From 12f9714e3e2a6ca333cdce6a65355f76c89c8360 Mon Sep 17 00:00:00 2001
From: "pulsar89.5" <pulsar89.5@ykn.fr>
Date: Sun, 8 Nov 2026 17:45:26 +0100
Subject: [PATCH] Manage rights

---
 defaults/main.yml          | 25 +++++++++++++++++++++++++
 tasks/main.yml             | 12 ++++++++++++
 templates/radicale.conf.j2 |  5 +++++
 templates/rights.j2        |  8 ++++++++
 4 files changed, 50 insertions(+)
 create mode 100644 templates/rights.j2

diff --git a/defaults/main.yml b/defaults/main.yml
index 3019d30..8d27937 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -8,3 +8,28 @@ radicale_users: []
 # Example:
 #  - name: toto
 #    password: <secret>
+# password is either the plain-text password, hashed at deploy time (SHA-512
+# crypt, stable per-user salt so the file stays idempotent), or an existing
+# htpasswd hash ($apr1$, bcrypt $2y$, $5$, $6$, argon2), written as is.
+
+# Access rights. Empty: built-in "owner_only" model. Otherwise a rights file is
+# deployed and used ("from_file"); sections are evaluated in order, the first
+# matching one wins. See https://radicale.org/v3.html#authorization-and-rights
+radicale_rights: []
+# Example (same as owner_only, plus anonymous GET on one calendar):
+#  - name: root
+#    user: ".+"
+#    collection: ""
+#    permissions: R
+#  - name: principal
+#    user: ".+"
+#    collection: "{user}"
+#    permissions: RW
+#  - name: calendars
+#    user: ".+"
+#    collection: "{user}/[^/]+"
+#    permissions: rw
+#  - name: public
+#    user: ".*"
+#    collection: "toto/public"
+#    permissions: i
diff --git a/tasks/main.yml b/tasks/main.yml
index 045c46c..836857c 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -50,6 +50,7 @@
     group: "{{ radicale_user }}"
     mode: u=rw,g=r,o=
   become: true
+  diff: false
   notify: Restart radicale.service
 
 - name: Deploy configuration file
@@ -61,3 +62,14 @@
     mode: u=rw,g=r,o=
   become: true
   notify: Restart radicale.service
+
+- name: Deploy rights file
+  ansible.builtin.template:
+    src: rights.j2
+    dest: "{{ radicale_root_path }}/rights"
+    owner: root
+    group: "{{ radicale_user }}"
+    mode: u=rw,g=r,o=
+  become: true
+  when: radicale_rights | length > 0
+  notify: Restart radicale.service
diff --git a/templates/radicale.conf.j2 b/templates/radicale.conf.j2
index 5ae3b91..3387cc8 100644
--- a/templates/radicale.conf.j2
+++ b/templates/radicale.conf.j2
@@ -12,7 +12,12 @@ stock=utf-8
 level=debug
 
 [rights]
+{% if radicale_rights | length > 0 %}
+type=from_file
+file={{ radicale_root_path }}/rights
+{% else %}
 type=owner_only
+{% endif %}
 
 [server]
 hosts=0.0.0.0:5232, [::]:5232
diff --git a/templates/rights.j2 b/templates/rights.j2
new file mode 100644
index 0000000..25af1f0
--- /dev/null
+++ b/templates/rights.j2
@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+{% for rule in radicale_rights %}
+
+[{{ rule.name }}]
+user: {{ rule.user }}
+collection: {{ rule.collection }}
+permissions: {{ rule.permissions }}
+{% endfor %}