Radicale master master master v3 v2 v1

as normal user ¶

Recommended only for testing - open a console and type:

# Run the following command to only install for the current user
python3 -m pip install --user --upgrade https://github.com/Kozea/Radicale/archive/master.tar.gz

If install is not working and instead error: externally-managed-environment is displayed, create and activate a virtual environment in advance

python3 -m venv ~/venv
source ~/venv/bin/activate

and try to install with

python3 -m pip install --upgrade https://github.com/Kozea/Radicale/archive/master.tar.gz

Start the service manually, data is stored only for the current user

# Start, data is stored for the current user only
python3 -m radicale --storage-filesystem-folder=~/.var/lib/radicale/collections

as system user (or as root) ¶

Alternative one can install and run as system user or as root (not recommended)

# Run the following command as root (not required)
# or non-root system user (can require --user in case of dependencies are not available system-wide and/or virtual environment)
python3 -m pip install --upgrade https://github.com/Kozea/Radicale/archive/master.tar.gz

Start the service manually, data is stored in a system folder

# Start, data is stored in a system folder (requires write permissions to /var/lib/radicale/collections)
python3 -m radicale --storage-filesystem-folder=/var/lib/radicale/collections --auth-type none

common ¶

Victory! Open http://localhost:5232 in your browser! You can log in with any username and password (no authentication is required as long as not proper configured - INSECURE).

The secure way ¶

The users file can be created and managed with htpasswd:

Note: some OS contain unpatched htpasswd (< 2.4.59) without supporting SHA-256 or SHA-512 (e.g. Ubuntu LTS 22), in this case use '-B' for "bcrypt" hash method or stay with insecure MD5 (default) or SHA-1 ('-s').

Note that support of SHA-256 or SHA-512 was introduced with 3.1.9

# Create a new htpasswd file with the user "user1" using SHA-512 as hash method
$ htpasswd -5 -c /path/to/users user1
New password:
Re-type new password:
# Add another user
$ htpasswd -5 /path/to/users user2
New password:
Re-type new password:

Authentication can be enabled with the following configuration:

[auth]
type = htpasswd
htpasswd_filename = /path/to/users
htpasswd_encryption = autodetect

The simple but insecure way ¶

Create the users file by hand with lines containing the username and password separated by :. Example:

user1:password1
user2:password2

Authentication can be enabled with the following configuration:

[auth]
type = htpasswd
htpasswd_filename = /path/to/users
# encryption method used in the htpasswd file
htpasswd_encryption = plain

hosts ¶

A comma separated list of addresses that the server will bind to.

Default: localhost:5232

max_connections ¶

The maximum number of parallel connections. Set to 0 to disable the limit.

Default: 8

max_content_length ¶

The maximum size of the request body. (bytes)

Default: 100000000

timeout ¶

Socket timeout. (seconds)

Default: 30

ssl ¶

Enable transport layer encryption.

Default: False

certificate ¶

Path of the SSL certifcate.

Default: /etc/ssl/radicale.cert.pem

key ¶

Path to the private key for SSL. Only effective if ssl is enabled.

Default: /etc/ssl/radicale.key.pem

certificate_authority ¶

Path to the CA certificate for validating client certificates. This can be used to secure TCP traffic between Radicale and a reverse proxy. If you want to authenticate users with client-side certificates, you also have to write an authentication plugin that extracts the username from the certificate.

Default: (unset)

protocol ¶

(>= 3.3.1)

Accepted SSL protocol (maybe not all supported by underlying OpenSSL version) Example for secure configuration: ALL -SSLv3 -TLSv1 -TLSv1.1 Format: Apache SSLProtocol list (from "mod_ssl")

Default: (system default)

ciphersuite ¶

(>= 3.3.1)

Accepted SSL ciphersuite (maybe not all supported by underlying OpenSSL version) Example for secure configuration: DHE:ECDHE:-NULL:-SHA Format: OpenSSL cipher list (see also "man openssl-ciphers")

Default: (system-default)

script_name ¶

(>= 3.5.0)

Strip script name from URI if called by reverse proxy

Default: (taken from HTTP_X_SCRIPT_NAME or SCRIPT_NAME)

request ¶

Encoding for responding requests.

Default: utf-8

stock ¶

Encoding for storing local collections

Default: utf-8

type ¶

The method to verify usernames and passwords.

