BookLore

Search the Azure Marketplace for BookLore, choose the plan, and create the VM.

In the networking step, attach a network security group (NSG) that allows inbound TCP 22 (SSH) and TCP 80 (the web console) from your client networks only. Put a TLS reverse proxy in front of port 80 for production.

No other port needs to be open. MariaDB and the application's own port 6060 both listen on the loopback interface, so nginx is the only ingress.

RG="booklore-prod"; LOCATION="eastus"; VM_NAME="booklore-01" IMAGE_URN="sac1647283583153:booklore-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name bl-vnet --address-prefix 10.113.0.0/16 --subnet-name bl-subnet --subnet-prefix 10.113.1.0/24 az network nsg create -g "$RG" --name bl-nsg az network nsg rule create -g "$RG" --nsg-name bl-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name bl-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:booklore-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name bl-vnet --subnet bl-subnet --nsg bl-nsg --public-ip-sku Standard

The library data disk is part of the image, so it is created and mounted for you automatically. You do not need to attach an extra disk.

ssh azureuser@<vm-ip>

All services start automatically on first boot, after booklore-firstboot.service has generated this instance's secrets and claimed the administrator. First boot typically completes within a minute of the VM reporting ready.

sudo systemctl is-active mariadb booklore nginx
sudo test -f /var/lib/sac/data/booklore-firstboot.done && echo FIRSTBOOT_DONE
sudo ss -tlnH | awk '{print $1, $4}' | sort -u

Expected output: all three units are active and first boot has completed. Only SSH and nginx are on a public address, while the application and the database stay on loopback:

active active active FIRSTBOOT_DONE LISTEN 0.0.0.0:22 LISTEN 0.0.0.0:80 LISTEN 127.0.0.1:3306 LISTEN 127.0.0.53%lo:53 LISTEN 127.0.0.54:53 LISTEN [::]:22 LISTEN [::]:80 LISTEN [::ffff:127.0.0.1]:6060

Only SSH and nginx are on a public address. MariaDB is on 127.0.0.1:3306, and the two port 53 entries are the local systemd-resolved DNS stub.

The application itself is on [::ffff:127.0.0.1]:6060. This is the IPv4-mapped form of 127.0.0.1, so port 6060 is reachable only from the VM itself and nginx is the sole ingress.

Every instance generates its own administrator password and database password on first boot and writes them to a root-only file:

sudo ls -l /root/booklore-credentials.txt
sudo cat /root/booklore-credentials.txt

The file is mode 600, owned by root. It contains the console URL, the administrator username and password, and the database credentials.

Sign in with those values. Then change the administrator email address and password under Settings > Users.

BookLore creates its first administrator through a one-time setup endpoint that the API accepts only while no users exist. This image claims that administrator during first boot, before nginx starts, so nobody can reach your instance and claim it first. Confirm that the setup endpoint is closed:

curl -s http://127.0.0.1/api/v1/setup/status

Expected output (setup has already been completed on this instance):

{"data":true,"message":"Initial setup has already been completed.","status":200,"timestamp":"..."}

A protected endpoint must refuse an anonymous caller and a forged token:

curl -s -o /dev/null -w 'anonymous: %{http_code}\n' http://127.0.0.1/api/v1/users/me
curl -s -o /dev/null -w 'forged token: %{http_code}\n' http://127.0.0.1/api/v1/users/me \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJub2JvZHkifQ.not-a-valid-signature'

Expected output:

anonymous: 403 forged token: 401

curl -s http://127.0.0.1/api/v1/healthcheck df -h /var/lib/booklore free -m swapon --show

The health endpoint reports the running version, and the dedicated 64 GiB library volume is mounted. The whole stack sits comfortably inside 4 GB. swapon --show prints nothing because the image ships with no swap at all.

Browse to http://<vm-ip>/ and sign in with the administrator username and password from the credentials file.

Create a library from the Libraries section of the sidebar and point it at a folder on the data volume, for example /var/lib/booklore/books. Copy your EPUB, PDF or CBZ files there. BookLore scans them, extracts titles, authors and covers, and shelves them.

sudo install -d -o booklore -g booklore -m 0750 /var/lib/booklore/books ls -ld /var/lib/booklore/books /var/lib/booklore/bookdrop

Then copy your own files in and hand them to the booklore user. Replace the source path with your own:

sudo cp ~/my-collection/*.epub /var/lib/booklore/books/
sudo chown -R booklore:booklore /var/lib/booklore/books

You can also drop files into the watched auto-import folder at /var/lib/booklore/bookdrop, or upload them from the browser with the upload button in the toolbar.

