Martin Weinelt
cff7a27cfe
We now explain what Radicale even is and classify reusing the hashed passwords of login accounts as limitation because it requires using compatible password hashes. This is difficult because compatible password hashes need an overlap between libxcrypt and Radicales choice of libraries: libpass, argon2 and bcrypt. Extract the source code into a proper .nix file so we get source linting and formatting for free. Pruned from bad practices of the past, like global `with lib`.
56 lines
1.0 KiB
Nix
56 lines
1.0 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib)
|
|
concatStrings
|
|
flip
|
|
mapAttrsToList
|
|
;
|
|
|
|
mailAccounts = config.mailserver.loginAccounts;
|
|
htpasswd = pkgs.writeText "radicale.users" (
|
|
concatStrings (flip mapAttrsToList mailAccounts (mail: user: "${mail}+:${user.hashedPassword}\n"))
|
|
);
|
|
|
|
in
|
|
{
|
|
services.radicale = {
|
|
enable = true;
|
|
settings = {
|
|
auth = {
|
|
type = "htpasswd";
|
|
htpasswd_filename = "${htpasswd}";
|
|
htpasswd_encryption = "bcrypt";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"cal.example.com" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:5232/";
|
|
extraConfig = ''
|
|
proxy_set_header X-Script-Name /;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_pass_header Authorization;
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
}
|