How to Install Baïkal CalDAV/CardDAV Server on Debian 13

Last updated: Oct 24, 2026

Baïkal is a lightweight, open-source CalDAV and CardDAV server that allows you to host and synchronize calendars and contacts on your own infrastructure. It provides a simple alternative to cloud-based synchronization services.

I have been a long-time user of Zimbra, appreciating its web interface, email management, and shared calendar features. The free and open-source edition served its purpose well, even though it gradually became more difficult to maintain and upgrade. However, following changes in ownership and licensing over the years, the availability and future of the free edition have become increasingly uncertain. I therefore started looking for alternative solutions for its various components (calendar, webmail, etc.).

In this article, I'll show how to install and configure a Baïkal CalDAV/CardDAV server on Debian 13, enable secure HTTPS access, and synchronize calendars with Thunderbird and DAVx⁵ on Android. Baïkal also provides a web administration interface to manage users, calendars, and address books.

For this setup, we'll use SQLite, which is well suited to a small number of users and requires minimal administration.

Configuration:
- Debian: 13 (Trixie)
- Baïkal: 0.13.0
- SQLite: 3.46
- PHP: 8.4

And a big thank you to ByteHamster for maintaining Baïkal, this free and open-source project.

Diagram showing the general architecture of the Baïkal shared calendar on Debian, with local and remote Thunderbird clients and DAVx⁵ smartphone synchronization through the internet. — General architecture of the Baïkal shared calendar environment, illustrating the Debian server, LAN clients, remote Thunderbird users, and smartphone synchronization via DAVx⁵.

Baïkal Installation

Prerequisites

Install prerequisites:

root@host:~# apt update && apt install apache2 php-sqlite3 git sqlite3 unzip php php-xml libapache2-mod-php

Download the latest Baïkal release (check the official GitHub repository for the latest version https://github.com/sabre-io/Baikal/releases):

root@host:~# wget https://github.com/sabre-io/Baikal/releases/download/0.13.0/baikal-0.13.0.zip

Unzip and move the folder to /var/www/baikal/:

root@host:~# unzip baikal-0.13.0.zip
root@host:~# mv baikal /var/www/baikal

Set www-data as the owner of the folder:

root@host:~# chown -R www-data:www-data /var/www/baikal/

Certificates

To enable HTTPS on your Baïkal server, you need TLS certificates. You can choose between generating self-signed certificates or using Let’s Encrypt certificates.

Self-signed certificates are easy to generate, but they are not trusted by default by external devices and applications. As a result, clients will display security warnings when connecting to your server.

Let’s Encrypt provides free, publicly trusted TLS certificates. Certificates issued by Let’s Encrypt are recognized automatically by operating systems, browsers, and CalDAV/CardDAV clients, which prevents security warnings.

In this guide, both methods are presented so you can choose the solution that best fits your environment.

Self-signed certificates

First, create the /etc/apache2/ssl/ directory, which will be used to store the TLS certificates and private keys:

root@host:~# mkdir /etc/apache2/ssl/

Generate the self-signed TLS certificate using openssl:

root@host:~# openssl req -x509 -nodes -days 3650 \
  -newkey rsa:4096 \
  -keyout /etc/apache2/ssl/selfsigned.key \
  -out /etc/apache2/ssl/selfsigned.crt \
  -subj "/CN=baikal.std.rocks" \
  -addext "subjectAltName=DNS:baikal.std.rocks"

Restrict permissions on the selfsigned.key private key so that only its owner can read or modify it:

root@host:~# chmod 600 /etc/apache2/ssl/selfsigned.key

Edit the Apache VirtualHost configuration file /etc/apache2/sites-available/000-default.conf:

<VirtualHost *:443>

    DocumentRoot /var/www/baikal/html
    ServerName baikal.std.rocks

    RewriteEngine On
    # Generally already set by global Apache configuration
    #RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    RewriteRule /.well-known/carddav /dav.php [R=308,L]
    RewriteRule /.well-known/caldav  /dav.php [R=308,L]

    <Directory "/var/www/baikal/html">
        Options None
        # If you install cloning git repository, you may need the following
        Options +FollowSymlinks
        AllowOverride None
        # Configuration for apache-2.4:
        Require all granted
    </Directory>

    <IfModule mod_expires.c>
        ExpiresActive Off
    </IfModule>

    SSLEngine On

    #SECURE SSL
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite HIGH:!aNULL:!MD5
    SSLHonorCipherOrder On

    #AUTOGENERATE CERTIFICATES
    SSLCertificateFile /etc/apache2/ssl/selfsigned.crt
    SSLCertificateKeyFile /etc/apache2/ssl/selfsigned.key

