Skip to content

This chapter is geared towards advanced users. Solid tech skills are required.

Contacts, calendars & tasks

Radicale calendar

Radicale is a self-hosted contact, calendar and task management solution. It doesn't boast a wide array of features, but excels at what it does. Radicale is FOSS and supports various clients.

heart No ads • No tracking • Full data ownership heart


Radicale installation

Installation

Follow the instructions below to resolve all dependencies and install Radicale on your server.

Show me the step-by-step guide

Prerequisite

Radicale requires Python to run. Log into the server and install the following packages:

sudo apt install python3 python3-pip

Installation

Install Radicale:

sudo -H python3 -m pip install --upgrade radicale

Next, create a system user which will run Radicale. For the purpose of this tutorial, we'll call this system user radicaleadmin. Of course, you can choose any name, just make sure to adjust the commands accordingly:

sudo useradd --system --home-dir / --shell /sbin/nologin radicaleadmin

No need for a database, just create a folder where Radicale's data is stored in plain files:

sudo mkdir -p /var/lib/radicale/collections
Show me a summary video


Radicale configuration

Configuration

After successfully installing Radicale, we're going to configure a number of settings such as multi-user support, permissions, autostart and so on. More details below.

Show me the step-by-step guide

Users

Radicale supports multiple users. Each one can have its own set of calendars, contacts and task lists. Access can be secured by user credentials, which are stored in an encrypted file on the server.

Install the following packages to enable encryption:

sudo -H python3 -m pip install --upgrade passlib bcrypt

Next, create a directory to store user credentials:

sudo mkdir /var/www/radicale

Finally, create a first user account with the command below, using the -c flag. Replace $USER with the actual user name. When prompted, enter a strong, unique password:

sudo htpasswd -B -c /var/www/radicale/users $USER

As an illustration, let's create three users — Georg, Lenina and Tom:

sudo htpasswd -B -c /var/www/radicale/users Georg
sudo htpasswd -B /var/www/radicale/users Lenina
sudo htpasswd -B /var/www/radicale/users Tom

Note how we used the -c flag to create the first user Georg, and then removed the flag to create additional users Lenina and Tom.

Finally, verify that all user credentials have been correctly added:

sudo cat /var/www/radicale/users

The terminal should prompt something similar to:

Georg:$2y$05$Zsb8MYlKjRr2InVi/IQNtustqfdnHWN14uG9jNNhx1g rF7a/8Cg6
Lenina:$2y$05$Hh2Y8nrikm 9f1Pz8LrOFe K5NR HlL0Qz3Yvv gupSBgIr4lT0bi
Tom:$2y$05$1BnHnXCqNHXZtWMiFhnxBOpYM9xeVnZXm70SoTclEfsrI JPSvDVy

Settings

Create a directory containing all settings:

sudo mkdir /etc/radicale

Open the configuration:

sudo vi /etc/radicale/config

Add or modify the following lines:

[server]
hosts               = 0.0.0.0:5232, [::]:5232
max_connections     = 20
max_content_length  = 10000000
timeout             = 10

[auth]
type                = http_x_remote_user
htpasswd_filename   = /var/www/radicale/users
htpasswd_encryption = bcrypt
delay               = 5

[storage]
filesystem_folder   = /var/lib/radicale/collections

Some additional information about those settings:

Setting Description
hosts Allow remote access to calendars and contacts.
max_connections Limit the number of parallel connections to 20.
max_content_length Limit the file size to 1 MB. Important for large contact photos.
timeout Terminate connections after 10 seconds.
type Enable authentication with the reverse proxy. Radicale uses the user name provided in the X-Remote-User HTTP header.
htpasswd_filename Provide the location where usernames and passwords are stored. In this setup, that's /var/www/radicale/users.
htpasswd_encryption Provide the method used to encrypt usernames and passwords. In this setup, it's bcrypt.
delay Set the delay after a failed login attempt to 5 seconds, to avert brute force attacks.
filesystem_folder Provide the location where Radicale stores data. In this setup, that's /var/lib/radicale/collections.

