Radicale: document client setup, allow anonymous well-known discovery - #377
Open
micbar wants to merge 1 commit into
Open
Radicale: document client setup, allow anonymous well-known discovery#377micbar wants to merge 1 commit into
micbar wants to merge 1 commit into
Conversation
Clients were left guessing the CalDAV/CardDAV URLs (issue #192): the README documented how to deploy Radicale but not how to connect to it. - Add radicale/README.md with client URLs (trailing slash required), the App-Token requirement (account passwords are rejected with the default PROXY_ENABLE_BASIC_AUTH=false), GNOME Online Accounts and Thunderbird walkthroughs, and troubleshooting. - Mark the two '/.well-known/*' proxy routes as unprotected so DAV clients can run RFC 6764 service discovery before authenticating. Previously the proxy answered 401 where clients expect the 301 redirect to /caldav/ or /carddav/. Radicale serves no data on these paths (deeper paths return 404, path traversal is normalized onto the protected routes), verified against opencloud 7.5.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #192
The README documented how to deploy Radicale but not how clients connect to it, so users ended up guessing URLs (and hitting the web UI or 401s). Verified the full request matrix against a stock deployment (opencloud 7.5.0 +
radicale/radicale.yml), details in #192 analysis comment.Changes
radicale/README.md(new)
client setup guide — the CalDAV/CardDAV URLs (
/caldav/,/carddav/, trailing slash required: without it the proxy prefix route doesn't match and requests land on the web UI), the App-Token requirement (with the defaultPROXY_ENABLE_BASIC_AUTH=falseaccount passwords are rejected with 401 while App Tokens work out of the box — verified), GNOME Online Accounts and Thunderbird walkthroughs, troubleshooting table.config/opencloud/proxy.yaml
mark the two
/.well-known/*routesunprotected: trueso DAV clients can run RFC 6764 service discovery before authenticating. Previously the proxy answered 401 where discovery expects the 301 redirect. Verified:GET/PROPFIND /.well-known/caldav|carddav→301to/caldav///carddav//.well-known/caldav/<uuid>/) →404; path traversal (/.well-known/caldav/../../caldav/) is normalized by the router onto the protected/caldav/route →401X-Remote-Userheader is overwritten by the proxy on authenticated routes (accountResolversets the header unconditionally) and is irrelevant on the well-known routes (redirect only)PROPFIND /caldav///carddav/still207with correctcurrent-user-principalREADME.md
the "With Radicale" section now states the client URLs and links to the new guide.
Not included
Slash-less routes (
/caldavwithout trailing slash) were tested and deliberately left out: Radicale 500s onPROPFINDfor the bare script root, which is worse than the current well-defined fall-through. Documented instead.