{...}: {
  config.flake.modules.homeManager.dav = {
    lib,
    config,
    pkgs,
    ...
  }: {
    config = {
      azos.dav.enable = true;

      # Same smartcard gate as mail: the password comes from `pass`.
      azos.dav.presenceCheckCommand = lib.mkIf config.azos.encryption.yubikey.enable "${pkgs.azos-card-present}/bin/azos-card-present";

      accounts.calendar.accounts.nextcloud = {
        remote = {
          type = "caldav";
          # Principal discovery from the DAV root resolves the account's
          # user ID, which differs from the login name on this server.
          url = "https://nextcloud.zakobar.com/remote.php/dav/";
          userName = "aner";
          passwordCommand = ["sh" "-c" "pass zakobar.com | head -1"];
        };
        vdirsyncer = {
          enable = true;
          collections = ["from a"];
          itemTypes = ["VTODO"];
        };
      };
    };
  };
}