fix for davical /server url path

clusters/base/apps/davical/helmrelease-davical.yaml

@@ -27,6 +27,14 @@ spec:
                 if [ ! -f /mnt/config-pvc/davical.php ]; then
                   cp -r /config/. /mnt/config-pvc/
                 fi
+                # Apache's SCRIPT_NAME (and DAViCal's base_url derived from it)
+                # only reflects the /server prefix if Apache itself resolves
+                # that prefix - Traefik forwards the path unstripped. Add an
+                # Alias so /server/* maps to the app root; idempotent so it
+                # self-heals if apache.conf predates this fix.
+                if ! grep -q '^\s*Alias /server ' /mnt/config-pvc/apache.conf; then
+                  sed -i '/^\s*DocumentRoot \/usr\/share\/davical\/htdocs/a\        Alias /server /usr/share/davical/htdocs' /mnt/config-pvc/apache.conf
+                fi
         containers:
           app:
             image:
@@ -78,8 +86,10 @@ spec:
         # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
         # A second Ingress with the annotation would create a competing
         # Certificate for the same host/secret.
-        annotations:
-          traefik.ingress.kubernetes.io/router.middlewares: pim-davical-stripprefix@kubernetescrd
+        #
+        # No stripPrefix middleware either: Apache needs to see the /server
+        # prefix itself (via the Alias added in the seed-config initContainer)
+        # so that DAViCal's self-referential links come out correct.
         hosts:
           - host: c.aggtaa.com
             paths:

clusters/base/apps/davical/kustomization.yaml

@@ -3,6 +3,5 @@ kind: Kustomization
 resources:
   - helmrepository.yaml
   - secret.enc.yaml
-  - middleware.yaml
   - helmrelease-postgres.yaml
   - helmrelease-davical.yaml

clusters/base/apps/davical/middleware.yaml

@@ -1,9 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: davical-stripprefix
-  namespace: pim
-spec:
-  stripPrefix:
-    prefixes:
-      - /server

clusters/base/apps/davical/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: davical-secrets
     namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:kov7rlxHbjXaoayqP3UhjGPPyagsxA+DutQbuNzMqo41PTa+1AA8cQoZZ5QbkLMp,iv:4hjs8aBgm11Iq9K+wxXDcTG1Ee72I7m8i0s7rGfl9sM=,tag:zuOnX/6y9YAAkk4WkF6HJA==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:UGHf34tRRAVr5A+dHSxYkdDr6vFunjreFIjQsnTV0eiF4cXT96RKZDnWX/tAYzzC,iv:uZLRYgOEgfNbbMBIQI3uVEOr0VtgCCQlwVJxBhNCZPM=,tag:2azyVW6oj5Tz5riN4LEmUA==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:nHWF4fD207skRQsF6ZHloPlXUc6nOBNNSG4By6K84aE=,iv:Pbt4nx1MWmgFh6EltrU3qleng2HZpEynTxc26CGgPMI=,tag:8RK/nzUJJH/lhBeYpWWleQ==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:wjO3esTrwjxbYAZtp4HRGYC5ZDwtf/mffrLQVaylxFAOdKaLylw1UMrnIY+IaWi2,iv:JhqqeHspjHq5zrmXYJVylV4Po8JpTADnu7kxvH9i4VE=,tag:p1/UbYNDP0CtpZTUdMMQEg==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:+xwtbmfk3UuU9BW4Gj890m0ow5Vhi44dplgOzJTlHW1g76Y8UYNa33ZJthroh8u1,iv:r7oSMEmpXaEqe29tkN5YMhGUKGT3pLcAZ8KGUdgVOqc=,tag:bz8I9Sht4mXS48xQ+xq6LQ==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:I8tm4WPCy40BF2cDei44XIolSOtyTHXkqkwXAkD3/uA=,iv:HmQoCl9jPNL/stYrYhFxkupSs8BF+LyERz4Qol8rbH4=,tag:HvO4/BCCKVV24kkRJZOeYQ==,type:str]
 sops:
     age:
         - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMGt3OFhScWI4K2FMeTZS
-            djc2ZXN6emw3dnViQXNpLy9obTBzeStDZzBnClBjcFJjU2hEc2xiRGhMeW5RWFFz
-            TnNvUEhsZm5mWXBVVFI3L2E3S2htUkkKLS0tIHRNQjhIeGZtWlBkWUt6WTFELzQ5
-            TURuSDBJdEZRNFFrWXo3YzdObE9tdU0KFXr6yBqTsrtnWeae+yONQAphX14HmAt8
-            ptypIfbaxaLjtvNw0Dg7p+vPbDkCeLcLKAaIgo/xVnZFAaxJqzCXog==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhV3hmcVdiRm5NWXRXRUFn
+            ZlF0R0l6Vldxa3FoSmJpYUFKWlFRaXFsYVFRCmgyOEdvZmJkMTN5ajJGampGaGw0
+            eFNPeEZMeU5icXpxb1dyOXdTRS95QWsKLS0tIDBiMVFiblVHbElBdGpIL0RVekhD
+            ZTB2dzVUNVBkV2svVENzQ1piOHlxcVEKIro5yzooQiQm91YqLJBPu2attAqPmQzO
+            Dd7+1wE24ksi/2ZOkW41TQEe+6hrjE9x14Ffczza5w1XpGIqje0SQw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:23:55Z"
-    mac: ENC[AES256_GCM,data:vzYxxZE6kkuskQrjC0dHFbTk9fW9S28Vk77qYz9depHmNyTj0jxIhdncGEiI6ymuKIOPdUAnkWnehMB1nnpowVQ5gC7kbxcuhTlhJQy4pEDWEcOq3967+JIKW1yj1/pZSw/+EP7GkL/3WLwhZy6NEajBovOfOxOyYSWiJFlCkrI=,iv:1lUPYy6lMNFVgSS94WRlJAeu7tS/LZjcixfhxYgJD1E=,tag:vcffA2DsUPppBuZGrwNuIg==,type:str]
+    lastmodified: "2026-08-26T10:24:02Z"
+    mac: ENC[AES256_GCM,data:OVYAkLZ/CQtMjs5qI0mFaZ/e9FM7qR5hYruBYgQDJy5vonVHuaxdUyEdVYYd4eLC4MFD/QYnuhsEwh97+ypgVf2esns48ArLERJw4gdJO9FOeFoc9tvCWAj95ui9pXdwRUKSDbEOn8j9rSr5NvH5F6jlhZ6P8P/xkEDjo3w6ElA=,iv:dB08nWzXDvUBJZ4jcGG2OS+dN7bjESQ+9STZ6PLQ1Wk=,tag:WyQEpoBCZ2zpxAPnpID+MA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0