    #LETS ENCRYPT CERTIFICATES
    #SSLCertificateFile /etc/letsencrypt/live/baikal.std.rocks/fullchain.pem
    #SSLCertificateKeyFile /etc/letsencrypt/live/baikal.std.rocks/privkey.pem
</VirtualHost>

Let's Encrypt certificates

First, stop the Apache service to allow Certbot to listen on the HTTP port during the certificate validation process:

root@host:~# systemctl stop apache2.service

Install the certbot package:

root@debian:~# apt update && sudo apt install certbot

Use certbot to request a Let’s Encrypt SSL/TLS certificate. Replace baikal.std.rocks with your own domain name and letsencrypt@std.rocks with your administrative email address:

root@debian:~# certbot certonly --standalone -d baikal.std.rocks --email letsencrypt@std.rocks --agree-tos --noninteractive
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for baikal.std.rocks

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/baikal.std.rocks/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/baikal.std.rocks/privkey.pem
This certificate expires on 2026-04-23.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

💡 Note: Keep track of your certificate’s expiration date. Certbot automatically sets up renewal, but you can also configure a cron job or systemd timer to ensure the process runs smoothly.

Edit the Apache VirtualHost configuration file /etc/apache2/sites-available/000-default.conf:

<VirtualHost *:443>

    DocumentRoot /var/www/baikal/html
    ServerName baikal.std.rocks

    RewriteEngine On
    # Generally already set by global Apache configuration
    #RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    RewriteRule /.well-known/carddav /dav.php [R=308,L]
    RewriteRule /.well-known/caldav  /dav.php [R=308,L]

    <Directory "/var/www/baikal/html">
        Options None
        # If you install cloning git repository, you may need the following
        Options +FollowSymlinks
        AllowOverride None
        # Configuration for apache-2.4:
        Require all granted
    </Directory>

    <IfModule mod_expires.c>
        ExpiresActive Off
    </IfModule>

    SSLEngine On

    #SECURE SSL
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite HIGH:!aNULL:!MD5
    SSLHonorCipherOrder On

    #AUTOGENERATE CERTIFICATES
    #SSLCertificateFile /etc/apache2/ssl/selfsigned.crt
    #SSLCertificateKeyFile /etc/apache2/ssl/selfsigned.key

    #LETS ENCRYPT CERTIFICATES
    SSLCertificateFile /etc/letsencrypt/live/baikal.std.rocks/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/baikal.std.rocks/privkey.pem
</VirtualHost>

Finalize configuration

Once your self-signed or Let’s Encrypt certificate has been generated, you can continue with the installation of Baïkal.

Enable the required Apache modules for URL rewriting and SSL support:

root@host:~# a2enmod rewrite
root@host:~# a2enmod ssl

Restart the Apache service to apply the configuration changes:

root@host:~# systemctl restart apache2

You can now proceed with the Baïkal configuration.

Baïkal Configuration

Open a web browser and access the Baïkal web interface using the server's IP address (https://IP_SERVER) or DNS name (https://DNS_NAME), then set the administrator password:

Baïkal installation wizard showing the initial configuration screen with admin password fields and the Save changes button — Baïkal installation wizard displaying the initial configuration settings, including the administrator password setup.

Keep the default database configuration (SQLite) and click Save changes to continue:

Baïkal database setup screen showing SQLite selected as the database backend — Baïkal database configuration screen with SQLite selected as the backend.

Finally, click on Start using Baïkal:

Baïkal installation wizard completion screen confirming that the database is configured and ready for use — Final screen of the Baïkal installation wizard confirming that the database has been configured successfully.

Use the previously configured password and click Authenticate:

Baïkal web administration authentication screen showing the login and password fields with the Authenticate button — Authentication screen of the Baïkal web administration interface, used to access the dashboard.

To add users, click Users and Resources from the dashboard:

Baïkal web administration dashboard showing system information, services status, and access to users and resources — Baïkal web administration dashboard providing an overview of the system status and access to users and resources management.

Then, click the Add User button:

Baïkal user management page showing the Users section with access to add new user accounts — User management section of the Baïkal web administration interface, used to manage accounts and related resources.

Enter information for the new account and click Save changes:

Baïkal user creation form showing username, display name, email, password fields, and the Save changes button — User creation form in the Baïkal web administration interface, used to add a new user account.

The user is now created. Click on the Calendars button:

Baïkal user management screen showing a created user with access to calendars and address books settings — User management screen in the Baïkal web administration interface, allowing access to calendars and address books for a specific user.

