Initial commit

Dockerfile

@@ -0,0 +1,27 @@
+# syntax=docker/dockerfile:1
+FROM python:3.14-slim AS base
+
+# bcrypt is needed for htpasswd auth; kept out of the default deps because the
+# CLI does not need it.
+RUN pip install --no-cache-dir bcrypt
+
+WORKDIR /app
+COPY pyproject.toml README.md ./
+COPY src ./src
+RUN pip install --no-cache-dir .
+
+# The vault is bind-mounted at /vault; the sidecar index lives at /data so it is
+# never written inside the user's notes.
+ENV MDCALDAV_CONFIG=/config/mdcaldav.toml \
+    PYTHONUNBUFFERED=1
+
+EXPOSE 5232
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import urllib.request,sys; \
+sys.exit(0 if urllib.request.urlopen('http://localhost:5232/', timeout=4).status < 500 else 1)" \
+    || exit 1
+
+# Stock Radicale loads our storage plugin by name. Running Radicale directly
+# (rather than `mdcaldav serve`) keeps every Radicale option available.
+CMD ["radicale", "--config", "/config/radicale.conf"]