{
  nglib,
  nixpkgs,
  ...
}:
nglib.makeSystem
(let
  htpasswd_location = "/radicale_htpasswd";
in {
  inherit nixpkgs;
  system = "x86_64-linux";
  name = "nixng-radicale";

  config = {...}: {
    dinit.enable = true;

    init.services.radicale = {
      shutdownOnExit = true;

      tmpfiles = with nglib.nottmpfiles.dsl; [
        (f htpasswd_location "-" "radicale" "radicale" _ "pim:$apr1$GUiTihkS$dDCkaUxFx/O86m6NCy/yQ.")
      ];
    };

    services.radicale = {
      enable = true;

      settings = {
        server = {
          hosts = "0.0.0.0:5232, [::]:5232";
          ssl = false;
        };

        encoding = {
          request = "utf-8";
          stock = "utf-8";
        };

        auth = {
          realm = "Radicale - Password Required";
          type = "htpasswd";
          htpasswd_filename = htpasswd_location;
          htpasswd_encryption = "md5";
        };

        rights.type = "owner_only";

        storage = {
          type = "multifilesystem";
          filesystem_folder = "/data";
        };

        logging = {};
        headers = {};
      };
    };
  };
})