I use radicale, DAVx5 and Simple Calendar Pro. I tried to use GNOME Calendar on the desktop, but its caldav support is too buggy to be usable, and I ended up using the calendar on my phone only.
Before simple calendar I used Etar, but it had a very annoying bug where it changed the date (or time, I don't remember) every time I edited an event. Plus, simple calendar can send birthday notifications if you have them in your contact book.
Why disallow root login? I always need root when I connect, and stealing the password by aliasing sudo/doas is trivial. It seems to me it would just make life harder for no benefit.