Configure Radicale with Pangolin, Traefik and Basic Auth

Radicale is an open-source CalDAV and CardDAV server that offers a simple way to manage calendars, to-do lists, and contact information. It is designed for users who value privacy and prefer to host their own synchronization service. It provides a self-hosted alternative to proprietary services, emphasizing user control and data security.

In this guide, we will show you how to configure Radicale and Traefik to

Prepare your radicale instance

First of all, follow the guide to install Radicale or deploy a docker container.

Then, you need to configure Radicale to authenticate users with the X-Remote-User header.

[auth]
type = http_x_remote_user

htpasswd_filename = /etc/radicale/users

htpasswd_encryption = bcrypt # needs https://pypi.org/project/bcrypt/ if not dockerized !

Don’t forget to add a file listing your users !

test:$2a$10$ug7bOqmAYtpYIWadkhVTZOszZMPzQiJvjTVNEEoZN3vZCe88ORhi6 # test

Configure Traefik

Now, you need to add a ressource to Pangolin as usual.

Then, connect to your VPS and add the following to the Trafik dynamic configuration :

http:
  middlewares:
  # ...
    basic-auth:
      basicAuth:
        users: # copy from the radicale users file
          - test:$2a$10$ug7bOqmAYtpYIWadkhVTZOszZMPzQiJvjTVNEEoZN3vZCe88ORhi6
        headerField: "X-Remote-User" #

  routers:
  # ...
    radicale:
      entryPoints:
        - websecure
      middlewares:
        - security-headers
        - basic-auth
        # - crowdsec # if you have not added this middleware globally
        # - geoblock # same as crowdsec
      rule: Host(`radicale.example.com`)
      priority: 50 # higher than the one automatically added by pangolin
      service: 1-service@http # check the Traefik dashboard to find it
      tls:
        certresolver: letsencrypt
  # ...

Connect a client

You can use DAVx⁵ on your phone to synchronize your calandar and your contacts.

I hope this guide has been useful !