From 22204b49f52538d3dad0135fc7f9f0ba64e8d5a7 Mon Sep 17 00:00:00 2001 From: Frank Date: Mon, 21 Sep 2026 12:51:06 -0700 Subject: [PATCH] docs(calibre-server): correct the port map - pasta is port-forward mode Only the 8084 forward is exposed; the desktop GUI runs inside the container netns and is internal-only. Drop the now-unneeded CUSTOM_HTTPS_PORT (no host-port conflict exists inside the netns). --- .../quadlet/calibre-server.container | 22 +++++++++++-------- serverAppConfigs-docs/Dankserver/Calibre.md | 13 ++++++----- 2 files changed, 20 insertions(+), 15 deletions(-) diff --git a/dankserver/calibre-server/quadlet/calibre-server.container b/dankserver/calibre-server/quadlet/calibre-server.container index 0fde088..69e6d26 100644 --- a/dankserver/calibre-server/quadlet/calibre-server.container +++ b/dankserver/calibre-server/quadlet/calibre-server.container @@ -10,15 +10,20 @@ # serverAppConfigs-docs/Dankserver/Calibre.md predates the desktop revamp; # the dedicated headless images (ta264/docker-calibre, agentgreen) are # dormant (calibre 6.10 / 2017), so this unit runs calibre-server as the -# image's s6-overlay main service via Exec= and keeps the desktop as a -# bonus (browser GUI on 8080, basic-authed via the env file). -# -# Port map (Network=pasta, so container ports bind on the host directly): -# 8090 -> host 8084 calibre-server (the content server; 8080 is taken by -# the image's own nginx, 8083 by calibre-web) -# 8080 -> host 8080 desktop GUI (nginx; CUSTOM_HTTPS_PORT moved to 8182 -# because Tautulli holds host 8181) +# image's s6-overlay main service via Exec=; the desktop also runs but its +# ports are internal-only (see the port map below). # +# Port map: Network=pasta is port-FORWARD mode on this host (the container +# keeps its own netns; only PublishPort'd ports reach the host — verified +# 2026-09-21: 8080/8090/8182 inside the container are not visible on the +# host, only the 8084 forward). So the ONLY exposed surface is: +# 8090 -> host 8084 calibre-server (the content server; 8080 inside the +# container is the image's own nginx, 8083 on the host +# is calibre-web) +# The desktop GUI (nginx 8080/8181 + WS 8082, inside the container) runs but +# is internal-only: no PublishPort. Exposing it is one PublishPort line away +# if the browser GUI is ever wanted (the basic-auth credential is already in +# the env file). # Auth: calibre-server 9.x keeps its users in a SQLite userdb (the pw column # is PLAINTEXT, so the file is mode 600). The single admin account is # bootstrapped once by the deploy handler (deploy_calibre_server) via @@ -44,7 +49,6 @@ EnvironmentFile=/home/dank/Containers/calibre-server/env Environment=PUID=1000 Environment=PGID=1000 Environment=TZ=America/Vancouver -Environment=CUSTOM_HTTPS_PORT=8182 Volume=/home/dank/Containers/calibre-web/books:/books Volume=/home/dank/Containers/calibre-server/userdb.sqlite:/userdb.sqlite Exec=calibre-server --port 8090 --enable-auth --auth-mode=basic --userdb /userdb.sqlite /books diff --git a/serverAppConfigs-docs/Dankserver/Calibre.md b/serverAppConfigs-docs/Dankserver/Calibre.md index c3cfb6b..b01b30f 100644 --- a/serverAppConfigs-docs/Dankserver/Calibre.md +++ b/serverAppConfigs-docs/Dankserver/Calibre.md @@ -55,17 +55,18 @@ The image is the current **desktop** build (Selkies web-streamed GUI), not the headless image the old compose snippet assumed — the dedicated headless images (ta264/docker-calibre, agentgreen/calibre-server) are dormant (calibre 6.10 / 2017, both below the 9.9.0 content-server fix). The unit therefore runs -`calibre-server` as the image's s6-overlay main service via `Exec=` and keeps -the desktop as a bonus: +`calibre-server` as the image's s6-overlay main service via `Exec=`. | Surface | Host port | Auth | |---------|-----------|------| | Content server (OPDS + web UI) | **8084** (internal 8090) | HTTP Basic, single admin `calibre` in the SQLite userdb | -| Desktop GUI (bonus) | 8080 (HTTPS on 8182) | HTTP Basic, same credential | +| Desktop GUI (internal only) | none (8080/8181/8082 inside the container) | HTTP Basic ready (`CUSTOM_USER`/`CUSTOM_PASSWORD` in the env file) | -Port notes: 8080 inside the container is the image's own nginx (the desktop), -so the content server runs on internal 8090; `CUSTOM_HTTPS_PORT=8182` avoids -Tautulli's host 8181. +Port notes: `Network=pasta` on this host is port-FORWARD mode — the container +keeps its own netns and only `PublishPort`'d ports reach the host (verified +2026-09-21). The desktop GUI runs but is unreachable: exposing the browser +GUI is one `PublishPort` line away. 8080 *inside* the container is the +image's own nginx (the desktop), so the content server runs on internal 8090. **Auth model (calibre 9.x):** users live in a SQLite userdb whose `pw` column is **plaintext** — the file is mode 600. The single admin account is