Martin Weinelt
e9337b346f
The "login" prefix makes this option more confusing rather than clearer, because what other account types are there? LDAP ones for example, but you can login with those too, so the prefix is pointless.
56 lines
1.0 KiB
Nix
56 lines
1.0 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib)
|
|
concatStrings
|
|
flip
|
|
mapAttrsToList
|
|
;
|
|
|
|
mailAccounts = config.mailserver.accounts;
|
|
htpasswd = pkgs.writeText "radicale.users" (
|
|
concatStrings (flip mapAttrsToList mailAccounts (mail: user: "${mail}+:${user.hashedPassword}\n"))
|
|
);
|
|
|
|
in
|
|
{
|
|
services.radicale = {
|
|
enable = true;
|
|
settings = {
|
|
auth = {
|
|
type = "htpasswd";
|
|
htpasswd_filename = "${htpasswd}";
|
|
htpasswd_encryption = "bcrypt";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"cal.example.com" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:5232/";
|
|
extraConfig = ''
|
|
proxy_set_header X-Script-Name /;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_pass_header Authorization;
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
}
|