Frank
22204b49f5
Only the 8084 forward is exposed; the desktop GUI runs inside the container netns and is internal-only. Drop the now-unneeded CUSTOM_HTTPS_PORT (no host-port conflict exists inside the netns).
92 lines
4.5 KiB
Markdown
92 lines
4.5 KiB
Markdown
# Calibre
|
|
|
|
Calibre is the e-book library manager that backs Calibre-Web. It manages metadata, formats, and conversions for the library that Calibre-Web serves.
|
|
|
|
**Host:** Dankserver (library directory on host) — **Docs:** https://calibre-ebook.com
|
|
|
|
## Role in this Stack
|
|
|
|
Calibre itself is a desktop/GUI application, not a container service. This stack runs **Calibre-Web** in a container and points it at an existing Calibre library directory on the Dankserver host.
|
|
|
|
Calibre is used to:
|
|
- Import books into the library (drag-and-drop or CLI `calibredb`)
|
|
- Edit metadata (author, title, series, tags, cover art)
|
|
- Convert between formats (EPUB → MOBI, MOBI → EPUB, etc.)
|
|
- Manage collections and reading lists
|
|
|
|
The actual library files (`.epub`, `.mobi`, `.pdf`) and the Calibre database (`.db` file) live on the host filesystem. Calibre-Web reads and writes them through the mounted volume.
|
|
|
|
## Current Version
|
|
|
|
Calibre 9.2.1 is the version on the live host (9.9.0 is the upstream latest). Major features include:
|
|
- Bookshelf view
|
|
- Opt-in AI features
|
|
- Content server security fix (CVE-2025-7404 equivalent): a bug since v6.16.0 allows any user with server access to read non-Calibre files on the host. Upgrade to 9.9.0+ if serving content to untrusted users.
|
|
|
|
## Library Directory
|
|
|
|
The live Calibre-Web container bind-mounts the library at `/books`:
|
|
|
|
| Purpose | Host path (live) |
|
|
|---------|------------------|
|
|
| Calibre library | `/home/dank/Containers/calibre-web/books` → `/books` in the Calibre-Web container |
|
|
|
|
(The older `/opt/calibre-web/books` path was the compose-era location and is
|
|
gone; the quadlet unit mounts the Containers data root.)
|
|
|
|
## What the Container Needs
|
|
|
|
- Read/write access to the library directory. Calibre-Web edits metadata through the database file.
|
|
- Ownership matching `PUID=1000` / `PGID=1000` (the `dank` user on Dankserver).
|
|
|
|
## Calibre Content Server (running)
|
|
|
|
Calibre includes a built-in HTTP content server (`calibre-server`) that serves
|
|
the library via OPDS feeds and a web interface:
|
|
- OPDS feeds for mobile reading apps (FBReader, Moon+ Reader, KyBook)
|
|
- Web UI for browsing, metadata editing, and uploads
|
|
- Direct device push (from the GUI, not the content server)
|
|
|
|
**Live shape (deployed 2026-09-21):** a rootless Quadlet unit
|
|
(`dankserver/calibre-server/quadlet/calibre-server.container`), boot-persistent
|
|
and self-healing, on `lscr.io/linuxserver/calibre:9.15.0`.
|
|
|
|
The image is the current **desktop** build (Selkies web-streamed GUI), not the
|
|
headless image the old compose snippet assumed — the dedicated headless images
|
|
(ta264/docker-calibre, agentgreen/calibre-server) are dormant (calibre 6.10 /
|
|
2017, both below the 9.9.0 content-server fix). The unit therefore runs
|
|
`calibre-server` as the image's s6-overlay main service via `Exec=`.
|
|
|
|
| Surface | Host port | Auth |
|
|
|---------|-----------|------|
|
|
| Content server (OPDS + web UI) | **8084** (internal 8090) | HTTP Basic, single admin `calibre` in the SQLite userdb |
|
|
| Desktop GUI (internal only) | none (8080/8181/8082 inside the container) | HTTP Basic ready (`CUSTOM_USER`/`CUSTOM_PASSWORD` in the env file) |
|
|
|
|
Port notes: `Network=pasta` on this host is port-FORWARD mode — the container
|
|
keeps its own netns and only `PublishPort`'d ports reach the host (verified
|
|
2026-09-21). The desktop GUI runs but is unreachable: exposing the browser
|
|
GUI is one `PublishPort` line away. 8080 *inside* the container is the
|
|
image's own nginx (the desktop), so the content server runs on internal 8090.
|
|
|
|
**Auth model (calibre 9.x):** users live in a SQLite userdb whose `pw` column
|
|
is **plaintext** — the file is mode 600. The single admin account is
|
|
bootstrapped once by the deploy handler
|
|
(`deploy_calibre_server` in `scripts/deploy-remote.sh`) via
|
|
`calibre-server --manage-users -- add`, the password piped on stdin with
|
|
`printf` (a trailing newline from `echo` lands in the stored password and
|
|
breaks every login). The desktop's basic auth (`CUSTOM_USER`/`CUSTOM_PASSWORD`)
|
|
reuses the same pair. Both live in the machine-local env file
|
|
`/home/dank/Containers/calibre-server/env` (mode 600); the repo holds no
|
|
secrets. `--auth-mode=basic` is pinned: on a non-SSL port the server defaults
|
|
to Digest auth, which rejects plain Basic clients with
|
|
`400 Unsupported authentication method`.
|
|
|
|
LAN-only (no vhost, no public DNS). The library is mounted read-write — the
|
|
content server writes metadata, the same library Calibre-Web uses.
|
|
|
|
## See Also
|
|
|
|
- [[Calibre-Web]] — the containerized frontend
|
|
- [[Dankserver Stack]]
|
|
- [[ARR-Stack]] — Readarr for automatic ebook downloads
|