radicale

clusters/base/apps/radicale/configmap.yaml

@@ -0,0 +1,44 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radicale-config
+  namespace: radicale
+data:
+  # storage.hook (the git-commit-per-change hook in the old compose setup)
+  # called out to a webhooks sidecar that isn't part of this deployment yet,
+  # so it's dropped here rather than pointing at a script that doesn't exist.
+  config: |
+    [server]
+    hosts = 0.0.0.0:5232
+    ssl = False
+
+    [auth]
+    type = htpasswd
+    htpasswd_filename = /config/users
+    htpasswd_encryption = bcrypt
+
+    [rights]
+    type = owner_only
+    # file = /config/rights
+
+    [storage]
+    type = multifilesystem
+    filesystem_folder = /data/collections
+
+    [headers]
+    Access-Control-Allow-Origin = *
+    Access-Control-Allow-Methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK
+    Access-Control-Allow-Headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With
+    Access-Control-Expose-Headers: Etag, Preference-Applied
+  rights: |
+    # read access to root collection for all users
+    [all-read-root-collection]
+    user = .+
+    collection =
+    permission = r
+
+    # write access to own files for each user
+    [owner-write]
+    user: .+
+    collection: ^%(login)s(/.+)?$
+    permission: rw

clusters/base/apps/radicale/helmrelease.yaml

@@ -0,0 +1,74 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: radicale
+  namespace: radicale
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: app-template
+  values:
+    controllers:
+      radicale:
+        containers:
+          app:
+            image:
+              repository: tomsquest/docker-radicale
+              tag: "3.7.6.0"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: radicale
+        ports:
+          http:
+            port: 5232
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: configMap
+        name: radicale-config
+        globalMounts:
+          - path: /config/config
+            subPath: config
+            readOnly: true
+          - path: /config/rights
+            subPath: rights
+            readOnly: true
+      users:
+        type: secret
+        name: radicale-secrets
+        globalMounts:
+          - path: /config/users
+            subPath: users
+            readOnly: true
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        globalMounts:
+          - path: /data

clusters/base/apps/radicale/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: app-template
+  namespace: radicale
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/radicale/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - configmap.yaml
+  - helmrelease.yaml