Permissions

We'll imit access to the user radicaleadmin for the directories /var/lib/radicale (contains the data), /var/www/radicale (contains encrypted user credentials) and /etc/radicale (contains settings):

sudo chown -R radicaleadmin:radicaleadmin /var/lib/radicale
sudo chmod -R 700 /var/lib/radicale

sudo chown -R radicaleadmin:radicaleadmin /var/www/radicale
sudo chmod -R 755 /var/www/radicale

sudo chown -R radicaleadmin:radicaleadmin /etc/radicale
sudo chmod -R 700 /etc/radicale

In addition, let's grant permissions to site-packages. This is required to allow the user radicaleadmin to run Radicale as a systemd service, due to the fact that we previously enforced stricter permissions by setting umask to 027.

sudo chmod -R go+rX /usr/local/lib/python3.8/dist-packages

Autostart

Make sure Radicale automatically starts at every system boot. Create a configuration file:

sudo vi /etc/systemd/system/radicale.service

Add the following content (adjust accordingly):

[Unit]
Description=A simple CalDAV (calendar) and CardDAV (contact) server
After=network.target
Requires=network.target

[Service]
ExecStart=/usr/bin/env python3 -m radicale
Restart=on-failure
User=radicaleadmin
Group=radicaleadmin
UMask=027
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
NoNewPrivileges=true
ReadWritePaths=/var/lib/radicale/collections

[Install]
WantedBy=multi-user.target

Let's make sure Radicale automatically starts everytime the server boots:

sudo systemctl daemon-reload
sudo systemctl enable radicale

Reboot the server:

sudo reboot

Make sure Radicale is up and running (the status should be"Active"):

sudo systemctl status radicale
Show me a summary video


Radicale web interface

Web interface

We are going to set up an Apache Virtual Host as a Reverse Proxy to access Radicale's web interface. Read on below for more details on how to set this up.

Show me the step-by-step guide

Create an Apache configuration file:

sudo vi /etc/apache2/sites-available/myradicale.gofoss.duckdns.org.conf

Add the following content and make sure to adjust the settings to your own setup, such as domain names, path to SSL keys, IP addresses and so on:

<VirtualHost *:80>

ServerName              myradicale.gofoss.duckdns.org
ServerAlias             www.myradicale.gofoss.duckdns.org
Redirect permanent /    https://myradicale.gofoss.duckdns.org/

</VirtualHost>

<VirtualHost *:443>

ServerName              myradicale.gofoss.duckdns.org
ServerAlias             www.myradicale.gofoss.duckdns.org
ServerSignature         Off

SecRuleEngine           Off
SSLEngine               On
SSLProxyEngine          On
SSLProxyCheckPeerCN     Off
SSLCertificateFile      /etc/dehydrated/certs/gofoss.duckdns.org/fullchain.pem
SSLCertificateKeyFile   /etc/dehydrated/certs/gofoss.duckdns.org/privkey.pem

<Location />
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
    Allow from 192.168.1.0/24
    Allow from 10.8.0.1/24
</Location>

RewriteEngine On
RewriteRule ^/radicale$ /radicale/ [R,L]

<Location "/radicale/">
    AuthType      Basic
    AuthName      "Radicale - Password Required"
    AuthUserFile  "/var/www/radicale/users"
    Require       valid-user

    ProxyPass        http://localhost:5232/ retry=0
    ProxyPassReverse http://localhost:5232/
    RequestHeader    set X-Script-Name /radicale/
RequestHeader    set X-Remote-User expr=%{REMOTE_USER}
</Location>

ErrorLog ${APACHE_LOG_DIR}/myradicale.gofoss.duckdns.org-error.log
CustomLog ${APACHE_LOG_DIR}/myradicale.gofoss.duckdns.org-access.log combined

</VirtualHost>

Once the content is added, save and close the file (:wq!).

Note how we enable SSL encryption with the instruction SSLEngine On, and use the SSL certicate /etc/dehydrated/certs/gofoss.duckdns.org/fullchain.pem as well as the private SSL key /etc/dehydrated/certs/gofoss.duckdns.org/privkey.pem, which were created earlier on.

Also note how we disabled ModSecurity in the Apache configuration file with the instruction SecRuleEngine Off, as Radicale and ModSecurity don't play well together.

Next, enable the Apache Virtual Host and reload Apache:

sudo a2ensite myradicale.gofoss.duckdns.org.conf
sudo systemctl reload apache2

Configure Pi-Hole to resolve Radicale's local address. Browse to https://mypihole.gofoss.duckdns.org and log into Pi-Hole's web interface (adjust accordingly). Navigate to the menu entry Local DNS Records and add the following domain/IP combination (adjust accordingly):

DOMAIN:      myradicale.gofoss.duckdns.org
IP ADDRESS:  192.168.1.100

Browse to https://myradicale.gofoss.duckdns.org/radicale and log in with valid credentials. Then create calendars, addressbooks and task lists as required.

