml;
    sops.secrets."radicale/users" = {
      owner = "radicale";
      restartUnits = [ "radicale.service" ];
    };

    networking.hostName = "caldav";
    networking.firewall.allowedTCPPorts = [ 5232 ];

    services.radicale = {
      enable = true;
      settings = {
        server.hosts = [ "0.0.0.0:5232" ];
        auth = {
          type = "htpasswd";
          htpasswd_filename = config.sops.secrets."radicale/users".path;
          htpasswd_encryption = "bcrypt";
        };
      };
    };
  };
}