Files

T

Frank 272ef6f0b0 docs: record quadlet standardization of dankserver media + dankclaw data roots

Phase 1/2 of the podman standardization plan: service pages updated to the
quadlet reality (units, Containers data roots, env-file secret convention,
the v1-generator findings each caught live), Storage Policy documents the
two rootless ownership regimes and the merge-move migration, Deployment
Flow's service-manager table no longer claims dankserver media is bare
inventory-only. Bundle change log entry added.

2026-09-01 13:57:33 -07:00

4.2 KiB

Raw Blame History

Calibre-Web

Calibre-Web is a web application that browses, reads, and downloads eBooks from an existing Calibre library database. It serves as the web frontend for the Calibre e-book manager.

Host: Dankserver — Hostname: books.dankserver.local — Docs: https://github.com/linuxserver/docker-calibre-web

Facts

Item	Value
Latest version	0.6.25-ls365 (live); 0.6.27-ls397 upstream
Image	`lscr.io/linuxserver/calibre-web:latest` (live: 0.6.25-ls365)
Base OS	Ubuntu Noble (24.04 LTS, since 2024-12-05)
Port	8083 (host) → 8083 (container)
Default login	`admin` / `admin123`
Docker mod	`linuxserver/mods:universal-calibre` (ebook conversion, x86-64 only)
Volumes	`/config` (internal database + config), `/books` (existing Calibre library)
Extra tools	`unrar` at `/usr/bin/unrar`, `kepubify` at `/usr/bin/kepubify` (pre-configured since 2025-01-07)

CVEs Fixed in Latest Version

CVE	Issue
CVE-2025-7404	External binary names (e.g. `unrar`) restricted to prevent RCE
—	XSS in book comments imported via Calibre, now sanitized

Additional packages added: libxfixes3 and libasound2t64 to support epub-to-pdf conversion. The --no-sandbox flag is applied to qtwebengine to prevent crashes in Docker.

Configuration

Environment Variables

Variable	Value	Description
`PUID`	`1000`	User ID
`PGID`	`1000`	Group ID
`TZ`	`Etc/UTC`	Timezone
`DOCKER_MODS`	`linuxserver/mods:universal-calibre`	Optional: enables ebook conversion tools
`OAUTHLIB_RELAX_TOKEN_SCOPE`	`1`	Required for Google OAuth

Setup Steps

Point the container at the Calibre library directory (set the /books volume).
Log in with admin / admin123 and change the password immediately.
In Basic Configuration → Calibre Database → set Location of Calibre database to /books.
In Basic Configuration → External Binaries → set the directory to /usr/bin/ for Calibre-Web >= 0.6.22.
kepubify is pre-configured since version 0.6.27. No need to set the kepubify path manually.
Set up Google OAuth if desired (requires OAUTHLIB_RELAX_TOKEN_SCOPE=1).

Volumes

Container path	Host path
`/config`	`/home/dank/Containers/calibre-web/config`
`/books`	`/home/dank/Containers/calibre-web/books`

Deployment since 2026-09-01 is a quadlet unit (dankserver/calibre-web/quadlet/calibre-web.container → calibre-web.service, deploy with ./scripts/deploy.sh dankserver --service calibre-web), image pinned to 0.6.27-ls397, healthcheck on /, PublishPort=8083:8083. This service was already on the Containers data-root layout before the standardization, so the cutover was a bare-container retire + unit start with no data movement.

Docker Compose (reference — retired 2026-09-01; live mounts are under `/home/dank/Containers/calibre-web`)

services:
  calibre-web:
    image: lscr.io/linuxserver/calibre-web:0.6.27-ls397
    container_name: calibre-web
    restart: unless-stopped
    environment:
      PUID: "1000"
      PGID: "1000"
      TZ: Etc/UTC
      OAUTHLIB_RELAX_TOKEN_SCOPE: "1"
    ports:
      - "8083:8083"
    volumes:
      - /opt/calibre-web/config:/config
      - /opt/calibre-web/books:/books
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8083/"]
      interval: 30s
      timeout: 10s
      retries: 3

Gotchas

Wrong database path: Login appears to succeed but the library is empty. Verify the Calibre database path in the admin page.
Ebook conversion: Requires the universal-calibre Docker mod AND the external binary path set to /usr/bin/ (directory, not full path to ebook-convert).
Google OAuth: Set OAUTHLIB_RELAX_TOKEN_SCOPE=1 or OAuth login fails.
calibre 9.9.0 content server security fix: A bug since v6.16.0 allows any user with server access to read non-Calibre files on the host. Upgrade to 9.9.0+ if serving content to untrusted users.

4.2 KiB Raw Blame History