Deployment guide

Calibre-Web

Overview

Calibre-Web is a clean, modern, open source web interface for browsing, reading and downloading the books in a Calibre ebook library. From an ordinary browser you get an in-browser reader, full text search, custom shelves, per-user accounts, Kobo sync and an OPDS feed, so dedicated reading apps can pull straight from your library. It is a distinct web frontend project, separate from the Calibre desktop application.

The SecureAnyCloud image serves Calibre-Web 0.6.26 behind an nginx reverse proxy on a hardened Ubuntu 24.04 LTS base, patched at build time. The application server listens only on the loopback interface (127.0.0.1:8083), and nginx serves it on port 80. An empty Calibre library is already initialized, so there is no first-run setup wizard. You sign in and start uploading books.

A unique administrator password is generated on the first boot of every VM and written to a root-only file, so no shared or default login ever ships in the image.

What you get:

Calibre-Web 0.6.26 served behind nginx, managed by systemd
The Calibre-Web web interface on :80 with authentication required from the first request
A per-VM administrator password generated on first boot and recorded in a root-only file
An empty Calibre library pre-initialized at /var/lib/calibre-web/library, with the settings database pre-seeded so no setup wizard appears
The calibredb command-line tools for managing the library from the shell
The application server bound to 127.0.0.1:8083 only, never exposed directly to the network
A dedicated Azure data disk at /var/lib/calibre-web for the library and the settings database
calibre-web.service and nginx.service as enabled systemd units
An OPDS feed at /opds for dedicated reading apps
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Size up for larger libraries or more concurrent readers.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Calibre-Web serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain.

The application server is never exposed directly. It listens on 127.0.0.1:8083 only, so port 8083 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for Calibre-Web by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab. Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:calibre-web-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name calibre-web \
  --image sac1647283583153:calibre-web-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web interface:

az vm open-port --resource-group <your-rg> --name calibre-web --port 80

Step 3 - Confirm the services are running

Connect over SSH as azureuser, and confirm that Calibre-Web and nginx are active. The application server listens only on 127.0.0.1:8083, while nginx serves the web interface on port 80.

systemctl is-active calibre-web nginx calibre-web-firstboot

sudo ss -tlnp | grep -E ':80 |:8083 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own administrator password on first boot. It writes the password, along with the login user and URL, to a root-only credentials file. Read it with sudo:

sudo cat /root/calibre-web-credentials.txt

You can prove that the login works from the command line by round-tripping a sign-in through nginx with those credentials:

PASS=$(sudo grep '^calibre-web.admin.pass=' /root/calibre-web-credentials.txt | cut -d= -f2-);
J=$(mktemp);
CSRF=$(curl -s -c "$J" http://127.0.0.1/login | grep -oE 'name="csrf_token"[^>]*value="[^"]+"' | grep -oE 'value="[^"]+"' | head -1 | sed 's/value="//;s/"//'); curl -s -o /dev/null -w 'login HTTP %{http_code}\n' -L -b "$J" -c "$J" --data-urlencode "csrf_token=$CSRF" --data-urlencode 'username=admin' --data-urlencode "password=$PASS" --data-urlencode 'submit=' http://127.0.0.1/login; rm -f "$J"

Step 5 - Sign in to Calibre-Web

Browse to http://<vm-public-ip>/. Calibre-Web opens on its sign-in screen. Enter username admin and the password from Step 4.

After you sign in, you land on the library. From the BROWSE sidebar, list books or browse by author, series, category, publisher, language and rating. Use Discover to jump to a random selection. The library ships empty, so your books appear here once you upload them.

Step 6 - Upload and read your books

Use the Upload button in the top toolbar to add EPUB, PDF, MOBI and other ebook files. Calibre-Web adds them to the library, extracts metadata and cover art, and lets you read them in the browser or download them.

You can also manage the library on the command line with the bundled calibredb tool, which operates on the library directory on the data disk:

calibredb --with-library /var/lib/calibre-web/library list

Step 7 - Add scoped user accounts

Open Admin, then Add New User, to create additional accounts. Each user has its own permissions (view, download, upload, edit) and visibility settings. A household or team can share one instance while you keep administrative control.

Step 8 - Administration

The Admin page lists your users and their permissions. It also shows the email server settings used for send-to-eReader, and the core configuration, including the Calibre library directory, the listening port and whether uploads are enabled.

From here, manage users, edit the library configuration and review scheduled tasks.

