{ ... }:

{
  services.radicale = {
    enable = true;
    config = ''
    [server]
    hosts = 127.0.0.1:61865

    [auth]
    type = htpasswd
    htpasswd_filename = /var/src/secrets/radicale/htpasswd
    htpasswd_encryption = bcrypt

    [storage]
    filesystem_folder = /var/lib/radicale/collections
    '';
  };

  services.nginx.virtualHosts."dav.clerie.de" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:61865";
      extraConfig = ''
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header  Host $host;
        proxy_pass_header Authorization;
      '';
    };
  };
}