# Radicale CalDAV/CardDAV server
# The chart uses the official rootless ghcr.io/kozea/radicale image with a
# hardened securityContext by default (non-root, read-only rootfs, all caps dropped).
replicaCount: 1
env:
    - name: TZ
      value: ENC[AES256_GCM,data:KEcOJfkU2JYAOQv8,iv:DrPCrrhkXja3gst7OJKJ+aWvZiO2+ITw420JBukOR0Q=,tag:uDvIa1XZJGfyoYlikkxJpQ==,type:str]
config:
    # No authentication, LAN-only exposure behind Traefik. 
    auth:
        type: none
ingress:
    enabled: true
    className: traefik
    annotations:
        external-dns.alpha.kubernetes.io/enabled: "true"
    hosts:
        - host: radicale.lan
          paths:
            - path: /
              pathType: Prefix
persistence:
    data:
        enabled: true
        className: longhorn
        size: 5Gi
        accessMode: ReadWriteOnce
resources:
    requests:
        cpu: 50m
        memory: 128Mi
    limits:
        cpu: 500m
        memory: 256Mi
sops:
    lastmodified: "2026-08-26T19:31:54Z"
    mac: ENC[AES256_GCM,data:hbhDZjTboKtyFEjKCghRbcNAD1WTdD+IlayaCWPY40zp0tvb+rvjggF7MvdQNjqjOof0yQpp74eVlH8To0CUqTJQT6g5bCxgttv5jT+T0/Myz/U2T1xz28tMczJapQ/fFg9CoCmElc36ucfLEmbrl9dcdYH01p5zKIQbTxssYFE=,iv:4vt3c1wTcws6BCplDm5bKRtie3xSaVjKpyUhldzg93k=,tag:9EdiEkKVtfcfck2RpnlpVw==,type:str]
    pgp:
        - created_at: "2026-08-26T19:31:54Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ/9G5KO5oSV9/JM8c5nbeKYJ3gEYBkgRyVzWDRYuJnq/pjv
            ryFaMSG9llmIVKEjSkNwrLcnCN0OXRzeeEFKWwm7V5n9qBvLz+wTGaEeFXklpg2Z
            EvAiaWzgUYRTvhFxSx9QXojjdy62Ym0mK8lu/TFtCf8POzvm5zqH26091NK608lo
            mc/XLXVNA5l9iRZbHHeRJC6RxSDheQPop/kx6qn5ZxsCgveHWmolIxkX14ixdMkG
            SHaRmGqJC0jWMhUBXFYvbd/86mEM126XKkQjAzIf54NJNQDoctKMOGbgKfThE5u+
            i7K7K1syTJe03eHCU6SC4u+90jaEjN1QIWr433A4Bna2zVfT2/HEKcfGKmY6TAuR
            PgpsBss+LiMKNHfDTENdmGuiRurXNxVNezk0X2PsYEEdDGJ0JbmxFx2vj0Zhgm1L
            mv4YbqCODcGDwlArRKH72qfnxj0g8ZCjLbZRziGNo/Rbl83T4wQfaWhybE9hXOP7
            QxlGCYutWWd3llRYdWry14TqZxGABnDv/6yDHWjg5wZC3NPd4KQbMptjnb6u3V5m
            rFCJZsRMrCD+84D1EaRu0NLtPCRp0trq0oZ9L2F20UKp1W3n9cTXjBdD2AKYYIG4
            EvhvMmTKiQYjKnD4GQqeiztdIEj3Wwq6eabfjF6lwM8XmWx9OG2Z9jh65jb3xenS
            XAHH/pgI4LF27j6OAglSu5c3l35OWHWV+mlM0LZUevc7GkEvErVJHVTU8iZFN07Y
            JdEi5rzz4wpGEjOaQkcvnSNcCIUUOlg2k1SizCFlYlZMBbmtwafuvQKb7MMC
            =chFT
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2