Step 9 - Verify the stack

Confirm the Calibre-Web version and that the services are enabled. Then check that the web interface responds through nginx and that the dedicated data disk is mounted:

/opt/calibre-web/venv/bin/python -c "import importlib.metadata as m; print('Calibre-Web', m.version('calibreweb'))"

systemctl is-enabled calibre-web nginx

curl -sI http://127.0.0.1/ | head -1

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/calibre-web

Step 10 - Where your data lives

The Calibre library and the Calibre-Web settings database both live on a dedicated Azure data disk mounted at /var/lib/calibre-web, separate from the OS disk. This disk is captured into the image and re-provisioned on every VM.

Confirm the mount and the free space:

df -h /var/lib/calibre-web | tail -1

sudo ls -la /var/lib/calibre-web/library | head

Step 11 - The OPDS feed

Calibre-Web publishes an OPDS catalog at /opds so dedicated reading apps (KOReader, Moon+ Reader, Marvin and others) can browse and download straight from your library. Point your reader at http://<vm-public-ip>/opds and sign in with your Calibre-Web username and password.

Security notes

Add TLS. Calibre-Web serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks. A common approach is certbot with your-domain on a front-end proxy.
Loopback only. The application server listens on 127.0.0.1:8083 only and is never exposed directly. Only nginx on port 80 faces the network.
Authentication from the first request. The per-VM administrator password lives in /root/calibre-web-credentials.txt, readable only by root. You can change it from your profile. Keep a copy somewhere safe.
Least privilege. Create scoped user accounts for readers rather than sharing the administrator login.
Patching. Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. If you have any questions about this Calibre-Web image or need help with your deployment, contact SecureAnyCloud through the SecureAnyCloud website.

Deploy on Azure

Launch Calibre-Web on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Calibre-Web is a clean, modern web interface for browsing, reading and downloading the books in a Calibre ebook library. It provides an in-browser ebook reader, full text search, custom shelves, per-user accounts, Kobo sync and an OPDS feed for dedicated reading applications.

This image runs Calibre-Web from a dedicated Python virtual environment, served on the loopback interface and fronted by nginx on port 80. The companion calibre command-line tools are installed, so you can manage the library from the shell with calibredb.

What you get:

An empty Calibre library initialized at /var/lib/calibre-web/library, with Calibre-Web pre-configured to use it. There is no first-run setup wizard. You sign in and start uploading books immediately.
A Calibre-Web administrator password generated on the first boot of every deployed instance. Two instances launched from the same Amazon Machine Image never share a password. The password is written to /root/calibre-web-credentials.txt with mode 0600, so only the root user can read it.
The built-in admin account ships with the password policy enabled (a minimum length plus upper case, lower case, number and special character). Any password you set later must satisfy the same rules.
The Calibre library, the book files and the Calibre-Web settings database all live under /var/lib/calibre-web, on a dedicated EBS volume separate from the operating system disk. Storage can be resized independently of the operating system.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users will reach Calibre-Web on
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Calibre-Web. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Then create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Calibre-Web Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=calibre-web-01}]'

The command prints a JSON document on success. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve the Administrator Password

Connect over SSH with the key pair you selected and the public IP address of the instance. The SSH login user depends on the operating system of the AMI variant that you launched:

AMI variant SSH login user

Calibre-Web 0.6.26 on Ubuntu 24.04 ubuntu

The per-instance administrator password is written to /root/calibre-web-credentials.txt. Read it with sudo cat /root/calibre-web-credentials.txt. The file lists the sign-in URL, the administrator user name (admin) and the generated password. Keep it somewhere safe. The file is readable only by root.

Confirm the Services Are Running

Calibre-Web runs as the calibre-web systemd service, bound to the loopback interface on port 8083, and nginx proxies it to port 80. Confirm both services are active:

systemctl is-active calibre-web.service nginx.service

Both lines report active. Next, confirm the listeners. nginx is on port 80 on all interfaces, and Calibre-Web is on port 8083 bound to loopback only:

ss -tln | grep -E ':80 |:8083 '

You should see 0.0.0.0:80 (nginx) and 127.0.0.1:8083 (Calibre-Web). Calibre-Web is never exposed directly; all traffic goes through nginx.

