e772c4b6d5
This commit adds a new `Auth/PasswordCommand` option
to support security best practices re: handling secrets
in CLI program configuration.
Prior to this commit, the two available options
for specifying a password were:
1. via the `Auth/Password` config parameter, or
2. via a `$CALCURSE_CALDAV_PASSWORD` environment variable.
The former is unsafe for obvious reasons;
the latter is unsafe because as long as the script is running,
its environment can be accessed via
$ cat /proc/<pid>/environ
and is thus visible to anyone with access to the system.
This commit preserves preexisting behavior (for backward compatibility)
but removes all mention of option 2 from the README.
Since the README example for option 2 used a password command anyway,
there is little reason to continue its use,
and this commit recommends it be deprecated.
Signed-off-by: Lukas Fleischer <lfleischer@calcurse.org>
75 lines
2.9 KiB
Plaintext
75 lines
2.9 KiB
Plaintext
# If you want to synchronize calcurse with a CalDAV server using
|
|
# calcurse-caldav, create a new directory at $XDG_CONFIG_HOME/calcurse/caldav/
|
|
# (~/.config/calcurse/caldav/) and $XDG_DATA_HOME/calcurse/caldav/
|
|
# (~/.local/share/calcurse/caldav/) and copy this file to
|
|
# $XDG_CONFIG_HOME/calcurse/caldav/config and adjust the configuration below.
|
|
# Alternatively, if using ~/.calcurse, create a new directory at
|
|
# ~/.calcurse/caldav/ and copy this file to ~/.calcurse/caldav/config and adjust
|
|
# the configuration file below.
|
|
|
|
[General]
|
|
# Path to the calcurse binary that is used for importing/exporting items.
|
|
Binary = calcurse
|
|
|
|
# Host name of the server that hosts CalDAV. Do NOT prepend a protocol prefix,
|
|
# such as http:// or https://. Append :<port> for a port other than 80.
|
|
Hostname = some.hostname.com
|
|
|
|
# Path to the CalDAV calendar on the host specified above. This is the base
|
|
# path following your host name in the URL.
|
|
Path = /path/to/calendar/on/the/server/
|
|
|
|
# Type of authentication to use. Must be "basic" or "oauth2"
|
|
#AuthMethod = basic
|
|
|
|
# Enable this if you want to skip SSL certificate checks.
|
|
InsecureSSL = No
|
|
|
|
# Disable this if you want to use HTTP instead of HTTPS.
|
|
# Using plain HTTP is highly discouraged.
|
|
HTTPS = Yes
|
|
|
|
# This option allows you to filter the types of tasks synced. To this end, the
|
|
# value of this option should be a comma-separated list of item types, where
|
|
# each item type is either "event", "apt", "recur-event", "recur-apt", "todo",
|
|
# "recur" or "cal". Note that the comma-separated list must not contain any
|
|
# spaces. Refer to the documentation of the --filter-type command line argument
|
|
# of calcurse for more details. Set this option to "cal" if the configured
|
|
# CalDAV server doesn't support tasks, such as is the case with Google
|
|
# Calendar.
|
|
SyncFilter = cal,todo
|
|
|
|
# Disable this option to actually enable synchronization. If it is enabled,
|
|
# nothing is actually written to the server or to the local data files. If you
|
|
# combine DryRun = Yes with Verbose = Yes, you get a log of what would have
|
|
# happened with this option disabled.
|
|
DryRun = Yes
|
|
|
|
# Enable this if you want detailed logs written to stdout.
|
|
Verbose = Yes
|
|
|
|
# Credentials for HTTP Basic Authentication (if required).
|
|
# Set `Password` to your password in plaintext (unsafe),
|
|
# or `PasswordCommand` to a shell command that retrieves it (recommended).
|
|
#[Auth]
|
|
#Username = user
|
|
#Password = password
|
|
#PasswordCommand = pass baikal
|
|
|
|
# Optionally specify additional HTTP headers here.
|
|
#[CustomHeaders]
|
|
#User-Agent = Mac_OS_X/10.9.2 (13C64) CalendarAgent/176
|
|
|
|
# Use the following to synchronize with an OAuth2-based service
|
|
# such as Google Calendar.
|
|
#[OAuth2]
|
|
#ClientID = your_client_id
|
|
#ClientSecret = your_client_secret
|
|
|
|
# Scope of access for API calls. Synchronization requires read/write.
|
|
#Scope = https://example.com/resource/scope
|
|
|
|
# Change the redirect URI if you receive errors, but ensure that it is identical
|
|
# to the redirect URI you specified in the API settings.
|
|
#RedirectURI = http://127.0.0.1
|