diff --git a/domains/stvnliu.me/caldav/.gitignore b/domains/stvnliu.me/caldav/.gitignore
new file mode 100644
index 0000000..2171176
--- /dev/null
+++ b/domains/stvnliu.me/caldav/.gitignore
@@ -0,0 +1,2 @@
+config/
+data/
diff --git a/domains/stvnliu.me/caldav/docker-compose.yml b/domains/stvnliu.me/caldav/docker-compose.yml
index 10836b7..252170f 100644
--- a/domains/stvnliu.me/caldav/docker-compose.yml
+++ b/domains/stvnliu.me/caldav/docker-compose.yml
@@ -11,7 +11,7 @@ services:
     init: true
     read_only: false
     security_opt:
-      - no-new-privileges: true
+      - no-new-privileges:true
     cap_drop:
       - ALL
     cap_add:
@@ -24,6 +24,13 @@ services:
         limits:
           memory: 256M
           pids: 50
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.radicale.rule=Host(`cal.stvnliu.me`) && PathPrefix(`/radicale/`)"
+      - "traefik.http.routers.radicale.entrypoints=websecure"
+      - "traefik.http.services.radicale.loadbalancer.server.port=5232"
+      - "traefik.http.middlewares.radicale-scriptname.headers.customrequestheaders.X-Script-Name=/radicale"
+      - "traefik.http.routers.radicale.middlewares=radicale-scriptname"
     restart: unless-stopped
     volumes:
       - ./data:/data
diff --git a/domains/stvnliu.me/docker-compose.yml b/domains/stvnliu.me/docker-compose.yml
index 8537a9b..99a7d61 100644
--- a/domains/stvnliu.me/docker-compose.yml
+++ b/domains/stvnliu.me/docker-compose.yml
@@ -2,3 +2,4 @@ include:
   - path: ./vault/docker-compose.yml
   - path: ./git/docker-compose.yml
   - path: ./sso/docker-compose.yml
+  - path: ./caldav/docker-compose.yml
diff --git a/domains/stvnliu.me/sso/docker-compose.yml b/domains/stvnliu.me/sso/docker-compose.yml
index 52f0a1f..fbcbd10 100644
--- a/domains/stvnliu.me/sso/docker-compose.yml
+++ b/domains/stvnliu.me/sso/docker-compose.yml
@@ -39,13 +39,14 @@ services:
     networks:
       - authentik_net
       - proxy_net
-    ports:
-      - ${COMPOSE_PORT_HTTP:-9000}:9000
+      # ports:
+      # - ${COMPOSE_PORT_HTTP:-9000}:9000
       # - ${COMPOSE_PORT_HTTPS:-9443}:9443
     restart: unless-stopped
     shm_size: 512mb
     labels:
       - traefik.enable=true
+      - traefik.docker.network=proxy-net
       - traefik.http.routers.authentik-stvnliu-me.tls=true
       - traefik.http.routers.authentik-stvnliu-me.entrypoints=websecure
       - traefik.http.routers.authentik-stvnliu-me.rule=Host(`sso.stvnliu.me`)