Audiobookshelf

A self-hosted audiobook and podcast server.

Audiobookshelf is an open-source audiobook and podcast server with a web UI and mobile apps. It streams your personal audio library, tracks listening progress across devices, and supports metadata management. Self-hosting avoids subscription fees and keeps your library and listening history private.

Alternatives considered

Cloud Hosted

Tool	Open Source	Free Tier	Monthly Cost
Audible	No	No	From $14.95/mo
Pocketcasts	No	Limited	From $3.99/mo
Overcast	No	Yes	From $9.99/yr

Installation

Architecture

• Deployment: Single audiobookshelf deployment in the audiobookshelf namespace
• Image: ghcr.io/advplyr/audiobookshelf:2.33.1 (digest-pinned)
• Storage: Two Longhorn PVCs (audiobookshelf-config, audiobookshelf-metadata) for app data; NFS PV from TrueNAS for the audio library
• Networking: ClusterIP service on port 80, HTTPRoute via internal gateway

Security

• Runs as runAsUser: 10001, runAsNonRoot: true
• allowPrivilegeEscalation: false, capabilities dropped
• Longhorn PVCs encrypted at rest via SOPS-managed keys

Updates

Managed by Renovate. Image is digest-pinned (sha256:a4a584…).

Data Management

• PVCs: audiobookshelf-config and audiobookshelf-metadata (Longhorn-encrypted); NFS PV for the audio library (TrueNAS)
• Backups: k8up Schedule backs up both Longhorn PVCs to Hetzner S3 (workload-talos-audiobookshelf-*) via restic. No database — app uses its own file-based storage.

User Management

No OIDC or LDAP configured. User accounts managed internally through the Audiobookshelf web UI.

Configuration Management

• Longhorn encryption keys from SOPS-encrypted secrets (audiobookshelf-config-longhorn, audiobookshelf-metadata-longhorn)
• k8up S3 credentials and restic password from SOPS secrets

Administration

Usage

Access the web UI to manage your audiobook and podcast library. Upload or link audio files from the NFS share, track per-book and episode progress, and stream from any device. Mobile apps (iOS/Android) sync listening progress back to the server.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/apps/talos/audiobookshelf/README.md.

Cluster Deployment

App URLs

• audiobookshelf.int.kueber.eu

Depends on

• Envoy Gateway
• k8up backups
• Longhorn

Audiobookshelf — Talos cluster

Cluster-specific notes only. General product info, "why we use it", and alternatives live in docusaurus/docs/apps/audiobookshelf.mdx.

Deviations from defaults

Defaults live in docusaurus/docs/apps/audiobookshelf.mdx — document anything this cluster does differently here, with a one-line reason.

Kubernetes Metadata

• Image: ghcr.io/advplyr/audiobookshelf:2.35.1@sha256:1eef6716183c52abafe5405e7d6be8390248ecd59c7488c44af871757ac8fc4d

Rendered manifests (kustomize build)

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kustomize.toolkit.fluxcd.io/force: enabled
  labels:
    app.kubernetes.io/instance: audiobookshelf
    app.kubernetes.io/name: audiobookshelf
  name: audiobookshelf
  namespace: audiobookshelf
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: audiobookshelf
      app.kubernetes.io/name: audiobookshelf
      homepage: active
      ingress: internal
  strategy:
    rollingUpdate: null
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: audiobookshelf
        app.kubernetes.io/name: audiobookshelf
        homepage: active
        ingress: internal
    spec:
      containers:
        - image: >-
            ghcr.io/advplyr/audiobookshelf:2.35.1@sha256:1eef6716183c52abafe5405e7d6be8390248ecd59c7488c44af871757ac8fc4d
          name: audiobookshelf
          ports:
            - containerPort: 80
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 1
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            privileged: false
          volumeMounts:
            - mountPath: /podcasts
              name: audio
              subPath: podcasts
            - mountPath: /audiobooks
              name: audio
              subPath: audiobooks
            - mountPath: /config
              name: config
            - mountPath: /metadata
              name: metadata
      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      volumes:
        - name: audio
          persistentVolumeClaim:
            claimName: audiobookshelf-truenas-nfs-audio
        - name: config
          persistentVolumeClaim:
            claimName: audiobookshelf-config
        - name: metadata
          persistentVolumeClaim:
            claimName: audiobookshelf-metadata