diff --git a/hosts/dav/baikal.nix b/hosts/dav/baikal.nix
new file mode 100644
index 0000000..8b7c5c1
--- /dev/null
+++ b/hosts/dav/baikal.nix
@@ -0,0 +1,24 @@
+{ ... }:
+
+{
+  imports = [
+    ../../services/nginx.nix
+  ];
+
+  services = {
+    baikal = {
+      enable = true;
+      virtualHost = "dav.${config.networking.domain}";
+    };
+
+    nginx.virtualHosts."dav.${config.networking.domain}" = {
+      default = true;
+      quic = true;
+      kTLS = true;
+      forceSSL = true;
+      enableACME = true;
+      locations."/all.ics".root = "/srv/www/calendar";
+    };
+  };
+}
+
diff --git a/hosts/dav/default.nix b/hosts/dav/default.nix
index 3009519..a7e857f 100644
--- a/hosts/dav/default.nix
+++ b/hosts/dav/default.nix
@@ -5,7 +5,8 @@
     ../common.nix
     ../../services/openssh.nix
     ../../services/prometheus-node.nix
-    ./radicale.nix
+    #./radicale.nix
+    ./baikal.nix
   ];
 
   networking = {
diff --git a/hosts/dav/radicale.nix b/hosts/dav/radicale.nix
index b8a2873..47b120b 100644
--- a/hosts/dav/radicale.nix
+++ b/hosts/dav/radicale.nix
@@ -42,14 +42,14 @@ in
     radicale = {
       enable = true;
       rights = {
-        root = {
-          user = ".*";
-          collection = "";
+        readonly = {
+          user = "";
+          collection = ".*";
           permissions = "r";
         };
         principal = {
           user = ".*";
-          collection = "{user}/?";
+          collection = "{user}";
           permissions = "rw";
         };
         collections = {