Available backends:

none : Just allows all usernames and passwords.

denyall (>= 3.2.2) : Just denies all usernames and passwords.

htpasswd : Use an Apache htpasswd file to store usernames and passwords.

remote_user : Takes the username from the REMOTE_USER environment variable and disables HTTP authentication. This can be used to provide the username from a WSGI server which authenticated the client upfront. Required to validate, otherwise client can supply the header itself which is unconditionally trusted then.

http_x_remote_user : Takes the username from the X-Remote-User HTTP header and disables HTTP authentication. This can be used to provide the username from a reverse proxy which authenticated the client upfront. Required to validate, otherwise client can supply the header itself which is unconditionally trusted then.

ldap (>= 3.3.0) : Use a LDAP or AD server to authenticate users by relaying credentials from client and handle result.

dovecot (>= 3.3.1) : Use a Dovecot server to authenticate users by relaying credentials from client and handle result.

imap (>= 3.4.1) : Use an IMAP server to authenticate users by relaying credentials from client and handle result.

oauth2 (>= 3.5.0) : Use an OAuth2 server to authenticate users by relaying credentials from client and handle result. Oauth2 authentication (SSO) directly on client is not supported. Use herefore http_x_remote_user in combination with SSO support in reverse proxy (e.g. Apache+mod_auth_openidc).

pam (>= 3.5.0) : Use local PAM to authenticate users by relaying credentials from client and handle result..

Default: none (< 3.5.0) denyall (>= 3.5.0)

cache_logins ¶

(>= 3.4.0)

Cache successful/failed logins until expiration time. Enable this to avoid overload of authentication backends.

Default: false

cache_successful_logins_expiry ¶

(>= 3.4.0)

Expiration time of caching successful logins in seconds

Default: 15

cache_failed_logins_expiry ¶

(>= 3.4.0)

Expiration time of caching failed logins in seconds

Default: 90

htpasswd_filename ¶

Path to the htpasswd file.

Default: /etc/radicale/users

htpasswd_encryption ¶

The encryption method that is used in the htpasswd file. Use the htpasswd or similar to generate this files.

Available methods:

plain : Passwords are stored in plaintext. This is obviously not secure! The htpasswd file for this can be created by hand and looks like:

user1:password1
user2:password2

bcrypt : This uses a modified version of the Blowfish stream cipher. It's very secure. The installation of bcrypt is required for this.

md5 : This uses an iterated MD5 digest of the password with a salt (nowadays insecure).

sha256 (>= 3.1.9) : This uses an iterated SHA-256 digest of the password with a salt.

sha512 (>= 3.1.9) : This uses an iterated SHA-512 digest of the password with a salt.

autodetect (>= 3.1.9) : This selects autodetection of method per entry.

Default: md5 (< 3.3.0) autodetect (>= 3.3.0)

htpasswd_cache ¶

(>= 3.4.0)

Enable caching of htpasswd file based on size and mtime_ns

Default: False

delay ¶

Average delay after failed login attempts in seconds.

Default: 1

realm ¶

Message displayed in the client when a password is needed.

Default: Radicale - Password Required

ldap_uri ¶

(>= 3.3.0)

The URI to the ldap server

Default: ldap://localhost

ldap_base ¶

(>= 3.3.0)

LDAP base DN of the ldap server. This parameter must be provided if auth type is ldap.

Default:

ldap_reader_dn ¶

(>= 3.3.0)

The DN of a ldap user with read access to get the user accounts. This parameter must be provided if auth type is ldap.

Default:

ldap_secret ¶

(>= 3.3.0)

The password of the ldap_reader_dn. Either this parameter or ldap_secret_file must be provided if auth type is ldap.

Default:

ldap_secret_file ¶

(>= 3.3.0)

Path of the file containing the password of the ldap_reader_dn. Either this parameter or ldap_secret must be provided if auth type is ldap.

Default:

ldap_filter ¶

(>= 3.3.0)

The search filter to find the user DN to authenticate by the username. User '{0}' as placeholder for the user name.

Default: (cn={0})

ldap_user_attribute ¶

(>= 3.4.0)

The LDAP attribute whose value shall be used as the user name after successful authentication

Default: not set, i.e. the login name given is used directly.

ldap_groups_attribute ¶

(>= 3.4.0)

The LDAP attribute to read the group memberships from in the authenticated user's LDAP entry.

If set, load the LDAP group memberships from the attribute given These memberships can be used later on to define rights. This also gives you access to the group calendars, if they exist.

• The group calendar will be placed under collection_root_folder/GROUPS
• The name of the calendar directory is the base64 encoded group name.
• The group calendar folders will not be created automatically. This must be done manually. In the LDAP-authentication section of Radicale's wiki you can find a script to create a group calendar.

