Files

T

Frank 22204b49f5 docs(calibre-server): correct the port map - pasta is port-forward mode

Only the 8084 forward is exposed; the desktop GUI runs inside the
container netns and is internal-only. Drop the now-unneeded
CUSTOM_HTTPS_PORT (no host-port conflict exists inside the netns).

2026-09-21 12:51:06 -07:00

4.5 KiB

Raw Blame History

Calibre

Calibre is the e-book library manager that backs Calibre-Web. It manages metadata, formats, and conversions for the library that Calibre-Web serves.

Host: Dankserver (library directory on host) — Docs: https://calibre-ebook.com

Role in this Stack

Calibre itself is a desktop/GUI application, not a container service. This stack runs Calibre-Web in a container and points it at an existing Calibre library directory on the Dankserver host.

Calibre is used to:

Import books into the library (drag-and-drop or CLI calibredb)
Edit metadata (author, title, series, tags, cover art)
Convert between formats (EPUB → MOBI, MOBI → EPUB, etc.)
Manage collections and reading lists

The actual library files (.epub, .mobi, .pdf) and the Calibre database (.db file) live on the host filesystem. Calibre-Web reads and writes them through the mounted volume.

Current Version

Calibre 9.2.1 is the version on the live host (9.9.0 is the upstream latest). Major features include:

Bookshelf view
Opt-in AI features
Content server security fix (CVE-2025-7404 equivalent): a bug since v6.16.0 allows any user with server access to read non-Calibre files on the host. Upgrade to 9.9.0+ if serving content to untrusted users.

Library Directory

The live Calibre-Web container bind-mounts the library at /books:

Purpose	Host path (live)
Calibre library	`/home/dank/Containers/calibre-web/books` → `/books` in the Calibre-Web container

(The older /opt/calibre-web/books path was the compose-era location and is gone; the quadlet unit mounts the Containers data root.)

What the Container Needs

Read/write access to the library directory. Calibre-Web edits metadata through the database file.
Ownership matching PUID=1000 / PGID=1000 (the dank user on Dankserver).

Calibre Content Server (running)

Calibre includes a built-in HTTP content server (calibre-server) that serves the library via OPDS feeds and a web interface:

OPDS feeds for mobile reading apps (FBReader, Moon+ Reader, KyBook)
Web UI for browsing, metadata editing, and uploads
Direct device push (from the GUI, not the content server)

Live shape (deployed 2026-09-21): a rootless Quadlet unit (dankserver/calibre-server/quadlet/calibre-server.container), boot-persistent and self-healing, on lscr.io/linuxserver/calibre:9.15.0.

The image is the current desktop build (Selkies web-streamed GUI), not the headless image the old compose snippet assumed — the dedicated headless images (ta264/docker-calibre, agentgreen/calibre-server) are dormant (calibre 6.10 / 2017, both below the 9.9.0 content-server fix). The unit therefore runs calibre-server as the image's s6-overlay main service via Exec=.

Surface	Host port	Auth
Content server (OPDS + web UI)	8084 (internal 8090)	HTTP Basic, single admin `calibre` in the SQLite userdb
Desktop GUI (internal only)	none (8080/8181/8082 inside the container)	HTTP Basic ready (`CUSTOM_USER`/`CUSTOM_PASSWORD` in the env file)

Port notes: Network=pasta on this host is port-FORWARD mode — the container keeps its own netns and only PublishPort'd ports reach the host (verified 2026-09-21). The desktop GUI runs but is unreachable: exposing the browser GUI is one PublishPort line away. 8080 inside the container is the image's own nginx (the desktop), so the content server runs on internal 8090.

Auth model (calibre 9.x): users live in a SQLite userdb whose pw column is plaintext — the file is mode 600. The single admin account is bootstrapped once by the deploy handler (deploy_calibre_server in scripts/deploy-remote.sh) via calibre-server --manage-users -- add, the password piped on stdin with printf (a trailing newline from echo lands in the stored password and breaks every login). The desktop's basic auth (CUSTOM_USER/CUSTOM_PASSWORD) reuses the same pair. Both live in the machine-local env file /home/dank/Containers/calibre-server/env (mode 600); the repo holds no secrets. --auth-mode=basic is pinned: on a non-SSL port the server defaults to Digest auth, which rejects plain Basic clients with 400 Unsupported authentication method.

LAN-only (no vhost, no public DNS). The library is mounted read-write — the content server writes metadata, the same library Calibre-Web uses.

4.5 KiB Raw Blame History