clusters/base/apps/radicale/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: radicale-secrets
+    namespace: radicale
+stringData:
+    users: ENC[AES256_GCM,data:H1oE1jDfgArBjJlrDhMOMnd3Mrc2Mc+2jFJKz6srZ4NKI8u3K8vf3JmoZFK6XA/8CTUp5Rvpd+O459Spau8XZ4M+H0MqukCEVKWiMkuSS/tNuac2vGI2PufeIz6GR1HlpUWMfrnPr3SUDnp9bE3B1djkZk7w91HJLv/+GomyDffLcQkJF3q/jA==,iv:1iRIQ5g/crLYsJ/2csPxmXkyqG5oJUONY7zWmuHZbBc=,tag:sytxP8qgs/+7S3AZo8aC1A==,type:str]
+sops:
+    age:
+        - recipient: age1nqjekn6qk8uqunyv5cl88nx9g3y8a94h5qr0u53q5dsdsmhr7g2syy6fsd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTC9nZjd2RjJqUHlBaUwz
+            OEl4Vlhud1lVK3gwZ3RWb0s4eUNZWmFqQTBJCjFNQlpTRGNFTUpoTC9idU1nNlA1
+            UTVWaVJMY2hjMllKVEZSQUtvZGJCVGMKLS0tIEM0dGUrQWlRVzRRb1lvaTBCYjRM
+            T0MrSTJGcVk5ZFFjbStsVzM2VlNhYW8KBbevNTC/FymllcC5doSpn5xkfiOSBwMH
+            TG9dkscqQV86acTtouqexc/3UmpRwZhFqVelY4AbCs5hB0a/v0V1dg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:17:44Z"
+    mac: ENC[AES256_GCM,data:lE1WLOkSRXqetZG5260aSS7ZbhsuJaX3MxgtpyAKdycq9bm1uSv/S4GHDy7elIbNTlXPtUPwNmT+SrWskc+1hoeRdLHxknZwGr/mLHrBFXQhyvH1uKj0i5pYAFhce74HpW25TZGTue1POsC3VjAateU1qMAJly0fZuqt78PEDcU=,iv:mzw8iijCix0SFV/bjyswEZ3Xh55VvKCvjOjiLkDy0uo=,tag:dJ/j/i62/fDo7oqgxyLCxA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:ZSi9ncwQt1hF89l00We38ZVpj6aZSdLM1Y0p8nFeKk/fpwvZ9EHP+eZsC1sqzU0eM14TVFZMY0/s,iv:HDHYINHS11OCEBYggNrHbYVydk8uR1We1Na/q8oCS30=,tag:s09J6DNSX97/YvJaKpdasA==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:qAoDEzwuADkdgydaberlQ9G6Vfnl5xG0Ff1ERn4F5HK6okP0x5o7bAnbEhRJ5aJfPE/x0+POVT0EQU9REYA0jYyZtRS8Ntszb/NiIH39uaRRzkZ4wrcHQR8aMIcWp81j4NnUp7iGL7j01H58dIY4ABmNSoV7lA==,iv:B2izY/vJqtqXpAUeyZPBBIH8nKhWeiv9c52gyMM1wvY=,tag:bJE43ntkkDv3l1alBjuhwA==,type:str]
+    #ENC[AES256_GCM,data:AffIDcVKgZnTtLbbqx2PFZriPuccC//Lmy+PSx0VNQY1OLAwdE7ESFI1qlSx82PsDlUhCM0b7j/L,iv:OS26G7ChoAeM7xzjeK/oLg2pfMRnFFQi81otUPZq1vM=,tag:8L2tA86nGFR718l3KainTw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:zEXMwyWmiLXyuAqc3hFkWwBwuXtiiNWi36hlTQgvr3U+TCiJEJIiUPHK4ry8NHS4wZKlJJWZ41vlPyuP/Jr+8beFXlk4oZbPhRvNa/DTk2N1eKUd/ykLPyMkmwa2t119S12OIHqoQkfSkZ0X6VX3e91XqelYLA==,iv:xxoOP4qOrQKG6RfVY0ZelGoY63+oUlTr/V9XoHQykAs=,tag:0cNu4mGVnz9dBZgYoBCa9w==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETG1pVE50Q0JPMVdEdGhz
-            NmZzdGRDNkNpUUdNSld1ZjdvK0ZKSm96VzJ3ClpldzFxMWpoa3FmODF0amQ4Nkpq
-            Mit2dENsSGZmaHBsemEwc0I3VzdZYVEKLS0tIGsvRjRCZWQ0WkU2WVROQ2Z0bThj
-            eVplbElrRjFXV240MytFM3JxZldxYXMKaTSYz4rprKWo8gIyNAIBmrS0QOkL4NCZ
-            sMo4kzEI6J6fI9uHwBtYQ5xk70EZw/XGo9JWeGxriZ1CduJqW9J7kQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYZmVvbHp2MkcyVlJZQmZB
+            N0k2Rk9lak9PYVVudldJcGc2ZmhkaTl4NDFzCnVWSlRYc04zWHVkbUc1aVhjdnYw
+            YmorczRsYjdybFg5Y3RpUnV0Y2NKdTgKLS0tIGMxUXFkd0hMandMcFFPQktlOEVD
+            YWRyZVM3NGdrb2YwNGRyNUR4SFlMZGsK228mMCi6+cgQu4JEnRjJqcuIrpTPTq5Y
+            xHlyFMwo73UMQg5pzGok2yfi3ObhCD0GNtWeTHBu56SsDDaUJXPG6A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:17:41Z"
