diff --git a/.gitignore b/.gitignore
index 1a098d1..0425b73 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
-migration-from-old-files/
\ No newline at end of file
+migration-from-old-files/
+migration-from-docker/
\ No newline at end of file
diff --git a/clusters/base/apps/radicale/configmap.yaml b/clusters/base/apps/radicale/configmap.yaml
new file mode 100644
index 0000000..b5672c7
--- /dev/null
+++ b/clusters/base/apps/radicale/configmap.yaml
@@ -0,0 +1,44 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radicale-config
+  namespace: radicale
+data:
+  # storage.hook (the git-commit-per-change hook in the old compose setup)
+  # called out to a webhooks sidecar that isn't part of this deployment yet,
+  # so it's dropped here rather than pointing at a script that doesn't exist.
+  config: |
+    [server]
+    hosts = 0.0.0.0:5232
+    ssl = False
+
+    [auth]
+    type = htpasswd
+    htpasswd_filename = /config/users
+    htpasswd_encryption = bcrypt
+
+    [rights]
+    type = owner_only
+    # file = /config/rights
+
+    [storage]
+    type = multifilesystem
+    filesystem_folder = /data/collections
+
+    [headers]
+    Access-Control-Allow-Origin = *
+    Access-Control-Allow-Methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK
+    Access-Control-Allow-Headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With
+    Access-Control-Expose-Headers: Etag, Preference-Applied
+  rights: |
+    # read access to root collection for all users
+    [all-read-root-collection]
+    user = .+
+    collection =
+    permission = r
+
+    # write access to own files for each user
+    [owner-write]
+    user: .+
+    collection: ^%(login)s(/.+)?$
+    permission: rw
diff --git a/clusters/base/apps/radicale/helmrelease.yaml b/clusters/base/apps/radicale/helmrelease.yaml
new file mode 100644
index 0000000..bdadb19
--- /dev/null
+++ b/clusters/base/apps/radicale/helmrelease.yaml
@@ -0,0 +1,74 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: radicale
+  namespace: radicale
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: app-template
+  values:
+    controllers:
+      radicale:
+        containers:
+          app:
+            image:
+              repository: tomsquest/docker-radicale
+              tag: "3.7.6.0"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: radicale
+        ports:
+          http:
+            port: 5232
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: configMap
+        name: radicale-config
+        globalMounts:
+          - path: /config/config
+            subPath: config
+            readOnly: true
+          - path: /config/rights
+            subPath: rights
+            readOnly: true
+      users:
+        type: secret
+        name: radicale-secrets
+        globalMounts:
+          - path: /config/users
+            subPath: users
+            readOnly: true
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        globalMounts:
+          - path: /data
diff --git a/clusters/base/apps/radicale/helmrepository.yaml b/clusters/base/apps/radicale/helmrepository.yaml
new file mode 100644
index 0000000..f692354
--- /dev/null
+++ b/clusters/base/apps/radicale/helmrepository.yaml
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: app-template
+  namespace: radicale
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"
diff --git a/clusters/base/apps/radicale/kustomization.yaml b/clusters/base/apps/radicale/kustomization.yaml
new file mode 100644
index 0000000..e99a21d
--- /dev/null
+++ b/clusters/base/apps/radicale/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - configmap.yaml
+  - helmrelease.yaml
diff --git a/clusters/base/apps/radicale/secret.enc.yaml b/clusters/base/apps/radicale/secret.enc.yaml
new file mode 100644
index 0000000..f29841d
--- /dev/null
+++ b/clusters/base/apps/radicale/secret.enc.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: radicale-secrets
+    namespace: radicale
+stringData:
+    users: ENC[AES256_GCM,data:8o+1aX07mOgu3es/j6n9K4/xTGcj9D9yaGLiwiDWe42uGIlIzbGFFcHNfukw+Z9O6wfOCDZmWnDORWvNtXbwDKDabqT6c8+kZPDGp8pjmQELYRSKJyPMVk1tYAnU6y+A7FhogbN9ixmhbj1L6OpOb9KPHaeMjBj/+cnz4MaU0FKg522ejn57EA==,iv:BmDbKyDv7kQSJwhLEHHKAZEbS0n/NqyEfToTn8esY6o=,tag:DaQ5WWSNZGBFPZqZnsQ59Q==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWUxieThVa3k5a1J1eTNY
+            WGJGWGs3T2JZZFZidXBSVWV0bThSOHhpWkc0CkRZUk1LczVvMCsvL2I1V0J4cjhw
+            ZEVoWUxpS2xiaXhuSVZUckdtWmJyMGMKLS0tIFVFWXJkU1dFemg0aDI2cVZ6eFlO
+            YzZLQXNyZU9VUFExaStzNmpWWDcxSncKr2rkVly2OblJ4T4cgXH85vNBtE4inZuL
+            mUVNmc3uw5TFiFp2j6x2AoM1dDE3fSFLMyPBlnVn/vvuMjayw1ipnw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-07-19T13:08:04Z"
+    mac: ENC[AES256_GCM,data:Yxa8ndMoFRBh1kOzsbjrUGloVm8tnAbEsHIRucP3OZOxfp711eXB5D0dGTaAPKoTDKx8Kj7AoM2v9QsAUHIVe3s6gQ+tU3DI49FyB/Ie5xSijRmCHFFMUi/Tb8HMWsbDQpFQdDC0e8PW08DIjk9wPhgXN7YDO7myRTEUB/P3A10=,iv:iK0nhutsXpt0L11tG1rWQJS0n4TTApjYp401yyeogkg=,tag:SOCmAkcfn88o/jb9ZraZlg==,type:str]
+    version: 3.13.2
diff --git a/clusters/base/namespaces/radicale.yaml b/clusters/base/namespaces/radicale.yaml
new file mode 100644
index 0000000..899b712
--- /dev/null
+++ b/clusters/base/namespaces/radicale.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: radicale
diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml
index 648c908..bd48e79 100644
--- a/clusters/home/apps/kustomization.yaml
+++ b/clusters/home/apps/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ../../base/apps/vaultwarden
   - ../../base/apps/zigbee2mqtt
+  - ../../base/apps/radicale
diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml
index 9ee8217..f8d230e 100644
--- a/clusters/home/namespaces/kustomization.yaml
+++ b/clusters/home/namespaces/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ../../base/namespaces/vaultwarden.yaml
   - ../../base/namespaces/zigbee2mqtt.yaml
+  - ../../base/namespaces/radicale.yaml