Calibre-Web 0.6.27

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened SRS Streaming Media Server & Media Servers AMIs listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for the full launch wizard). In Version, choose Calibre-Web 0.6.27 on Ubuntu 24.04, then choose your Region.
• Pick an instance type and your key pair. m5.large is recommended, and the software charge is $0.04 per vCPU per hour.
• Security group: the listing's default group opens SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address, and restrict ports 80 and 443 to the networks your readers use.
• Choose your VPC and subnet, leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run this command on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the VPC, subnet, key pair and CIDRs with your own:

SG=$(aws ec2 create-security-group --group-name calibre-web \
  --description "Calibre-Web e-book library" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr <your-mgmt-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=200,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=calibre-web}]'

The block device mapping grows the data volume (/dev/sdf, mounted at /var/lib/calibre-web) to 200 GiB for a larger library. Leave it out to keep 40 GiB.

You do not need --metadata-options, because the AMI already makes IMDSv2 required. Associate an Elastic IP if you want the address to survive a stop and start.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot takes about a minute after the instance starts. It sets the name that Calibre-Web is served as (the instance's public DNS name when it has one). It creates the TLS certificate, the keys, the settings database, the calibre library with the sample book, and the administrator password. It then writes /var/lib/sac/data/calibre-web-credentials.txt (mode 0600, root).

These are the entries in that file. The password is not shown here:

sudo grep -E '^(CALIBRE_WEB_URL|ADMIN_USERNAME)=' /var/lib/sac/data/calibre-web-credentials.txt
sudo grep -oE '^[A-Z_]+=' /var/lib/sac/data/calibre-web-credentials.txt
sudo stat -c '%a %U:%G %n' /var/lib/sac/data/calibre-web-credentials.txt

CALIBRE_WEB_URL=https://ec2-54-84-25-103.compute-1.amazonaws.com/ ADMIN_USERNAME=admin CALIBRE_WEB_URL= ADMIN_USERNAME= ADMIN_PASSWORD= 600 root:root /var/lib/sac/data/calibre-web-credentials.txt

The entries are:

• CALIBRE_WEB_URL: the address of this instance's Calibre-Web
• ADMIN_USERNAME: the administrator's user name (admin)
• ADMIN_PASSWORD: the administrator password, generated on this instance

To read the password, run sudo cat /var/lib/sac/data/calibre-web-credentials.txt in your own session and store the password in your password manager. Calibre-Web keeps only a hash of it.

Run the following checks. The two first-boot units should have finished, and Calibre-Web and nginx should be active. Only sshd and nginx listen beyond loopback. Calibre-Web, shown as cps, is on 127.0.0.1:8083, and the resolver is on 127.0.0.53:

systemctl is-active calibre-web-host.service calibre-web-firstboot.service calibre-web.service nginx.service
sudo ss -Htlnp | awk '{print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u cat /opt/calibre-web/VERSION

active active active active 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:8083 users:(("cps")) 127.0.0.53%lo:53 users:(("systemd-resolve")) 127.0.0.54:53 users:(("systemd-resolve")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx")) calibreweb_version=0.6.27 calibreweb_source=https://github.com/janeczku/calibre-web/tree/0.6.27 (PyPI: https://pypi.org/project/calibreweb/0.6.27/) calibre_version=9.18.0 calibre_source=https://download.calibre-ebook.com/9.18.0/calibre-9.18.0-x86_64.txz (sha512 3ebb6cb35d0f990e17e13b24bbe3dc62069dce47c72ac4624539c91e9c956ea2635215d0614153db17aab69e377a8b59d28fc30665732d62d34f27751dc04041) python=3.12.3 pip=26.3 requirements_sha256=a160e9516d49c65c3048a095e5fd28cad43b0697ced37c81ff58b8d82a2ad3b6 dependency_overrides=pypdf==6.21.4 certifi==2026.10.23 cryptography==50.0.2

These checks show the following:

• A signed-out visitor is sent to the sign-in page.
• A book download and the OPDS catalogue refuse a signed-out request.
• Registration does not exist.
• Plain HTTP redirects to HTTPS.
• An unknown Host header gets no answer.
• TLS 1.1 is not offered.

