Xandikos
Git-backed CardDAV/CalDAV server for self-hosted contacts and calendars
Alternative to: Alternatives to Google Calendar
Xandikos provides a lightweight CardDAV and CalDAV server with data stored in a Git repository. It fully implements CalDAV and CardDAV, Collection Synchronization, Calendar Availability, Extended MKCOL, and POST for creating collection members. Scheduling works end-to-end when all attendees are principals on the same server, translating organiser updates and deletions into iTIP REQUEST, CANCEL, and REPLY messages. It also accepts inbound iMIP through a command or LMTP endpoint, while outbound iMIP must be enabled and configured.
It is intended for users who need a self-hosted contact and calendar service with Git-backed storage. Tested clients include Thunderbird, Apple iOS, DAVx5, Evolution, and Home Assistant’s CalDAV integration. It can be installed through Python/pip or run from the provided Containerfile or published container image.
The research does not identify a specific paid product that Xandikos replaces, so a direct paid-product comparison is unavailable. Documented limitations include missing WebDAV LOCK operations and experimental multi-user support. Outbound iMIP is disabled by default and requires sendmail or SMTP configuration.
Key features
- Git-backed contact and calendar storage
- Full CardDAV and CalDAV implementation
- Same-server scheduling with iTIP messages
- WebDAV Collection Synchronization
- WebDAV-Push with VAPID and aes128gcm encryption
- Inbound iMIP through a command or LMTP endpoint
- Container configuration through environment variables
vs Unknown
Xandikos covers CardDAV, CalDAV, collection synchronization, calendar availability, and same-server scheduling. Its data is backed by Git, and it supports inbound iMIP plus configurable outbound iMIP. It lacks WebDAV LOCK operations, and multi-user support remains experimental. It fits users seeking a self-hosted server but not those requiring LOCK support or non-experimental multi-user operation.
Install
What's new in v0.4.10
* webdav-push: Check push-resource addresses on delivery, don't follow redirects and set a timeout. * webdav-push: Only accept `https` push-resource URLs. * Report `DAV:valid-sync-token` rather than a 500 for a sync token that isn't a hex SHA or doesn't name a tree. (#743)
