{ config, ... }:
{
  flake.modules.nixos.radicale = {
    imports = [ config.flake.modules.nixos.caddy ];

    services.radicale = {
      enable = true;
      settings = {
        server.hosts = [ "127.0.0.1:5232" ];

        auth = {
          type = "htpasswd";
          htpasswd_filename = "/var/lib/radicale/users";
          htpasswd_encryption = "bcrypt";
        };
      };
    };

    services.caddy.virtualHosts.${config.facts.services.radicale.domain}.extraConfig = ''
      reverse_proxy 127.0.0.1:5232 {
        header_up X-Script-Name /
        header_up X-Remote-User {http.auth.user.id}
      }
    '';
  };
}