The last command is the image's own round-trip check. It signs in with this instance's administrator password, proves that a wrong password is refused, downloads the sample book, proves that a signed-out download is refused, and signs out:

H=$(sed -n 's/^set \$cw_host "\(.*\)";$/\1/p' /etc/nginx/calibre-web-hostvar.conf) C=(--connect-to ::127.0.0.1:) curl -sk "${C[@]}" -o /dev/null -w 'web app, signed out -> %{http_code}\n' "https://$H/" curl -sk "${C[@]}" -o /dev/null -w 'sign-in page -> %{http_code}\n' "https://$H/login" curl -sk "${C[@]}" -o /dev/null -w 'book download, signed out -> %{http_code}\n' "https://$H/download/1/epub/1" curl -sk "${C[@]}" -o /dev/null -w 'OPDS, signed out -> %{http_code}\n' "https://$H/opds" curl -sk "${C[@]}" -o /dev/null -w 'registration -> %{http_code}\n' "https://$H/register" curl -s "${C[@]}" -o /dev/null -w 'http -> %{http_code}\n' "http://$H/" curl -sk -o /dev/null -w 'unknown Host -> %{http_code}\n' -H 'Host: evil.example' https://127.0.0.1/ || true curl -sk "${C[@]}" -o /dev/null -w 'TLS 1.1 -> %{http_code}\n' --tlsv1.1 --tls-max 1.1 "https://$H/" || true
sudo calibre-web-selftest

web app, signed out -> 302 sign-in page -> 200 book download, signed out -> 302 OPDS, signed out -> 401 registration -> 404 http -> 301 unknown Host -> 000 TLS 1.1 -> 000 round-trip OK: admin signed in over https://ec2-54-84-25-103.compute-1.amazonaws.com/ (a wrong password was refused), book 1 listed with its cover and served as a 56583-byte EPUB, anonymous download refused (302), logout ended the session

--connect-to ::127.0.0.1: sends each request to this instance while keeping the real host name in the request, exactly as a browser would send it. A 302 for a signed-out visitor is the redirect to the sign-in page. A 000 means that the server closed the connection without an answer.

These commands show the versions that Calibre-Web's own environment resolves, the three expected pip check lines, and the calibre build that Calibre-Web uses. The versions are read with importlib.metadata as the calibreweb user, exactly as the running service sees them:

sudo -u calibreweb /opt/calibre-web/venv/bin/python -c 'import importlib.metadata as m for d in ("calibreweb", "pypdf", "certifi", "cryptography", "tornado"): print(d, m.version(d))' /opt/calibre-web/venv/bin/python -m pip check 2>&1 || true /opt/calibre/calibredb --version

calibreweb 0.6.27 pypdf 6.21.4 certifi 2026.10.23 cryptography 50.0.2 tornado 6.5.10 calibreweb 0.6.27 has requirement certifi<2026.5.21,>=2024.7.4, but you have certifi 2026.10.23. calibreweb 0.6.27 has requirement cryptography<48.0.0,>=39.0.0, but you have cryptography 50.0.2. calibreweb 0.6.27 has requirement PyPDF<6.11.0,>=6.1.3, but you have pypdf 6.21.4. calibredb (calibre 9.18)

The same versions appear on Calibre-Web's About page, which reads them from the running process. Open it from the About link in Admin.

Browse to CALIBRE_WEB_URL (https://<public-dns-name>/). The certificate is self-signed, so your browser warns once. Accept it for this host, or install your own certificate (Step 11).

Calibre-Web opens on its sign-in page. Sign in with ADMIN_USERNAME and ADMIN_PASSWORD.

Once you sign in, you land in the library. The sample book is already there, so you can see covers, metadata and the reader working before you add anything of your own.

The left-hand menu browses by author, series, category (tag), publisher, language, rating and format. Search Library and Advanced Search are in the top bar.

Select a cover to open the book's page, with its metadata, the Download buttons and Read in Browser:

Read in Browser opens the reader. The arrows at the sides (or the arrow keys) turn pages, the menu at the top left shows the table of contents, and the gear at the top right changes the font size and theme. Calibre-Web remembers where you stopped.