From here, you can add a calendar and obtain the URI information (which can be useful depending on the calendar client):

Baïkal calendar management screen showing the default calendar and the CalDAV URI information for a user — Calendar management screen in the Baïkal web administration interface, displaying the CalDAV URI required to configure calendar clients.

Calendar Clients Configuration

At this point, we have a working shared calendar server. Now, let's connect our clients. I'll demonstrate how to do it with Thunderbird, which has an integrated calendar, and the DAVx5 Android application, allowing synchronization with calendars on Android devices.

Thunderbird

Open Thunderbird and click the calendar button, then select New Calendar…:

Select On the Network and click the Next button:

Thunderbird create new calendar dialog showing the option to add a calendar on the network — Creating a new network calendar in Mozilla Thunderbird as the first step to connect to a CalDAV server.

Enter the username and the Baïkal server URL using its IP address (https://IP_SERVER) or DNS name (https://DNS_NAME), then click Find Calendars:

Thunderbird network calendar setup showing the username field and the CalDAV server URL location before clicking Find Calendars — Entering the username and CalDAV server URL in Thunderbird to discover available calendars on the Baïkal server.

If you used a self-signed certificate, confirm the security exception:

Thunderbird security warning dialog prompting to add a certificate exception for an untrusted CalDAV server — Security warning in Thunderbird when connecting to a CalDAV server using a self-signed certificate, requiring a certificate exception.

Enter the password of the user previously created:

Thunderbird authentication dialog requesting the user password when connecting to a CalDAV calendar server — Entering the user password in Thunderbird to authenticate against the Baïkal CalDAV server.

Finally, click on Subscribe to add the calendar:

The shared calendar will appear:

Mozilla Thunderbird calendar view showing the subscribed CalDAV calendar listed in the left pane — Thunderbird calendar view after subscribing to the Baïkal CalDAV calendar, with the shared calendar now visible in the calendar list.

DAVx⁵

Open the DAVx⁵ app and click on the plus symbol to add an account:

Select Connect with URL and enter the requested information:

DAVx⁵ add account screen showing the option to connect using a URL and username for a CalDAV server — Adding a CalDAV account in DAVx⁵ by entering the server URL, username, and password on an Android device.

As with Thunderbird, we will receive a warning about the certificate if it is self-signed. Just click Accept:

DAVx⁵ security warning screen displaying the details of a self-signed SSL certificate and prompting the user to accept it — Certificate validation screen in DAVx⁵ when connecting to a CalDAV server using a self-signed SSL certificate.

Finally, click on Create:

DAVx⁵ account creation screen on Android showing the create account button to finish adding a CalDAV account — Final step in DAVx⁵ to create the CalDAV account on Android and enable calendar synchronization with the Baïkal server.

Upgrading Baïkal

Baïkal is actively maintained, so new versions become available as time goes by. Here, I'll explain how to update Baïkal while preserving user data. The first step, as usual for this kind of operation, will be to make a full backup of your system.

Stop the apache2 service:

root@host:~# systemctl stop apache2

Backup the sqlite3 database:

root@host:~# sqlite3 /var/www/baikal/Specific/db/db.sqlite ".backup 'backup.db.sqlite'"

Backup the baikal folder:

root@host:~# cp -a /var/www/baikal /var/www/$(date +%Y%m%d).baikal

Get the latest release (you can check here: https://github.com/sabre-io/Baikal/releases) of Baïkal and unzip it to /tmp/:

root@host:~# cd /tmp/

root@host:~# wget https://github.com/sabre-io/Baikal/releases/download/0.13.0/baikal-0.13.0.zip

root@host:~# unzip baikal-0.13.0.zip

Copy the current config and Specific folders to /tmp/baikal:

root@host:~# cp -ra /var/www/baikal/config /tmp/baikal/

root@host:~# cp -ra /var/www/baikal/Specific /tmp/baikal/

Disable old baikal folder:

root@host:~# cd /var/www/

root@host:~# mv baikal baikal.OLD

Move the new version of baikal to /var/www/:

root@host:~# mv /tmp/baikal /var/www/

Restore www-data rights:

root@host:~# chown -R www-data:www-data /var/www/baikal/

Start apache service:

root@host:~# systemctl start apache2

Open the baikal web administration page (e.g. https://baikal.std.rocks/admin/install/) and click on Start the upgrade:

Baïkal upgrade wizard showing the upgrade process from an older version to a newer one, with start upgrade and access admin actions — Baïkal upgrade wizard illustrating the start and completion of the upgrade process between two software versions.