Audiobookshelf

A self-hosted audiobook and podcast server.

Audiobookshelf is an open-source audiobook and podcast server with a web UI and mobile apps. It streams your personal audio library, tracks listening progress across devices, and supports metadata management. Self-hosting avoids subscription fees and keeps your library and listening history private.

Alternatives considered

Cloud Hosted

Tool	Open Source	Free Tier	Monthly Cost
Audible	No	No	From $14.95/mo
Pocketcasts	No	Limited	From $3.99/mo
Overcast	No	Yes	From $9.99/yr

Installation

Architecture

• Deployment: Single audiobookshelf deployment in the audiobookshelf namespace
• Image: ghcr.io/advplyr/audiobookshelf, digest-pinned via Renovate
• Storage: Two Longhorn PVCs (audiobookshelf-config, audiobookshelf-metadata) for app data; NFS PV from TrueNAS for the audio library
• Networking: ClusterIP service on port 80, HTTPRoute via the public gateway (audiobookshelf.web.kueber.eu)

Security

• Runs as runAsUser: 10001, runAsNonRoot: true
• allowPrivilegeEscalation: false, capabilities dropped
• Longhorn PVCs encrypted at rest via SOPS-managed keys

Updates

Managed by Renovate. Image is digest-pinned (sha256:a4a584…).

Data Management

• PVCs: audiobookshelf-config and audiobookshelf-metadata (Longhorn-encrypted); NFS PV for the audio library (TrueNAS)
• Backups: k8up Schedules to Hetzner and Backblaze via restic (workload-talos-audiobookshelf-*), covering both Longhorn PVCs. No database — app uses its own file-based storage.

User Management

OpenID Connect login against Keycloak: the client audiobookshelf (gated on audiobookshelf.user for the family group, with the mobile audiobookshelf://oauth callback) is created by the app's workspace, and its secret sits in workspace-outputs. Audiobookshelf stores the OpenID settings in its database only, so after a rotation the secret is copied into Settings → Authentication → OpenID Connect by hand. User accounts are otherwise managed through the web UI.

Configuration Management

• Longhorn encryption keys from SOPS-encrypted secrets (audiobookshelf-config-longhorn, audiobookshelf-metadata-longhorn)
• k8up S3 credentials and restic password from SOPS secrets

Usage

Access the web UI to manage your audiobook and podcast library. Upload or link audio files from the NFS share, track per-book and episode progress, and stream from any device. Mobile apps (iOS/Android) sync listening progress back to the server.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/apps/audiobookshelf/talos/README.md.

Cluster Deployment

App URLs

• audiobookshelf.web.kueber.eu

Depends on

• Envoy Gateway
• k8up backups
• Longhorn

Audiobookshelf — Talos cluster

Kubernetes Metadata

• Image: ghcr.io/advplyr/audiobookshelf:2.37.1@sha256:581d68b2a6fc7ebf58d81c878a9f387cbbc0d88ac9d37b298b9cee10168af85b

Rendered manifests (kustomize build)

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kustomize.toolkit.fluxcd.io/force: enabled
  labels:
    app.kubernetes.io/name: audiobookshelf
  name: audiobookshelf
  namespace: audiobookshelf
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: audiobookshelf
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: audiobookshelf
    spec:
      automountServiceAccountToken: false
      containers:
        - image: ghcr.io/advplyr/audiobookshelf:2.37.1@sha256:581d68b2a6fc7ebf58d81c878a9f387cbbc0d88ac9d37b298b9cee10168af85b
          name: audiobookshelf
          ports:
            - containerPort: 80
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 1
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            limits:
              memory: 1Gi
            requests:
              cpu: 25m
              memory: 512Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            privileged: false
          volumeMounts:
            - mountPath: /podcasts
              name: audio
              subPath: podcasts
            - mountPath: /audiobooks
              name: audio
              subPath: audiobooks
            - mountPath: /config
              name: config
            - mountPath: /metadata
              name: metadata
      priorityClassName: tier-2
      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      volumes:
        - name: audio
          persistentVolumeClaim:
            claimName: audiobookshelf-truenas-nfs-audio
        - name: config
          persistentVolumeClaim:
            claimName: audiobookshelf-config
        - name: metadata
          persistentVolumeClaim:
            claimName: audiobookshelf-metadata