Frank
58184008dd
Container images re-resolved against their registries today; each pin is the manifest-list digest the tag answers now, so no container is served from a build that upstream has already replaced. Version-tag moves: authentik 2026.8.3 -> 2026.8.5 (server/worker/outpost and the ldap image, which now carries the tag instead of a bare digest so the pair can never drift apart), seerr v3.4.1 -> v3.5.1, calibre 9.15.0 -> 9.17.0, calibre-web 0.6.27-ls402 -> ls407, plex ls329 -> ls330, tautulli v2.18.1-ls245 -> v2.18.2-ls250. Digest-only moves inside the same stream: postgres 16-alpine, mariadb 11, redis 7-alpine, valkey 9-alpine, grafana, alertmanager, gluetun, searxng, open-webui, jellyfin, romm, chromedp/headless-shell, lightpanda/browser. Rollback is the previous digest on the same Image= line.
64 lines
2.9 KiB
INI
64 lines
2.9 KiB
INI
# Quadlet unit: Calibre Content Server (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankserver:
|
|
# ~/.config/containers/systemd/calibre-server.container
|
|
# Unit name: calibre-server.service (podman 5.x drops the container- prefix)
|
|
#
|
|
# The image is the CURRENT linuxserver/calibre (9.15.0), which is a desktop
|
|
# image (Selkies web-streamed GUI on 8080/8181) with the headless
|
|
# calibre-server available inside. The compose-era snippet in
|
|
# serverAppConfigs-docs/Dankserver/Calibre.md predates the desktop revamp;
|
|
# the dedicated headless images (ta264/docker-calibre, agentgreen) are
|
|
# dormant (calibre 6.10 / 2017), so this unit runs calibre-server as the
|
|
# image's s6-overlay main service via Exec=; the desktop also runs but its
|
|
# ports are internal-only (see the port map below).
|
|
#
|
|
# Port map: Network=pasta is port-FORWARD mode on this host (the container
|
|
# keeps its own netns; only PublishPort'd ports reach the host — verified
|
|
# 2026-09-21: 8080/8090/8182 inside the container are not visible on the
|
|
# host, only the 8084 forward). So the ONLY exposed surface is:
|
|
# 8090 -> host 8084 calibre-server (the content server; 8080 inside the
|
|
# container is the image's own nginx, 8083 on the host
|
|
# is calibre-web)
|
|
# The desktop GUI (nginx 8080/8181 + WS 8082, inside the container) runs but
|
|
# is internal-only: no PublishPort. Exposing it is one PublishPort line away
|
|
# if the browser GUI is ever wanted (the basic-auth credential is already in
|
|
# the env file).
|
|
# Auth: calibre-server 9.x keeps its users in a SQLite userdb (the pw column
|
|
# is PLAINTEXT, so the file is mode 600). The single admin account is
|
|
# bootstrapped once by the deploy handler (deploy_calibre_server) via
|
|
# `calibre-server --manage-users -- add`, password piped on stdin with
|
|
# printf (a trailing newline from echo lands in the stored password and
|
|
# breaks every login). The desktop's basic auth (CUSTOM_USER/CUSTOM_PASSWORD)
|
|
# reuses the same credential pair. Both live in the machine-local env file;
|
|
# this unit holds no secrets.
|
|
#
|
|
# --auth-mode=basic is required: on a non-SSL port the server defaults to
|
|
# Digest auth, which rejects plain Basic clients with 400 "Unsupported
|
|
# authentication method".
|
|
|
|
[Unit]
|
|
Description=Calibre content server container
|
|
After=network.target
|
|
|
|
[Container]
|
|
ContainerName=calibre-server
|
|
Image=lscr.io/linuxserver/calibre:9.17.0@sha256:b198fc03a6abc6be7e251a9958e50e74634b00e447c7b25e92c191c8077ba378
|
|
Network=pasta
|
|
EnvironmentFile=/home/dank/Containers/calibre-server/env
|
|
Environment=PUID=1000
|
|
Environment=PGID=1000
|
|
Environment=TZ=America/Vancouver
|
|
Volume=/home/dank/Containers/calibre-web/books:/books
|
|
Volume=/home/dank/Containers/calibre-server/userdb.sqlite:/userdb.sqlite
|
|
Exec=calibre-server --port 8090 --enable-auth --auth-mode=basic --userdb /userdb.sqlite /books
|
|
PublishPort=8084:8090
|
|
|
|
[Service]
|
|
TimeoutStartSec=300
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|