{nglib, ...}: let
  htpasswd_location = "/radicale_htpasswd";
in {
  dinit.enable = true;

  init.services.radicale = {
    shutdownOnExit = true;

    tmpfiles = with nglib.nottmpfiles.dsl; [
      (f htpasswd_location "-" "radicale" "radicale" _ "pim:$apr1$GUiTihkS$dDCkaUxFx/O86m6NCy/yQ.")
    ];
  };

  services.radicale = {
    enable = true;

    settings = {
      server = {
        hosts = "0.0.0.0:5232, [::]:5232";
        ssl = false;
      };

      encoding = {
        request = "utf-8";
        stock = "utf-8";
      };

      auth = {
        realm = "Radicale - Password Required";
        type = "htpasswd";
        htpasswd_filename = htpasswd_location;
        htpasswd_encryption = "md5";
      };

      rights.type = "owner_only";

      storage = {
        type = "multifilesystem";
        filesystem_folder = "/data";
      };

      logging = {};
      headers = {};
    };
  };
}