-    mac: ENC[AES256_GCM,data:jw0L50e5SL/geTLLM0X53Coaxte2/cG481bsK79UZGzV8MnpXm1XkXa8gXN+8P4X5N4stFoVFMM537IAiI23yNVvp5pzfzqBAgZgvHyJn1bwJA/Rv9Gehf1unrQX32xXpNPO13D8S04kGfCansLoIrfoYVrhKnxp6K8drBl9zq4=,iv:Xyc+LWHXnbxsZMPiISw3mc6dyTaO+YO3FFnWh5wYRFo=,tag:y5YSLUswbo6jl06B0f6ZzA==,type:str]
+    lastmodified: "2026-08-26T10:17:45Z"
+    mac: ENC[AES256_GCM,data:hKPS2DWW4w8m4s7BWuUUjJKBsvRqHp6lp7qPeDmRyVOW44EqX+pusLDpvkBNAeAcwpz/2FvuPw8vkTc+z4EhGtqUy2k3pbwsC7cKJ6DyM/3kvdtoDrh+yerKUQymgYVW0PhMLjAWeCD//Ja5auhoPJ6O59QAH58xT3eHd/f5cSc=,iv:uC5F+y76Hh8HM7+EzML3G9ACLMREkHcpFEBSfOjMT54=,tag:8edRfJi/JQPAWqZdEAUeqg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:x9YutASbHeMTPsm9wTaxuOMNzvvAJIhKwUYkS3s7rTpYgqVsMVtVLjDtbxW8V9iTOkdL2GhqpXHkuIPY77TFJ+IwB6dm321v1JjUonc48BQv/Qfqq9vNJdxnzZeQwd0RiD4Irdk38ZxUxxja+3MVKOfmGC9XGuzsoU+lFpI=,iv:SxoJzEwvpIC4DgEIuo1x7kAl7NBvb/gjBVeVThlI7KA=,tag:bXyEc9HBuHycRtfm2huoJQ==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:8WWBEvJf1wO/f7hZYC1oL1kNdJ2cScytgL4OyYv1MM3r3JY5ctiyQi3BTTGMPlSeAkZ+K0wR6gj8v4s6+++TWzxkrRE1rv4WrVstxE0xPYg+qg4ZavwjsQ+g/QbXKSRbfYnBuva9gm/gsN2E286wS6JMiNlRiqWPtRYIqQE=,iv:/Ux9xf1cCKxvrh1h+kD5iEv4vTnYzkVuJ4BrMgU427c=,tag:7KcNdy5fpi/VzI11bh2DwA==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eXVjTVpUWGg5RUxRNUpS
-            OEg5eWVCSzYzenQvNGpDb3hpRHV0MGlQVndZCmVPZGU0NndJdDMrblc0MDhyUUlC
-            dG1OdzBPZ3Y0ci9TZ0dxMksxZUFZeUkKLS0tIGttMUt3d3Y1b2pyb3JEL2RvMGlN
-            amxpQkVkWW5Lay9XZ3NJcjQrbVlyVkEKG9hRHgo9WBbJELiEZ1rQ653LNgbm/jz5
-            NqCt+kNx3oGoRFMibEsuqRV4MYNNL/epv+RPpg56LxghY0jQ6rFKjg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4cEdha2JyYXRrZlFRZlgw
+            RERhTVBVVjJYYURoaDFZMFJacVZJSFNwVlFnCkcydHRkRlQyMDlPR0wraDZCTnpp
+            cit3em5FYklnWFA5QXUyNEZlZkVvMGsKLS0tIEVLVFA1d0Z4dnoxWlpDMzd6MklH
+            TCtFMG8vdFg1cFlrbTFITFdQc0RTTm8K7Okh3TGaLLua7GpqAEMMvk2S6IKrMIGs
+            XcmPGAHvLEkgDy+TOUp5LKYxhhu2C9zoO/mYvseYeqECKzqtuzX3fA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:17:42Z"
-    mac: ENC[AES256_GCM,data:Ehu/yxV7LfmZoMoY1xD6NUi/53goQOk3d+FYEBnii+TZKJNzpm5ftSiuuKPjT7K4CQnQuZQd5whOT7UuzFiaDiRRloN4b0RXgS0I6oHKUE0CoBjtJL3oo091+PrMACoo4c4XHkePpE6vCg3hWbiy58z3MMM2kGvJA584+GznaL0=,iv:7cGMgW2fP8M3lqhMKHHhmivWN84iAhGMtvopBD2Ico4=,tag:9keLGJ/LtOKlh3iyEk6FpQ==,type:str]
+    lastmodified: "2026-08-26T10:17:45Z"
+    mac: ENC[AES256_GCM,data:8wLKvXRK/oC0YY6/+28m8scESchRQEduzjwz+t/diOLJFYqCK+Vn0iPyW8bog48Pnpk8TUoSoHg50D5D1DWzuLtDgvFSzk3UBljwnwgd4wmQe8vplAxTR9XALCxNaeGeR+x3DtrmAlK0ogAi0eMfaHVPsKGRbcQ1iO1GeDYUIUA=,iv:ve7apVK94QhszfZ+5cid0L+g+oCj0lbmSBMnypzPb+g=,tag:e1TE8oLYiUHqh032pdE9Gw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/namespaces/radicale.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: radicale

clusters/home/apps/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ../../base/apps/vaultwarden
   - ../../base/apps/zigbee2mqtt
+  - ../../base/apps/radicale

clusters/home/namespaces/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ../../base/namespaces/vaultwarden.yaml
   - ../../base/namespaces/zigbee2mqtt.yaml
+  - ../../base/namespaces/radicale.yaml