Frank
272ef6f0b0
Phase 1/2 of the podman standardization plan: service pages updated to the quadlet reality (units, Containers data roots, env-file secret convention, the v1-generator findings each caught live), Storage Policy documents the two rootless ownership regimes and the merge-move migration, Deployment Flow's service-manager table no longer claims dankserver media is bare inventory-only. Bundle change log entry added.
102 lines
4.2 KiB
Markdown
102 lines
4.2 KiB
Markdown
# Calibre-Web
|
|
|
|
Calibre-Web is a web application that browses, reads, and downloads eBooks from an existing Calibre library database. It serves as the web frontend for the Calibre e-book manager.
|
|
|
|
**Host:** Dankserver — **Hostname:** `books.dankserver.local` — **Docs:** https://github.com/linuxserver/docker-calibre-web
|
|
|
|
## Facts
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Latest version | 0.6.25-ls365 (live); 0.6.27-ls397 upstream |
|
|
| Image | `lscr.io/linuxserver/calibre-web:latest` (live: 0.6.25-ls365) |
|
|
| Base OS | Ubuntu Noble (24.04 LTS, since 2024-12-05) |
|
|
| Port | 8083 (host) → 8083 (container) |
|
|
| Default login | `admin` / `admin123` |
|
|
| Docker mod | `linuxserver/mods:universal-calibre` (ebook conversion, x86-64 only) |
|
|
| Volumes | `/config` (internal database + config), `/books` (existing Calibre library) |
|
|
| Extra tools | `unrar` at `/usr/bin/unrar`, `kepubify` at `/usr/bin/kepubify` (pre-configured since 2025-01-07) |
|
|
|
|
## CVEs Fixed in Latest Version
|
|
|
|
| CVE | Issue |
|
|
|-----|-------|
|
|
| CVE-2025-7404 | External binary names (e.g. `unrar`) restricted to prevent RCE |
|
|
| — | XSS in book comments imported via Calibre, now sanitized |
|
|
|
|
Additional packages added: `libxfixes3` and `libasound2t64` to support epub-to-pdf conversion. The `--no-sandbox` flag is applied to qtwebengine to prevent crashes in Docker.
|
|
|
|
## Configuration
|
|
|
|
### Environment Variables
|
|
|
|
| Variable | Value | Description |
|
|
|----------|-------|-------------|
|
|
| `PUID` | `1000` | User ID |
|
|
| `PGID` | `1000` | Group ID |
|
|
| `TZ` | `Etc/UTC` | Timezone |
|
|
| `DOCKER_MODS` | `linuxserver/mods:universal-calibre` | Optional: enables ebook conversion tools |
|
|
| `OAUTHLIB_RELAX_TOKEN_SCOPE` | `1` | Required for Google OAuth |
|
|
|
|
### Setup Steps
|
|
|
|
1. Point the container at the Calibre library directory (set the `/books` volume).
|
|
2. Log in with `admin` / `admin123` and change the password immediately.
|
|
3. In Basic Configuration → Calibre Database → set Location of Calibre database to `/books`.
|
|
4. In Basic Configuration → External Binaries → set the directory to `/usr/bin/` for Calibre-Web >= 0.6.22.
|
|
5. **kepubify is pre-configured** since version 0.6.27. No need to set the kepubify path manually.
|
|
6. Set up Google OAuth if desired (requires `OAUTHLIB_RELAX_TOKEN_SCOPE=1`).
|
|
|
|
## Volumes
|
|
|
|
| Container path | Host path |
|
|
|----------------|-----------|
|
|
| `/config` | `/home/dank/Containers/calibre-web/config` |
|
|
| `/books` | `/home/dank/Containers/calibre-web/books` |
|
|
|
|
Deployment since 2026-09-01 is a quadlet unit
|
|
(`dankserver/calibre-web/quadlet/calibre-web.container` →
|
|
`calibre-web.service`, deploy with
|
|
`./scripts/deploy.sh dankserver --service calibre-web`), image pinned to
|
|
`0.6.27-ls397`, healthcheck on `/`, `PublishPort=8083:8083`. This service was
|
|
already on the Containers data-root layout before the standardization, so the
|
|
cutover was a bare-container retire + unit start with no data movement.
|
|
|
|
## Docker Compose (reference — retired 2026-09-01; live mounts are under `/home/dank/Containers/calibre-web`)
|
|
|
|
```yaml
|
|
services:
|
|
calibre-web:
|
|
image: lscr.io/linuxserver/calibre-web:0.6.27-ls397
|
|
container_name: calibre-web
|
|
restart: unless-stopped
|
|
environment:
|
|
PUID: "1000"
|
|
PGID: "1000"
|
|
TZ: Etc/UTC
|
|
OAUTHLIB_RELAX_TOKEN_SCOPE: "1"
|
|
ports:
|
|
- "8083:8083"
|
|
volumes:
|
|
- /opt/calibre-web/config:/config
|
|
- /opt/calibre-web/books:/books
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8083/"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
```
|
|
|
|
## Gotchas
|
|
|
|
- **Wrong database path:** Login appears to succeed but the library is empty. Verify the Calibre database path in the admin page.
|
|
- **Ebook conversion:** Requires the `universal-calibre` Docker mod AND the external binary path set to `/usr/bin/` (directory, not full path to `ebook-convert`).
|
|
- **Google OAuth:** Set `OAUTHLIB_RELAX_TOKEN_SCOPE=1` or OAuth login fails.
|
|
- **calibre 9.9.0 content server security fix:** A bug since v6.16.0 allows any user with server access to read non-Calibre files on the host. Upgrade to 9.9.0+ if serving content to untrusted users.
|
|
|
|
## See Also
|
|
|
|
- [[Dankserver Stack]]
|
|
- [[Calibre]] — the underlying library engine (host tool, not a container)
|
|
- [[ARR-Stack]] — Readarr for automatic ebook downloads into the Calibre library
|