Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let’s dive in!

As a homelab enthusiast, I found this a very interesting post. Here are my take aways from the post that I’m implementing myself:

• Miner detection. I’ve updated monitoring rules to now watch the CPU on my hosts. If the same thing happened to me I would not have been alerted at all as I’m doing simple up / down monitoring. Fixed.
• Access logging. I turned on access logging for my homelab Caddy instances.
• Log retention. I have increased the amount and retention of my logging. The hope is this will help me reconstruct what happened after a breach.
• Logs offsite. The VPS access logs now ride along with the normal backup process, which runs hourly. The homelab side still only gets caught by the weekly VM backup, so that’s next.
• Closed an open signup. My webtrees instance (genealogy) had self registration enabled, which is the same door this guy got hit through. Oops. Fixed.
• Built a tool. log-inventory.sh, so “could I actually reconstruct what happened” is a command I run instead of a thing I assume.

This is the companion to I own my books, where I made the case for stripping DRM and actually owning what I buy. This post is the machinery overview: how I store, serve, and read all of it from my own homelab.

My books workflow

When I find a book I want to buy, I go to eBooks.com and search for it. They have most titles, but occasionally I will have to go to Kobo to find it; regardless, I purchase the book.

Note: This is just an overview of how this works and is not a technical, step-by-step walk-thru.

Calibre

If the book has DRM, the distributor gives me a file with the .acsm extension. If the book is DRM free, then they hand me the ePUB file directly. Either way, the next step is to import the downloaded file into Calibre. With the right plug-ins, Calibre will automatically download the book, remove the DRM (if any) and add the ePUB file to the Calibre books library.

Syncthing

Once the book is in Calibre as a DRM-free ePUB, Syncthing syncs it to one of my homelab instances that serves it with Calibre-Web.

Calibre-Web

I use Calibre-Web to then serve my Calibre books on my local network. Calibre-Web implements the same endpoints the Kobo store exposes: sync, library metadata, cover images, reading state. This is the first piece that allows me to connect my books library to my Kobo device.

DNS and certificates

Two things have to be in place to allow my Kobo to connect to Calibre-Web. My local DNS has to point an internal hostname at the server running Calibre-Web. And that server needs a real, publicly trusted TLS certificate, because the Kobo thinks it’s talking to a commercial store and won’t accept a self-signed one. Getting a legitimate certificate for a hostname that only exists inside my homelab is the fiddly part. I may write that up separately.

Kobo

Now I update the api_endpoint setting in the .kobo/Kobo/Kobo eReader.conf file on the Kobo itself so it points to the internal hostname from the DNS and certificates section above. I plug the Kobo into my computer over USB and it mounts as a drive, which is how I get at the file. There’s no way to do this from the device’s settings menus.

All together now

So my workflow looks like this in practice:

1. Buy and download the book.
2. Import the book into Calibre.
3. Open my Kobo device and download the new book to the reader.
4. Read.

The default software on the Kobo is a first-class reading experience. Connecting it to my Calibre-Web server keeps that experience intact while my whole library syncs down over my local network.

KOReader

I see many people talking about KOReader, so when I first started on this path, I had every intention of installing and using it. In my own tests, the software just felt a lot rougher and harder to make into a nice reading experience, and I still had to connect my device directly to my laptop to load books. No shade towards KOReader and all the people who seem to love it, but the Kobo reading software works perfectly for me, and I can’t think of a feature that KOReader provides that isn’t already in the Kobo software.

Audiobooks

I listen to a fair amount of audiobooks, and my preference is to purchase them from Libro.fm. Their audiobooks are already DRM-free, so I just download the files from the Libro.fm website and boom, I have my backup.

Audible books do have DRM, but I can remove it. In order to make my backups, I use ffmpeg with credentials that audible-cli legitimately pulls from my authenticated account. I’m decrypting content I bought, using a key I’m entitled to, into a universally playable format (.m4b). So I can back up even Audible exclusives like Dungeon Crawler #8.

No matter how I purchased and backed up the audiobooks, I prefer to listen to them in Audiobookshelf, which is a self-hosted solution in my homelab.

Conclusion

And that’s my books workflow and an overview of how I self-host all this. I’m really interested in hearing about others’ book workflows too. Drop me a line if you’ve written something up and want to share.

Originally posted on my site: https://michaelharley.net/posts/2026/07/21/how-i-self-host-my-ebooks-and-audiobooks/