{ config, domain, ... }:
{
  sops.secrets = { 
    "nx2site/radicale-htpasswd" = {};
  };

  services = {
    radicale = {
      server.hosts = let 
        port = builtins.toString 5232;
      in [ "192.168.178.32:${port}" ];
      auth = {
        type = "htpasswd";
        htpasswd_filename = config.sops.secrets."nx2site/radicale-htpasswd".path;
        htpasswd_encryption = "bcrypt";
      };
    };
  };
}