06-audiobookshelf.md
kstack: book: Centerpoint Home Lab chapter: Media & Entertainment page: Audiobookshelf tags: [audiobookshelf, audiobooks, podcasts, media]
Overview
Audiobookshelf is a self-hosted audiobook and podcast server. It manages and streams audiobook and podcast content from the UnRAID NFS share, tracks listening progress across devices, and supports mobile apps for on-the-go listening.
A notable configuration detail: the Step-CA root certificate is injected into the
container's trust store so that Audiobookshelf can make HTTPS calls to internal
*.home.local services (e.g. for metadata lookups or integrations).
Access
| Type | URL | Notes |
|---|---|---|
| External | https://audio.jeeves5454.ddns.net |
GeoBlock (CA/US/IN) + CrowdSec — no Authentik |
No *.home.local internal Traefik route — accessible externally or via direct LAN
IP. Audiobookshelf uses its own account-based authentication.
Configuration
Image: ghcr.io/advplyr/audiobookshelf:latest
Compose project: Standalone (managed via Portainer)
Traefik Labels
traefik.enable: "true"
traefik.http.routers.audio.rule: Host(`audio.jeeves5454.ddns.net`)
traefik.http.routers.audio.entrypoints: websecure
traefik.http.routers.audio.tls.certresolver: letsencrypt
traefik.http.routers.audio.middlewares: plex-geoblock@file,crowdsec-bouncer@file,audio-headers
traefik.http.middlewares.audio-headers.headers.customrequestheaders.X-Forwarded-Proto: https
traefik.http.services.audio.loadbalancer.server.port: 80
Volumes / Bind Mounts
| Host Path | Container Path | Purpose |
|---|---|---|
/home/jeeves/docker/audiobookshelf/config |
/config |
App database and settings |
/home/jeeves/docker/audiobookshelf/metadata |
/metadata |
Cover art and cached metadata |
/mnt/Multimedia/Audio/Audio_Books |
/audiobooks |
Audiobook files (NFS from UnRAID) |
/mnt/Multimedia/Audio/podcasts |
/podcasts |
Podcast episode files (NFS from UnRAID) |
/home/jeeves/docker/step-ca/config/certs/root_ca.crt |
/usr/local/share/ca-certificates/step-ca.crt:ro |
Step-CA root cert trust injection |
The Step-CA root certificate is bind-mounted into the container's CA trust directory,
allowing Audiobookshelf to trust *.home.local TLS certificates when making outbound
HTTPS requests to internal services.
Networks
| Network | Purpose |
|---|---|
traefik-net |
Exposes the Audiobookshelf UI |
Dependencies
- NFS mount
/mnt/Multimedia/Audiomust be healthy for content to be accessible - Step-CA root certificate at
/home/jeeves/docker/step-ca/config/certs/root_ca.crtmust exist for the bind mount to succeed
Notes / Gotchas
- Audiobookshelf has its own user authentication — no Authentik ForwardAuth is applied. Manage users in the Admin panel.
- The
X-Forwarded-Proto: httpsmiddleware is required for Audiobookshelf to generate correct callback and share URLs when behind Traefik. - Podcast episode downloads are stored in
/mnt/Multimedia/Audio/podcasts. Ensure UnRAID has sufficient free space for automatic podcast downloads. - If Step-CA root cert is updated (e.g. after CA renewal), the container must be restarted to pick up the new cert from the bind mount.
- Listening progress is stored in the SQLite database under
/config. Back up this directory before upgrades to preserve progress data.
Last Updated: 2026-06-16