Show me a summary video

In this video, we set up the web interface, create an addressbook and calendar for Georg, and a task list for Lenina.


Radicale clients

Clients

Open F-Droid and install DAVx⁵. Alternatively, you can find the app on Aurora Store or Google's Play Store. DAVx⁵ natively integrates with your phone's calendar, contact and task apps to keep them synchronised with Radicale. Further instructions below.

Settings Description
Launch DAVx⁵ Open the DAVx⁵ app and disable battery optimisation when prompted.
Create new account Tap on the + sign to create a new account. Select Login with URL and user name.
Base URL Provide the address of the Radicale server. In our example, that's https://myradicale.gofoss.duckdns.org/radicale, adjust accordingly.
User & Password Provide valid user credentials. In our example, valid users are Georg, Lenina or Tom. Adjust accordingly.
Contact group method On the next screen, select Groups are separate VCards.
Create account Click on Create account.

Radicale works well with Thunderbird's desktop clients on Windows, macOS or Linux. Refer to the previous chapter on email clients for detailed install instructions.

Once installed, open Thunderbird, navigate to Tools ‣ Add-ons and install the Cardbook extention. Finally, restart Thunderbird.

Clients must have a working VPN access

Clients must be connected to the server via VPN to access Radicale.


Radicale get started

Get started

Import contacts

Your existing contacts are likely scattered all over the place. Follow below instructions to import them to Radicale.

Show me a step-by-step guide

Instructions Description
Step 1 Head over to devices or cloud services where your contacts are stored (Google, Microsoft, Apple, and so on). Export them in the vCard format (.vcf).
Step 2 Backup up the .vcf files.
Step 3 Transfer the various .vcf files to your Android phone.
Step 4 Open the stock Contacts app on your phone. If you use another contact app, instructions might slightly change.
Step 5 Go to Settings ‣ Import.
Step 6 Select Import contacts from .vcf file.
Step 7 Browse to the .vcf files location and select one.
Step 8 Select Save imported contacts to DAVx⁵ and choose the appropriate Radicale addressbook.
Step 9 Repeat until all contacts have been imported.

Synchronise contacts

Follow below instructions to synchronise contacts between Radicale and your phone. Once synchronised, all changes made on the phone will be mirrored to the Radicale server and other connected devices, and the other way round.

Show me a step-by-step guide

Instructions Description
Step 1 On your Android phone, open DAVx⁵'s main screen and select an account.
Step 2 Navigate to the CardDAV tab and select Radicale's addressbooks to be synched with the phone.
Step 3 Click on the synchronisation button.
Step 4 Make sure everything worked. Open your phone's Contacts app and click on Settings ‣ Accounts. Radicale's addressbooks should show up here.

Follow below instructions to synchronise contacts between Radicale and Thunderbird. Once synchronised, all changes made in Thunderbird will be mirrored to the Radicale server and other connected devices, and the other way round.

Show me a step-by-step guide

Instructions Description
Step 1 Log into https://myradicale.gofoss.duckdns.org/radicale (adjust accordingly).
Step 2 Navigate to the addressbook you want to synchronise and copy it's URL link.
Step 3 Open Thunderbird and navigate to Cardbook ‣ Address book ‣ New Address Book.
Step 4 Follow the setup wizzard:
Location: Remote
Type: CardDAV
URL:Paste the URL link to the addressbook, as copied previously
Username & Password: Provide valid Radicale user credentials
Properties: Provide the addressbook's name, color, offline availability, etc.
Step 5 Make sure everything worked. Radicale's addressbook should show up in the CardBook tab.

Import calendars

Your existing calendars are likely scattered all over the place. Follow below instructions to import them to Radicale.

Show me a step-by-step guide

Instructions Description
Step 1 Head over to devices or cloud services where your calendars are stored (Google, Microsoft, Apple, and so on). Export them in the iCalendar format (.ics).
Step 2 Backup up the .ics files.
Step 3 Transfer the various .ics files to your Android phone.
Step 4 On your phone, open F-Droid and install the Calendar Import-Export app. Alternatively, install the app from Google's Play Store
Step 5 Open the Calendar Import-Export app and click on Import files.
Step 6 Browse to the .ics files location and select one.
Step 7 Import to DAVx⁵ and choose the appropriate Radicale calendar.
Step 8 Repeat until all calendars have been imported.