• Upload in the browser: choose Upload in the top bar and pick one or more files. Calibre-Web reads the title, authors, tags and cover from the file (for PDFs, from its document information and XMP metadata) and opens the book's edit page. There you can correct the metadata, give a cover image URL, or use Fetch Metadata to search the online metadata providers. Some providers (Google Books' anonymous API in particular) limit requests from shared cloud addresses, so a search can come back empty from one provider while others answer.
• Add many files at once: copy the files to the instance and add them with calibre's calibredb, as the calibreweb user, into the library on the data volume:

scp -r ~/Books ubuntu@<public-ip>:/tmp/
sudo chown -R calibreweb:calibreweb /tmp/Books
sudo -u calibreweb /opt/calibre/calibredb add --recurse --with-library /var/lib/calibre-web/library /tmp/Books

• Bring an existing calibre library: stop Calibre-Web (sudo systemctl stop calibre-web) and replace the contents of /var/lib/calibre-web/library with your library (the folder that holds metadata.db). Then run sudo chown -R calibreweb:calibreweb /var/lib/calibre-web/library, and start Calibre-Web again.

The library as it ships, on its own volume:

findmnt -no TARGET,FSTYPE,SIZE /var/lib/calibre-web
findmnt --fstab -no TARGET,FSTYPE,OPTIONS /var/lib/calibre-web
sudo ls /var/lib/calibre-web
sudo -u calibreweb /opt/calibre/calibredb list --with-library /var/lib/calibre-web/library -f title,authors,formats --for-machine

/var/lib/calibre-web ext4 39.1G /var/lib/calibre-web ext4 defaults,nofail config library lost+found [ { "authors": "sac", "formats": [ "/var/lib/calibre-web/library/sac/Getting Started with Calibre-Web (1)/Getting Started with Calibre-Web - sac.epub" ], "id": 1, "title": "Getting Started with Calibre-Web" } ]

You can delete the sample book whenever you like. Open it, choose Edit Metadata, then choose Delete Book.

Choose Admin in the top bar to open the administration page. It holds the user list, the e-mail server settings, the library configuration, and the switches for uploads, anonymous browsing, public registration, magic-link login and reverse-proxy login. On this image, all of these switches are off except uploads.

• Administrator password: change it from your user name in the top bar (the profile page). The credentials file is not updated, so remove the old password from it (sudo nano /var/lib/sac/data/calibre-web-credentials.txt) once you have stored the new one.
• Other readers: choose Add New User and tick the rights each one needs (download, upload, edit, delete, viewer). Give the admin right only to people who should manage users and settings.
• Send to e-reader: fill in Edit Email Server Settings with your SMTP server. The password is stored encrypted with this instance's own key. Each user sets their e-reader's address on their profile page.
• E-reader apps (OPDS): point an OPDS app at https://<your-name>/opds and sign in with a Calibre-Web user name and password (HTTP Basic authentication over HTTPS). Apps generally need a certificate that the device trusts, so set up your DNS name and certificate first (Step 11).

These commands show the following:

• Calibre-Web, its first-boot unit and nginx carry IPAddressDeny for the metadata addresses.
• First boot recorded that it could not reach the metadata service from inside its own unit.
• Calibre-Web runs sandboxed as calibreweb.
• SSH runs with the SecureAnyCloud pins.

Run:

systemctl show -p IPAddressDeny calibre-web.service calibre-web-firstboot.service nginx.service
systemctl show -p User -p ProtectSystem -p ProtectHome -p NoNewPrivileges calibre-web.service
sudo grep -o 'IMDS-REFUSED-IN-FIRSTBOOT.*' /var/log/sac/sac-firstboot.log
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|x11forwarding) '

IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32 IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32 IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32 User=calibreweb ProtectHome=yes ProtectSystem=strict NoNewPrivileges=yes IMDS-REFUSED-IN-FIRSTBOOT (http 000; IPAddressDeny in effect) permitrootlogin no passwordauthentication no x11forwarding no

Point a DNS record (for example books.example.com) at the instance's public or Elastic IP address, then tell the image to serve that name. The helper creates a new self-signed certificate for the name and pins nginx and the cross-site guard to it. It also updates CALIBRE_WEB_URL in the credentials file and keeps the name across reboots:

sudo calibre-web-set-hostname books.example.com

For a trusted certificate, obtain one for that name. For example, use certbot's certonly mode with its own temporary web server, or get one from your organisation's CA.

Copy the certificate chain and key over /etc/ssl/calibre-web/calibre-web.crt and /etc/ssl/calibre-web/calibre-web.key (key mode 0600, root). Then run sudo systemctl reload nginx.