{ den, ... }:
{
  lux.services._.radicale = den.lib.perHost (
    { host }:
    {
      nixos =
        { config, ... }:
        {
          services.radicale = {
            enable = true;
            settings = {
              server.hosts = [ "127.0.0.1:5232" ];

              auth = {
                type = "htpasswd";
                htpasswd_filename = "/var/lib/radicale/users";
                htpasswd_encryption = "bcrypt";
              };

              storage.filesystem_folder = "/var/lib/radicale/collections";
            };
          };

          services.caddy.virtualHosts."radicale.${host.serviceDomain}".extraConfig = ''
            reverse_proxy :5232 {
               header_up X-Script-Name /
               header_up X-Forwarded-For {remote}
               header_up X-Remote-User {http.auth.user.id}
            }'';
        };
    }
  );
}