radicale: deploy on kube

.github/dependabot.yml

@@ -57,6 +57,7 @@ updates:
       - "/kubernetes/personal/notes/notesnook"
       - "/kubernetes/personal/notes/obsidian-livesync"
       - "/kubernetes/personal/paperless"
+      - "/kubernetes/personal/radicale"
       - "/kubernetes/production/buildpath"
       - "/kubernetes/production/semery-fr"
       - "/kubernetes/production/umami"

kubernetes/kustomization.yaml

@@ -33,6 +33,7 @@ resources:
   - home/zigbee2mqtt
   # Personal (apps storing my own content, grouped by content type)
   - personal/paperless
+  - personal/radicale
   - personal/media/photoprism
   - personal/notes/notesnook
   - personal/notes/obsidian-livesync

kubernetes/personal/radicale/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: radicale
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: radicale-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/personal/radicale/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/personal/radicale/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: radicale
+  labels:
+    app.kubernetes.io/name: radicale
+    app.kubernetes.io/component: caldav-carddav

kubernetes/personal/radicale/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: radicale
+  namespace: radicale
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: derwitt
+        namespace: radicale
+      chart: radicale
+      version: "2.1.0"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: radicale-values

kubernetes/personal/radicale/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: derwitt
+  namespace: radicale
+spec:
+  interval: 1h
+  url: https://charts.derwitt.dev

kubernetes/personal/radicale/values.yaml

@@ -0,0 +1,60 @@
+# Radicale CalDAV/CardDAV server
+# The chart uses the official rootless ghcr.io/kozea/radicale image with a
+# hardened securityContext by default (non-root, read-only rootfs, all caps dropped).
+replicaCount: 1
+env:
+    - name: TZ
+      value: ENC[AES256_GCM,data:aOeUzoi3PC8rjf8A,iv:xJpXljsxr61EhJvy6YiZU5mFXdWij6LCsQE8FIOgGZw=,tag:QMV8RzHlOilzTG45smv0yg==,type:str]
+config:
+    # No authentication, LAN-only exposure behind Traefik. 
+    auth:
+        type: none
+ingress:
+    enabled: true
+    className: traefik
+    annotations:
+        external-dns.alpha.kubernetes.io/enabled: "true"
+    hosts:
+        - host: radicale.lan
+          paths:
+            - path: /
+              pathType: Prefix
+persistence:
+    data:
+        enabled: true
+        className: longhorn
+        size: 5Gi
+        accessMode: ReadWriteOnce
+resources:
+    requests:
+        cpu: 50m
+        memory: 128Mi
+    limits:
+        cpu: 500m
+        memory: 256Mi
+sops:
+    lastmodified: "2026-08-24T19:16:53Z"
+    mac: ENC[AES256_GCM,data:o9/Kj3saNHqymzpAgJH+vpA5YiiHxE/XW4QUbG5mdndGgxqsLqTTp2vRdzwE11tj0hGxe3dHKv/DgMhcHllMcvBnJk30JZcj5UqK3LioCfozXNpveL56vsq61ZvjZf71sfgXqQT0CfzMRxqj9DG5WhEUGcKmwTbI4RZFFNWsOSM=,iv:msO8/hPrfzVm3Pp4CJswmTQX6uiAsOBN2hF5JKMxKTs=,tag:0PlvpRQpkXYx+WP+IZwh2w==,type:str]
+    pgp:
+        - created_at: "2026-08-24T19:16:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAvad1UZD+8o8EnpkOIAEcYMhJPbS0c8rAZHC7vHJdK1gn
+            Q5UZOSmRuGffXeD1oUOADM4ozDmKqq4wRl6doomky4MCXLb5FojgOoaUwzm/Sx+9
+            YeqWob1DQCSnlF/Dksj5wFnm1amAK8XXIJc5nelwoYSMH8Xby2ZnyzTEmfWcPFul
+            8IVrSEv2/JrJfmSU1ogXrKvVe+hrQ+Qixi5JTpmMYtUD8LiZMGCsK4VRVN3N7ie+
+            CgTx+OTb8G53h9DwVbVh8ct1rTlBB4EJBzN7bRDPrgu/mTtw2h/Rb9YfGfJ/tDDH
+            TFfgpVaeYkhTOxZwGosRztaD/qLBoSoiRZc3ZDU/fyD677PtkX6KHyxpNLSZThH6
+            XbSi2n6LTpDXFQbo6OtHtOMdn7B/wXAE+IErWeRx2RbO0MF3bM7p9x/ahXl+0BTm
+            U6q3+bsDmkdNN2TWUXuCPcIhtu9dwNZLewbxVcus3zrOmiEpR8jZWcOzp42QJeE4
+            kcXptlPNzSlGyjB3Oll/uIhaKiKKonIQq7W3w+LHuJi1bO5qDbQjb1L89Rm/hlW4
+            h4OssMz4pkeqsEcDyo2vCXYJ4cyrnUSeOTgiS6NOeVxHe+deVbTsW+ScLh55CGmh
+            ANiG7cJO7Dp8soIvaw6hpj6RiIA5Ifi6mGp2SCoXtOk06JPuskUKzdHFeZejobzS
+            XgEqYjYCIJY+/R2eiC+n8eGrCrGTZ1kQrbCTQnoZjdEJe0vKbIY89o6I/oMvxqSl
+            X+qzUG+vbdTboV3svUqjNBv2vX/hMr1OSvrfyEnncaqc2Gmika5eaDtl0bPYy7k=
+            =TQys
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    version: 3.10.2

kubernetes/system/coredns/zone-configmap.yaml

@@ -39,7 +39,6 @@ data:
     n8n             IN  A   10.1.2.212
     proxy           IN  A   10.1.2.212
     radarr          IN  A   10.1.2.212
-    radicale        IN  A   10.1.2.212
     sonarr          IN  A   10.1.2.212
     stirling-pdf    IN  A   10.1.2.212
     syncthing-valentin IN  A   10.1.2.212