feat: add radicale

modules/nixos/server/radicale.nix

@@ -0,0 +1,107 @@
+{ self, lib, config, ... }:
+let
+  inherit (config.repo.secrets.local.radicale) user1;
+  sopsFile = self + /secrets/winters/secrets2.yaml;
+  serviceDomain = "schedule.swarsel.win";
+  servicePort = 8000;
+  serviceName = "radicale";
+  serviceUser = "radicale";
+  serviceGroup = serviceUser;
+
+  cfg = config.services."${serviceName}";
+in
+{
+  options.swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
+  config = lib.mkIf config.swarselsystems.modules.server."${serviceName}" {
+
+    sops = {
+      secrets.radicale-user = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; };
+
+      templates = {
+        "radicale-users" = {
+          content = ''
+            ${user1}:${config.sops.placeholder.radicale-user}
+          '';
+          owner = serviceUser;
+          group = serviceGroup;
+          mode = "0440";
+        };
+      };
+    };
+
+    topology.self.services.radicale.info = "https://${serviceDomain}";
+
+    services.radicale = {
+      enable = true;
+      settings = {
+        server = {
+          hosts = [
+            "0.0.0.0:${builtins.toString servicePort}"
+            "[::]:${builtins.toString servicePort}"
+          ];
+        };
+        auth = {
+          type = "htpasswd";
+          htpasswd_filename = config.sops.templates.radicale-users.path;
+          htpasswd_encryption = "autodetect";
+        };
+        storage = {
+          filesystem_folder = "/Vault/data/radicale/collections";
+        };
+      };
+      rights = {
+        # all: match authenticated users only
+        root = {
+          user = ".+";
+          collection = "";
+          permissions = "R";
+        };
+        principal = {
+          user = ".+";
+          collection = "{user}";
+          permissions = "RW";
+        };
+        calendars = {
+          user = ".+";
+          collection = "{user}/[^/]+";
+          permissions = "rw";
+        };
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.settings.storage.filesystem_folder}'        0750 ${serviceUser} ${serviceGroup} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [ servicePort ];
+    networking.firewall.allowedUDPPorts = [ servicePort ];
+
+    nodes.moonside.services.nginx = {
+      upstreams = {
+        "${serviceName}" = {
+          servers = {
+            "192.168.1.2:${builtins.toString servicePort}" = { };
+          };
+        };
+      };
+      virtualHosts = {
+        "${serviceDomain}" = {
+          enableACME = true;
+          forceSSL = true;
+          acmeRoot = null;
+          oauth2.enable = false;
+          locations = {
+            "/" = {
+              proxyPass = "http://${serviceName}";
+              extraConfig = ''
+                client_max_body_size 16M;
+              '';
+            };
+          };
+        };
+      };
+    };
+
+  };
+
+}