Synchronise calendars

Follow below instructions to synchronise calendars between Radicale and your phone. Once synchronised, all changes made on the phone will be mirrored to the Radicale server and other connected devices, and the other way round.

Show me a step-by-step guide

Instructions Description
Step 1 On your Android phone, open DAVx⁵'s main screen and select an account.
Step 2 Navigate to the CalDAV tab and select Radicale's calendars to be synched with the phone.
Step 3 Click on the synchronisation button.
Step 4 Install and open the Simple Calendar app on your phone. If you use another calendar app, the following instructions might slightly change.
Step 5 Click on Settings and make sure the option CalDAV sync is enabled.
Step 6 Click on Manage synched calendars. Radicale's calendars should show up here.
Step 7 Select Radicale's calendars and click on OK.

Follow below instructions to synchronise calendars between Radicale and Thunderbird. Once synchronised, all changes made in Thunderbird will be mirrored to the Radicale server and other connected devices, and the other way round.

Show me a step-by-step guide

Instructions Description
Step 1 Log into https://myradicale.gofoss.duckdns.org/radicale (adjust accordingly).
Step 2 Navigate to the calendar you want to synchronise and copy it's URL link.
Step 3 Open Thunderbird and navigate to File ‣ New ‣ Calendar.
Step 4 Follow the setup wizzard:
Create a new calendar: On the Network
Format: CalDAV (do not select iCalendar (ICS)!)
Username: Provide a valid Radicale username
Location:Paste the URL link to the calendar, as copied previously
Offline support: Check the box
Customisation: Provide the calendar's name & color, enable reminders, associate an email address to manage invitations, etc.
Step 5 Make sure everything worked. Radicale's calendar should show up in the Calendar tab.

Synchronise tasks

Follow below instructions to synchronise tasks between Radicale and your phone. Once synchronised, all changes made on the phone will be mirrored to the Radicale server and other connected devices, and the other way round.

Show me a step-by-step guide

Instructions Description
Step 1 On your Android phone, open DAVx⁵'s main screen and select an account.
Step 2 Navigate to the CalDAV tab and select Radicale's task lists to be synched with the phone.
Step 3 Click on the synchronisation button.
Step 4 Install and open the Tasks.org app on your phone. If you use another tasks app, the following instructions might slightly change.
Step 5 Click on Settings and select Displayed Lists. Radicale's task lists should show up here.

Follow below instructions to synchronise task lists between Radicale and Thunderbird. Once synchronised, all changes made in Thunderbird will be mirrored to the Radicale server and other connected devices, and the other way round.

Show me a step-by-step guide

Instructions Description
Step 1 Log into https://myradicale.gofoss.duckdns.org/radicale (adjust accordingly).
Step 2 Navigate to the task list you want to synchronise and copy it's URL link.
Step 3 Open Thunderbird and navigate to File ‣ New ‣ Calendar.
Step 4 Follow the setup wizzard:
Create a new calendar: On the Network
Format: CalDAV (do not select iCalendar (ICS)!)
Username: Provide a valid Radicale username
Location:Paste the URL link to the calendar, as copied previously
Offline support: Check the box
Customisation: Provide the task list's name & color, enable reminders. No need to add an email address.
Step 5 Make sure everything worked. Radicale's task list should show up in the Calendar tab.

Backup

Regularly perform backups to avoid any data loss! While Radicale is great, it's not totally immune to errors. Contacts, calendars and tasks remain synchronised as long as your devices stay connected with the server over VPN. But sometimes synchronisation errors can occur, for example when changes aren't properly saved or devices get disconnected. Users might also inadvertedly delete information, and once this is synchronised accross the server and all devices the data is gone forever.

To perform manual backups, log into https://myradicale.gofoss.duckdns.org/radicale (adjust accordingly) and click on the URL links of addressbooks, calendars and tasks to download your data. You can also perform automatic backups of the directories /var/lib/radicale, /var/www/radicale and /etc/radicale.


Radicale support

Support

For further reference, consult Radicale's, DAVx⁵'s or Thunderbird's documentation.


Radicale