Confirm the Calibre-Web HTTP endpoint answers. An unauthenticated request to the root path returns a redirect to the login page:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

This prints HTTP 302. Confirm the installed Calibre-Web version:

/opt/calibre-web/venv/bin/python3.12 -c 'import importlib.metadata as m; print(m.version("calibreweb"))'

This prints 0.6.26.

First Login to the Web Interface

Browse to http://<instance-public-ip>/. You are redirected to the Calibre-Web login page.

Sign in with the user name admin and the password from /root/calibre-web-credentials.txt. After you sign in, you land on the library view. The Browse sidebar is on the left, and the search, Upload and Admin controls run along the top.

The library is empty until you add books. Upload an ebook with the Upload button at the top right, or add books from the command line with calibredb as described in Step 7.

Change the Administrator Password

The administrator password is unique to your instance, but you can set your own. Sign in as admin, open the user menu at the top right, and choose your account settings. Alternatively, open Admin, select the admin user and edit it. Enter a new password that satisfies the policy (minimum length with upper case, lower case, number and a special character) and save.

You can also reset the administrator password from the shell with the built-in command-line option, which sets the password and exits. Choose a password that satisfies the policy. Run the command as the calibre service user against the settings database at /var/lib/calibre-web/app.db, using sudo -u calibre env HOME=/opt/calibre-web /opt/calibre-web/venv/bin/cps -p /var/lib/calibre-web/app.db -s admin:<your-new-password>. Restart the service afterwards with sudo systemctl restart calibre-web.

Add and Manage Books

Add books from the web interface with the Upload button, or manage them from the shell with calibredb. The tool operates directly on the Calibre library at /var/lib/calibre-web/library.

List the current contents of the library (an empty library prints only the column header):

sudo -u calibre env HOME=/opt/calibre-web calibredb --with-library /var/lib/calibre-web/library list

To add an ebook file from the shell, copy it onto the instance and run sudo -u calibre env HOME=/opt/calibre-web calibredb --with-library /var/lib/calibre-web/library add /path/to/book.epub. After adding books outside the web interface, open Admin and use Reconnect Calibre Database so Calibre-Web rescans the library.

The OPDS Feed

Calibre-Web publishes an OPDS catalog so dedicated reading applications (such as KOReader, Moon+ Reader or Marvin) can browse and download from your library. The feed is at http://<instance-public-ip>/opds and requires authentication. Confirm that it is protected. An unauthenticated request returns 401 Unauthorized:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/opds

This prints HTTP 401. In your reading application, add an OPDS catalog pointing at http://<instance-public-ip>/opds and sign in with a Calibre-Web user name and password.

Create Users

Calibre-Web supports multiple user accounts with individual permissions. Open Admin, then Add New User. Set the user name, password, email and the per-user permissions (view, download, upload, edit and so on). Each user gets their own shelves and reading progress.

Anonymous browsing and public self-registration are disabled by default in this image. Enable them under Admin only if your deployment requires them.

Enable HTTPS with Let's Encrypt

For production use, terminate TLS in front of Calibre-Web. The simplest approach is to install certbot and obtain a certificate for a DNS name that resolves to your instance. Point a DNS record at the instance and make sure port 443 is open in the security group. Then install certbot for nginx:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx

Then obtain and install a certificate for your domain with sudo certbot --nginx -d your-domain.example.com, and follow the prompts. Certbot edits the nginx site to serve HTTPS and sets up automatic renewal. After it completes, browse to https://your-domain.example.com/.

Backups and Maintenance

All of your data lives under /var/lib/calibre-web: the Calibre library and book files under library/, and the Calibre-Web settings database at app.db. Because this directory is a dedicated EBS volume, the simplest backup is a periodic EBS snapshot of that volume. Alternatively, archive the directory:

sudo tar czf /tmp/calibre-web-backup.tar.gz -C /var/lib calibre-web

To update operating system packages, run sudo apt-get update && sudo apt-get -y upgrade, and reboot if a new kernel is installed.

The Calibre-Web application itself is installed in the virtual environment at /opt/calibre-web/venv. Consult the SecureAnyCloud support team before upgrading the Calibre-Web package, so that your library and settings are preserved.

Screenshots

The screenshots in this guide show the login page, the library view after signing in, and the administration page. They were captured from a live instance launched from this image.

Support

This image is provided by SecureAnyCloud with 24/7 technical support by email and chat. Contact support for help with Calibre-Web deployment, upgrades, library migration, OPDS and Kobo sync configuration, user management, reverse proxy and TLS termination.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Calibre-Web on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS