helm/profiles/radicale/default.nix

{ config, lib, pkgs, ... }:
{
  services.radicale = {
    enable = true;
    package = pkgs.radicale;
    settings = {
      server.hosts = [ "0.0.0.0:5252" ];
    };
  };

  networking.firewall.allowedTCPPorts = [ 5252 ];

  services.nginx.virtualHosts."cal.mossnet.lan" = {
    enableACME = false;
    forceSSL = false;

    locations."/" = {
      extraConfig = ''
        proxy_pass http://localhost:5252/;
        proxy_set_header X-Forwarded-Host $host;
      '';
    };
  };
}