+vpn_ser=openvpn-client
+if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
+ vpn_ser=openvpn
+fi
+
+d=/etc/systemd/system/radicale.service.d
+mkdir -p $d
+cat >$d/override.conf <<EOF
+[Unit]
+# this unit is configured to start and stop whenever openvpn-client@mail.service
+# does
+After=network.target
+BindsTo=$vpn_ser@mail.service
+After=$vpn_ser@mail.service
+
+[Install]
+RequiredBy=$vpn_ser@mail.service
+EOF
+systemctl daemon-reload # not sure this is needed
+
+pi-nostart radicale
+
+# use persistent uid/gid
+IFS=:; read -r _ _ uid _ < <(getent passwd radicale ); unset IFS
+IFS=:; read -r _ _ gid _ < <(getent group radicale ); unset IFS
+if [[ $uid != 609 ]]; then
+ systemctl stop radicale ||:
+ usermod -u 609 radicale
+ groupmod -g 609 radicale
+ usermod -g 609 radicale
+fi
+log_p=/var/log/radicale
+[[ -d $log_p ]] || log_p=
+find /o/radicale -xdev -exec chown -h 609 {} +
+find /o/radicale -xdev -exec chgrp -h 609 {} +