{ config, ... }:
let
  service = config.facts.services.radicale;
in
{
  flake.modules.nixos.radicale = {
    services.radicale = {
      enable = true;
      settings = {
        server.hosts = [ "${service.host}:${toString service.port}" ];

        auth = {
          type = "htpasswd";
          htpasswd_filename = "/var/lib/radicale/users";
          htpasswd_encryption = "bcrypt";
        };

        storage.filesystem_folder = "/var/lib/radicale/collections";
      };
    };

    services.caddy.virtualHosts.${service.domain}.extraConfig = ''
      reverse_proxy :${toString service.port} {
        header_up X-Script-Name /
        header_up X-Forwarded-For {remote}
        header_up X-Remote-User {http.auth.user.id}
      }
    '';
  };
}