Here is the relevant section:

[sharing]
type = csv
database_path = /var/lib/radicale/collections/sharing.csv
collection_by_map = true
permit_create_map = true

Just FYI, my filesystem_folder is defined as /var/lib/radicale/collections.

BTW. The token based sharing, as I understand, still requires auth, just not an user auth but, well, a token one.

It's IMHO poorly documented (in terms of visibility).

Since it is not enabled by default, you have to edit your config file with the '[sharing]' section. There are two types, by map and token to conform to different usecases. There are also two different storage types, csv and files. Personally i chose map and csv way.

After adding your config and restarting the server, in the gui you can find a new button to share next to your calendar / carddav and in the bottom right menu an entry to accept invites issued by others.

I previously shared with the symlink too but since this update i got rid of it and used this new system and, well, it works for me (i'm sharing ro only calendar but you can assing [limited] permissions too).

Depends on the client configuration. If you route all the traffic through vpn (so, simplified, 0.0.0.0/0) then all their client device network traffic would go through their vpn server at home and is seen as coming from there; otherwise, if you only route specific addressess (like your home network private addressess only) then only those go to their home network and everything else works like it would without a vpn.