Import GingerCal 1.0 source

bridge/docker-compose.yml

@@ -0,0 +1,23 @@
+# Run this on the machine where Nextcloud and your Pangolin "newt" site connector run.
+# Then create a Pangolin Raw TCP resource that targets this container on port 8443 (README.md).
+services:
+  caldav-bridge:
+    image: nginx:1.27-alpine
+    container_name: caldav-bridge
+    restart: unless-stopped
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./certs:/etc/nginx/certs:ro
+    # newt in Docker: put newt on this same network and use target "caldav-bridge:8443"; no
+    # published port needed. newt installed on the host instead: uncomment and use 127.0.0.1:8443.
+    # ports:
+    #   - "127.0.0.1:8443:8443"
+    networks:
+      - nextcloud
+
+networks:
+  nextcloud:
+    # EDIT: the network your Nextcloud container is on (docker network ls), so that the
+    # "nextcloud:80" upstream in nginx.conf resolves.
+    external: true
+    name: nextcloud_default

bridge/make-cert.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Creates the bridge's self-signed certificate (10 years) and prints the SHA-256
+# fingerprint to compare with what the phone shows when you tap "Trust".
+set -eu
+cd "$(dirname "$0")"
+mkdir -p certs
+NAME=${1:-caldav-bridge}
+if [ ! -f certs/bridge.key ]; then
+  openssl req -x509 -newkey rsa:2048 -sha256 -days 3650 -nodes \
+    -keyout certs/bridge.key -out certs/bridge.crt -subj "/CN=$NAME" 2>/dev/null
+  chmod 600 certs/bridge.key
+  echo "Created certs/bridge.crt"
+fi
+echo "SHA-256 fingerprint (must match the phone):"
+openssl x509 -in certs/bridge.crt -noout -fingerprint -sha256 | cut -d= -f2

bridge/nginx.conf

@@ -0,0 +1,75 @@
+# Legacy-TLS CalDAV bridge for Android 2.3 phones.
+#
+# The phone speaks TLS 1.0 with old ciphers and has no modern root CAs. This server accepts
+# exactly that, with a self-signed certificate the app pins by SHA-256 fingerprint, and
+# forwards ONLY the CalDAV endpoints to Nextcloud. The Nextcloud web UI stays unreachable here.
+#
+# Edit the lines marked EDIT, then see README.md.
+
+upstream nextcloud {
+    # EDIT: where Nextcloud listens, as seen from this container.
+    #   Nextcloud serves plain HTTP internally (official docker image :80, AIO :11000): keep :80.
+    #   Nextcloud forces HTTPS (port 80 redirects to https://, often alongside HSTS): use its
+    #   HTTPS port, e.g. nextcloud:443, AND switch proxy_pass below to https://.
+    server nextcloud:80;
+}
+
+server {
+    # Pangolin raw TCP resource -> this port. Add "proxy_protocol" here only if you also tick
+    # "Enable Proxy Protocol" on the Pangolin resource (see README).
+    listen 8443 ssl;
+    server_name _;
+
+    # EDIT: Nextcloud's own host name, as listed in its trusted_domains.
+    set $nc_host cloud.example.com;
+
+    ssl_certificate     /etc/nginx/certs/bridge.crt;
+    ssl_certificate_key /etc/nginx/certs/bridge.key;
+
+    # Android 2.3: TLS 1.0, AES-CBC-SHA. SECLEVEL=0 lets OpenSSL 3 negotiate it at all.
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers "ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:@SECLEVEL=0";
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:legacy:1m;
+    ssl_session_timeout 1h;
+
+    # Relative Location headers: correct even when Pangolin's public port differs from 8443.
+    absolute_redirect off;
+
+    client_max_body_size 5m;
+    access_log /var/log/nginx/caldav-bridge.log;
+
+    # HSTS from Nextcloud (or added by your proxy) is meant for its real https site. Passed on
+    # here it would tell browsers to treat this self-signed endpoint as strict HTTPS, with no
+    # way to click through. The phone app ignores HSTS either way.
+    proxy_hide_header Strict-Transport-Security;
+
+    location /remote.php/dav/ {
+        proxy_pass http://nextcloud;
+        # EDIT if Nextcloud forces HTTPS: replace the line above with
+        #   proxy_pass https://nextcloud;
+        # The phone side stays TLS 1.0; this bridge-to-Nextcloud leg then uses modern TLS.
+        proxy_ssl_server_name on;
+        proxy_ssl_name $nc_host;
+        # Internal hop to your own server, often with a self-signed or LAN-only certificate.
+        proxy_ssl_verify off;
+
+        proxy_set_header Host $nc_host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 120s;
+        proxy_buffering off;
+        # Nextcloud builds absolute URLs from its public address (overwrite.cli.url /
+        # overwriteprotocol). Keep the phone on the bridge by reducing them to the path.
+        proxy_redirect ~^https?://[^/]+(/.*)$ $1;
+    }
+
+    location = /.well-known/caldav {
+        return 301 /remote.php/dav/;
+    }
+
+    location / {
+        return 404;
+    }
+}