You asked how to connect the phone to Audiobookshelf. The page answered the browser case and was silent on the phone — and one of its doors bit me while I was scripting the check, so this closes both gaps.
What the page gains
Section
Fact
new Phone app
Server Address http://192.168.0.235:8000, user frank, plain HTTP, no base-path prefix. Reachability proven from a second host: /healthcheck and /ping answer 200, and iptables -S INPUT carries no rule for 8000 — so a phone on the LAN needs no further setup. download: true on the root account is what makes offline listening work.
Phone app (token)
POST /login puts the bearer at user.token, not top level. response.token is empty, the client then sends Authorization: Bearer with nothing after it, and every /api/* answers 401 as if the password were wrong — which it was not.
LAN-only law
Its consequence for clients is now written down: the Anubis + Authentik chain serves browsers, so guarding a vhost does not make the phone app work away from home. Remote listening wants a VPN into the LAN, after which the LAN address is still correct.
No script, unit, or config touched — documentation only, and the password itself stays out of the repo as the secret rules require (the page keeps pointing at ~/.config/secrets/audiobookshelf).
Verification, 2026-11-03
./tests/run.sh — 822 seams, all pass.
Service audiobookshelf.service: active, NRestarts=0, healthcheck 200.
POST /login → HTTP 200 as frank, type root, download: true; library Audiobooks (folder /audiobooks, provider audiobook) reports 5,374 items.
Cross-host probe from the workstation: /healthcheck 200, /ping 200.
Branch is cut from current origin/main, independent of #126.
You asked how to connect the phone to Audiobookshelf. The page answered the browser case and was silent on the phone — and one of its doors bit me while I was scripting the check, so this closes both gaps.
## What the page gains
| Section | Fact |
|---|---|
| new **Phone app** | Server Address `http://192.168.0.235:8000`, user `frank`, plain HTTP, no base-path prefix. Reachability proven from a **second host**: `/healthcheck` and `/ping` answer 200, and `iptables -S INPUT` carries no rule for 8000 — so a phone on the LAN needs no further setup. `download: true` on the root account is what makes offline listening work. |
| **Phone app** (token) | `POST /login` puts the bearer at **`user.token`**, not top level. `response.token` is empty, the client then sends `Authorization: Bearer ` with nothing after it, and every `/api/*` answers `401` as if the password were wrong — which it was not. |
| **LAN-only** law | Its consequence for clients is now written down: the Anubis + Authentik chain serves browsers, so guarding a vhost does **not** make the phone app work away from home. Remote listening wants a VPN into the LAN, after which the LAN address is still correct. |
No script, unit, or config touched — documentation only, and the password itself stays out of the repo as the secret rules require (the page keeps pointing at `~/.config/secrets/audiobookshelf`).
## Verification, 2026-11-03
- `./tests/run.sh` — **822 seams, all pass**.
- Service `audiobookshelf.service`: `active`, `NRestarts=0`, healthcheck 200.
- `POST /login` → HTTP 200 as `frank`, type `root`, `download: true`; library `Audiobooks` (folder `/audiobooks`, provider `audiobook`) reports **5,374 items**.
- Cross-host probe from the workstation: `/healthcheck` 200, `/ping` 200.
Branch is cut from current `origin/main`, independent of #126.
---
cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac99636f8bcb
The page told an agent how to sign in from a browser and nothing about the phone.
Measured 2026-11-03 on the deployed service:
- Server Address `http://192.168.0.235:8000`, user `frank`, plain HTTP, no base-path
prefix; `/healthcheck` and `/ping` answer 200 from a second host on the LAN and
`iptables -S INPUT` has no rule for 8000, so no phone-side setup is needed.
`download: true` on the root account is what enables offline listening.
- `POST /login` puts the bearer at `user.token`, not top level. Reading
`response.token` yields "", the client sends `Authorization: Bearer ` with nothing
after it, and every `/api/*` answers 401 as though the password were wrong — which
it was not. That is the failure I hit inside five minutes of scripting this.
- The LAN-only law gains its consequence for clients: the Anubis + Authentik chain
serves browsers, so guarding a vhost does not make the phone app work remotely.
Remote listening wants a VPN into the LAN; the LAN address is then still correct.
bats: 822 seams green.
dank
merged commit 5c888ff948 into main2026-11-02 19:11:24 -08:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
You asked how to connect the phone to Audiobookshelf. The page answered the browser case and was silent on the phone — and one of its doors bit me while I was scripting the check, so this closes both gaps.
What the page gains
http://192.168.0.235:8000, userfrank, plain HTTP, no base-path prefix. Reachability proven from a second host:/healthcheckand/pinganswer 200, andiptables -S INPUTcarries no rule for 8000 — so a phone on the LAN needs no further setup.download: trueon the root account is what makes offline listening work.POST /loginputs the bearer atuser.token, not top level.response.tokenis empty, the client then sendsAuthorization: Bearerwith nothing after it, and every/api/*answers401as if the password were wrong — which it was not.No script, unit, or config touched — documentation only, and the password itself stays out of the repo as the secret rules require (the page keeps pointing at
~/.config/secrets/audiobookshelf).Verification, 2026-11-03
./tests/run.sh— 822 seams, all pass.audiobookshelf.service:active,NRestarts=0, healthcheck 200.POST /login→ HTTP 200 asfrank, typeroot,download: true; libraryAudiobooks(folder/audiobooks, provideraudiobook) reports 5,374 items./healthcheck200,/ping200.Branch is cut from current
origin/main, independent of #126.cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac99636f8bcb