The All Books view shows the shelved collection with covers. Use the filter panel to narrow by author, format, read status, publisher or year.

Click any book to open it in the built-in reader. EPUB, PDF and comic formats all render in the browser, with per-user reading position, bookmarks and a progress indicator. You can stop on one device and resume on another.

Settings exposes reader preferences per format, metadata provider configuration, user administration, email delivery, OIDC single sign-on and the task manager.

Create an account for each reader under Settings > Users and give them only the permissions they need. Each user keeps their own shelves and reading progress.

BookLore also serves an OPDS catalog and supports Kobo and KOReader sync, so the same library is reachable from a dedicated e-reader. Metadata fetching from providers such as Amazon, GoodReads, Google and Open Library requires outbound internet access from the VM. It is optional and disabled until you configure it.

Component Detail

Application booklore.service, Spring Boot on Temurin JDK 25, 127.0.0.1:6060

Web console Angular 21, compiled into the same artifact and served by the application

Database MariaDB 10.11, 127.0.0.1:3306, database and role booklore

Reverse proxy nginx.service on TCP 80

Library volume 64 GiB disk mounted at /var/lib/booklore (books/, data/, bookdrop/)

Application jar /opt/booklore/app.jar

Environment file /etc/booklore/booklore.env (mode 640, generated at first boot)

Credentials /root/booklore-credentials.txt (mode 600)

Corresponding source /opt/booklore/src and /usr/share/booklore/source/

The Java heap is pinned at 1 GB and MariaDB's buffer pool at 192 MB, so the two never contend on a 2 vCPU instance.

If you move to a larger VM and want to raise the heap, edit ExecStart in /etc/systemd/system/booklore.service. Then run sudo systemctl daemon-reload && sudo systemctl restart booklore.

BookLore is licensed under the GNU Affero General Public License version 3. Section 13 requires that anyone interacting with the program over a network is offered the corresponding source of the running version. This instance satisfies that on disk, with no network access required:

cat /usr/share/doc/booklore/SOURCE-OFFER.txt cd /usr/share/booklore/source && sha256sum -c booklore-2.3.1-source.tar.gz.sha256

The complete unmodified v2.3.1 source tree that produced the running jar is at /opt/booklore/src, a pristine release tarball is at /usr/share/booklore/source/, the license text is at /usr/share/doc/booklore/LICENSE, and the written offer names all of them.

SecureAnyCloud makes no modifications to BookLore itself. This image supplies only configuration, systemd units, an nginx vhost and the first-boot credential bootstrap.

One packaging decision is worth noting. The upstream container vendors a prebuilt unrar binary whose license forbids reuse of its code, so this image deliberately omits it. BookLore detects its absence and falls back to its bundled pure-Java RAR reader, so EPUB, PDF and CBZ are unaffected. If you need RAR5-era CBR files, install a RAR reader yourself and point BOOKLORE_UNRAR_BIN at it.

A quick health check of the whole stack:

sudo systemctl is-active mariadb booklore nginx
sudo nginx -t

For deeper investigation, read the service journals. They print a lot of output, so run them on their own:

sudo systemctl status booklore
sudo journalctl -u booklore -n 100 --no-pager sudo journalctl -u booklore-firstboot --no-pager

The application reads its environment from /etc/booklore/booklore.env. After editing it, restart the service with sudo systemctl restart booklore.

Database maintenance reads this instance's password straight from the credentials file, so you have nothing to type or paste:

sudo mariadb -u booklore \
  -p"$(sudo sed -n 's/^booklore\.db\.pass=//p' /root/booklore-credentials.txt)" \
  booklore -e "SELECT COUNT(*) AS books FROM book;"

To back up the library, snapshot the data volume and dump the database the same way:

sudo mariadb-dump -u booklore \
  -p"$(sudo sed -n 's/^booklore\.db\.pass=//p' /root/booklore-credentials.txt)" \
  booklore > ~/booklore-backup.sql