Use 'memberOf' if you want to load groups on Active Directory and alikes, 'groupMembership' on Novell eDirectory, ...

Default: (unset)

ldap_use_ssl ¶

(>= 3.3.0)

Use ssl on the ldap connection

Default: False

ldap_ssl_verify_mode ¶

(>= 3.3.0)

The certificate verification mode. NONE, OPTIONAL or REQUIRED

Default: REQUIRED

ldap_ssl_ca_file ¶

(>= 3.3.0)

The path to the CA file in pem format which is used to certificate the server certificate

Default:

ldap_ignore_attribute_create_modify_timestamp ¶

(>= 3.5.1)

Add modifyTimestamp and createTimestamp to the exclusion list of internal ldap3 client so that these schema attributes are not checked. This is needed at least for Authentik LDAP server as not providing these both attributes.

Default: false

dovecot_connection_type = AF_UNIX ¶

(>= 3.4.1)

Connection type for dovecot authentication (AF_UNIX|AF_INET|AF_INET6)

Note: credentials are transmitted in cleartext

Default: AF_UNIX

dovecot_socket ¶

(>= 3.3.1)

The path to the Dovecot client authentication socket (eg. /run/dovecot/auth-client on Fedora). Radicale must have read / write access to the socket.

Default: /var/run/dovecot/auth-client

dovecot_host ¶

(>= 3.4.1)

Host of via network exposed dovecot socket

Default: localhost

dovecot_port ¶

(>= 3.4.1)

Port of via network exposed dovecot socket

Default: 12345

imap_host ¶

(>= 3.4.1)

IMAP server hostname: address | address:port | [address]:port | imap.server.tld

Default: localhost

imap_security ¶

(>= 3.4.1)

Secure the IMAP connection: tls | starttls | none

Default: tls

oauth2_token_endpoint ¶

(>= 3.5.0)

OAuth2 token endpoint URL

Default:

pam_service ¶

(>= 3.5.0)

PAM service

Default: radicale

pam_group_membership ¶

(>= 3.5.0)

PAM group user should be member of

Default:

lc_username ¶

Сonvert username to lowercase, must be true for case-insensitive auth providers like ldap, kerberos

Default: False

Note: cannot be enabled together with uc_username

uc_username ¶

(>= 3.3.2)

Сonvert username to uppercase, must be true for case-insensitive auth providers like ldap, kerberos

Default: False

Note: cannot be enabled together with lc_username

strip_domain ¶

(>= 3.2.3)

Strip domain from username

Default: False

type ¶

The backend that is used to check the access rights of collections.

The recommended backend is owner_only. If access to calendars and address books outside the home directory of users (that's /USERNAME/) is granted, clients won't detect these collections and will not show them to the user. Choosing any other method is only useful if you access calendars and address books directly via URL.

Available backends:

authenticated : Authenticated users can read and write everything.

owner_only : Authenticated users can read and write their own collections under the path /USERNAME/.

owner_write : Authenticated users can read everything and write their own collections under the path /USERNAME/.

from_file : Load the rules from a file.

Default: owner_only

file ¶

File for the rights backend from_file. See the Rights section.

permit_delete_collection ¶

(>= 3.1.9)

Global control of permission to delete complete collection (default: True)

If False it can be permitted by permissions per section with: D If True it can be forbidden by permissions per section with: d

permit_overwrite_collection ¶

(>= 3.3.0)

Global control of permission to overwrite complete collection (default: True)

If False it can be permitted by permissions per section with: O If True it can be forbidden by permissions per section with: o

type ¶

The backend that is used to store data.

Available backends:

multifilesystem : Stores the data in the filesystem.

multifilesystem_nolock : The multifilesystem backend without file-based locking. Must only be used with a single process.

Default: multifilesystem

filesystem_folder ¶

Folder for storing local collections, created if not present.

Default: /var/lib/radicale/collections

filesystem_cache_folder ¶

(>= 3.3.2)

Folder for storing cache of local collections, created if not present

Default: (filesystem_folder)

Note: only used in case of use_cache_subfolder_* options are active

Note: can be used on multi-instance setup to cache files on local node (see below)

use_cache_subfolder_for_item ¶

(>= 3.3.2)

Use subfolder collection-cache for cache file structure of 'item' instead of inside collection folders, created if not present

Default: False

Note: can be used on multi-instance setup to cache 'item' on local node

use_cache_subfolder_for_history ¶

(>= 3.3.2)

Use subfolder collection-cache for cache file structure of 'history' instead of inside collection folders, created if not present

