{ config, ... }:
{
  users.users.radicale.extraGroups = [ "lldap" ];

  services.radicale = {
    enable = true;
    settings = {
      server = {
        hosts = [ "${config.tailnetIPs.pinix}:5002" ];
      };
      auth = {
        type = "ldap";
        ldap_uri = "ldap://${config.tailnetIPs.blunix}:3890";
        ldap_base = config.ldapBaseDN;
        ldap_reader_dn = "uid=admin,ou=people,${config.ldapBaseDN}";
        ldap_secret_file = config.age.secrets.lldapAdmin.path;
      };
      storage = {
        filesystem_folder = "/var/lib/radicale/collections";
      };
    };
    rights = {
      "00-root" = {
        user = ".+";
        collection = "";
        permissions = "R";
      };
      "10-shared-principal" = {
        user = ".+";
        collection = "calendar";
        permissions = "R";
      };
      "20-shared-calendar-authenticated" = {
        user = ".+";
        collection = "calendar/public";
        # All authenticated users can edit events, but cannot delete or
        # overwrite the shared collection itself.
        permissions = "rwdo";
      };
      "30-principal" = {
        user = ".+";
        collection = "{user}";
        permissions = "RW";
      };
      "40-calendars" = {
        user = ".+";
        collection = "{user}/[^/]+";
        permissions = "rw";
      };
      "90-public-calendar" = {
        user = ".*";
        collection = "calendar/public";
        permissions = "r";
      };
      # lukas's personal "Kalender" collection (Apple-CalDAV-generated UUID,
      # not the DEFAULT_TASK_CALENDAR_NAME one). Fragile: if this calendar
      # is ever deleted and recreated in a CalDAV client, it gets a new
      # random UUID and this rule silently stops matching -- re-check the
      # UUID under /var/lib/radicale/collections/collection-root/lukas/ if
      # the public feed goes empty after a client-side calendar reset.
      "91-lukas-calendar-public" = {
        user = ".*";
        collection = "lukas/C6327392-6961-4753-A333-97ACE0A7CC82";
        permissions = "r";
      };
    };
  };
}