Default: False

Note: use only on single-instance setup, will break consistency with client in multi-instance setup

use_cache_subfolder_for_synctoken ¶

(>= 3.3.2)

Use subfolder collection-cache for cache file structure of 'sync-token' instead of inside collection folders, created if not present

Default: False

Note: use only on single-instance setup, will break consistency with client in multi-instance setup

use_mtime_and_size_for_item_cache ¶

(>= 3.3.2)

Use last modifiction time (nanoseconds) and size (bytes) for 'item' cache instead of SHA256 (improves speed)

Default: False

Note: check used filesystem mtime precision before enabling

Note: conversion is done on access, bulk conversion can be done offline using storage verification option radicale --verify-storage

folder_umask ¶

(>= 3.3.2)

Use configured umask for folder creation (not applicable for OS Windows)

Default: (system-default, usual 0022)

Useful value: 0077 (user:rw group:- other:-) or 0027 (user:rw group:r other:-) or 0007 (user:rw group:rw other:-) or 0022 (user:rw group:r other:r)

max_sync_token_age ¶

Delete sync-token that are older than the specified time. (seconds)

Default: 2592000

skip_broken_item ¶

(>= 3.2.2)

Skip broken item instead of triggering an exception

Default: True

hook ¶

Command that is run after changes to storage. Take a look at the Versioning with Git tutorial for an example.

Default:

Supported placeholders:

• %(user)s: logged-in user
• %(cwd)s: current working directory (>= 3.5.1)
• %(path)s: full path of item (>= 3.5.1)

Command will be executed with base directory defined in filesystem_folder (see above)

predefined_collections ¶

Create predefined user collections

Example:

 {
   "def-addressbook": {
      "D:displayname": "Personal Address Book",
      "tag": "VADDRESSBOOK"
   },
   "def-calendar": {
      "C:supported-calendar-component-set": "VEVENT,VJOURNAL,VTODO",
      "D:displayname": "Personal Calendar",
      "tag": "VCALENDAR"
   }
 }

Default:

type ¶

The backend that provides the web interface of Radicale.

Available backends:

none : Just shows the message "Radicale works!".

internal : Allows creation and management of address books and calendars.

Default: internal

level ¶

Set the logging level.

Available levels: debug, info, warning, error, critical

Default: warning (< 3.2.0) info (>= 3.2.0)

mask_passwords ¶

Don't include passwords in logs.

Default: True

bad_put_request_content ¶

(>= 3.2.1)

Log bad PUT request content (for further diagnostics)

Default: False

backtrace_on_debug ¶

(>= 3.2.2)

Log backtrace on level=debug

Default: False

request_header_on_debug ¶

(>= 3.2.2)

Log request on level=debug

Default: False

request_content_on_debug ¶

(>= 3.2.2)

Log request on level=debug

Default: False

response_content_on_debug ¶

(>= 3.2.2)

Log response on level=debug

Default: False

rights_rule_doesnt_match_on_debug ¶

Log rights rule which doesn't match on level=debug

Default: False

storage_cache_actions_on_debug ¶

(>= 3.3.2)

Log storage cache actions on level=debug

Default: False

type ¶

Hook binding for event changes and deletion notifications.

Available types:

none : Disabled. Nothing will be notified.

rabbitmq (>= 3.2.0) : Push the message to the rabbitmq server.

Default: none

rabbitmq_endpoint ¶

(>= 3.2.0)

End-point address for rabbitmq server. Ex: amqp://user:password@localhost:5672/

Default:

rabbitmq_topic ¶

(>= 3.2.0)

RabbitMQ topic to publish message.

Default:

rabbitmq_queue_type ¶

(>= 3.2.0)

RabbitMQ queue type for the topic.

Default: classic

max_freebusy_occurrence ¶

(>= 3.2.3)

When returning a free-busy report, a list of busy time occurrences are generated based on a given time frame. Large time frames could generate a lot of occurrences based on the time frame supplied. This setting limits the lookup to prevent potential denial of service attacks on large time frames. If the limit is reached, an HTTP error is thrown instead of returning the results.

Default: 10000

Linux shell scripts ¶

Use the flock utility.

# Exclusive
$ flock --exclusive /path/to/storage/.Radicale.lock COMMAND
# Shared
$ flock --shared /path/to/storage/.Radicale.lock COMMAND

Linux and MacOS ¶

Use the flock syscall. Python provides it in the fcntl module.

Windows ¶

Use LockFile for exclusive access or LockFileEx which also supports shared access. Setting nNumberOfBytesToLockLow to 1 and nNumberOfBytesToLockHigh to 0 works.