Set up AudioSilo with Caddy: Docker Compose and HTTPS

To put AudioSilo behind Caddy, let Caddy serve HTTPS and forward to http://audiosilo:8080, with AudioSilo’s HTTPS mode set to Off. Set its public address to your HTTPS hostname and trust the proxy’s address for client IP handling. The files below take you from a fresh Docker Compose stack to listening on your phone.

Caddy gets and renews the certificate, redirects HTTP to HTTPS, and forwards requests to AudioSilo over the Docker network.

What you need

• A Linux host with Docker Engine and the Compose plugin, and a terminal on it.
• An existing audiobook folder on that host.
• A domain you control and an email address for the certificate account.

Confirm Docker works:

docker version
docker compose version

The example hostname is books.example.com. Replace it with your own throughout.

Step 1: Prepare the hostname and network

1. In your DNS provider, add an A record for books pointing to the host’s public IPv4 address. At home, that is your router’s public address, not 192.168.x.x.
2. Add an AAAA record only if incoming IPv6 also reaches this host, and remove a stale one. If your DNS/CDN service has a proxy toggle, use DNS-only for now.
3. Give the Docker host a stable LAN address. Forward TCP 80 to TCP 80 and TCP 443 to TCP 443 to it on your router, and allow both through its firewall. A VPS needs its provider firewall opened too.
4. Make sure nothing else owns ports 80 or 443. If a proxy you want to keep does, see If you already run Caddy.

Check the public records with nslookup books.example.com. Behind CGNAT, with no incoming connections, this setup can’t get a certificate or serve remote listeners: use the VPN route or a reachable host instead.

Step 2: Download and edit the files

mkdir -p ~/audiosilo-caddy
cd ~/audiosilo-caddy
curl -fL https://audiosilo.app/downloads/reverse-proxy/caddy/compose.yaml -o compose.yaml
curl -fL https://audiosilo.app/downloads/reverse-proxy/caddy/env.example -o .env
curl -fL https://audiosilo.app/downloads/reverse-proxy/caddy/Caddyfile -o Caddyfile

Or save the Compose file, environment example and Caddyfile directly. Save the environment example as .env, with the leading dot, beside compose.yaml.

Open .env in an editor, for example nano .env, and replace these values:

BOOKS_HOST=books.example.com
[email protected]
PUID=1000
PGID=1000
TZ=Etc/UTC
AUDIOBOOKS_DIR=/srv/audiobooks
PROXY_SUBNET=172.30.90.0/24
PROXY_IP=172.30.90.2
AUDIOSILO_IP=172.30.90.3

Value	What to enter
BOOKS_HOST	Just the hostname: no https://, port or path.
AUDIOBOOKS_DIR	The existing absolute folder on the host that holds your books.
PUID, PGID	The output of id -u and id -g, for a user/group that can read that folder. On Unraid, commonly 99 and 100.
TZ	Your timezone, such as Europe/London.

Quote any value that contains spaces.

If 172.30.90.0/24 overlaps your LAN, VPN or another Docker network, change all three PROXY_SUBNET, PROXY_IP and AUDIOSILO_IP to an unused subnet and two addresses in it, such as 172.30.91.0/24, 172.30.91.2 and 172.30.91.3. Fixed addresses stop Docker giving the proxy’s IP to AudioSilo, which trusts only the proxy IP with /32.

The AudioSilo service already contains the settings that matter:

AUDIOSILO_BIND: 0.0.0.0:8080
AUDIOSILO_TLS_MODE: "off"
AUDIOSILO_PUBLIC_URL: https://${BOOKS_HOST}
AUDIOSILO_TRUSTED_PROXIES: ${PROXY_IP}/32

AudioSilo has no published host port: the proxy reaches it over the Docker network. The LinuxServer image keeps its configuration and database in ./audiosilo (mounted at /config) and reads your books at /audiobooks:ro. The first-party KodeStar image uses /data instead. See the LinuxServer AudioSilo reference.

Setup terminal

Step 3: Check the Caddy configuration

{
    email {$ACME_EMAIL}
}

{$BOOKS_HOST} {
    reverse_proxy audiosilo:8080
}

Caddy reads BOOKS_HOST and ACME_EMAIL from the environment Compose passes in. The upstream is the Compose service name, audiosilo:8080, not localhost:8080. Caddy sends the forwarding headers AudioSilo needs without extra header rules, and keeps its certificate state in the caddy_data volume.

Step 4: Start the stack and sign in

From the directory containing compose.yaml:

docker compose config --quiet
docker compose pull
docker compose up -d
docker compose ps
docker compose logs caddy

The config command should finish without errors and both services should be running. The proxy log should show no DNS, connection or ACME errors. On a public hostname, wait for a trusted certificate before signing in.

Setup terminal

Now read AudioSilo’s first-run log:

docker compose logs audiosilo

On a new configuration directory it prints an admin password and auth code once. Save them privately; a restart does not print them again.

Open https://books.example.com/admin and sign in as admin with that password. Keep the auth code for Step 7.

The pinned download runs 2.3.1, which opens the console directly. A new server on 2.4.0 or later opens Set up your server first; Finish later takes you to the console to follow this guide.

books.example.com:28443/admin

Step 5: Check the AudioSilo settings

Open Server > Settings > Network & HTTPS. Confirm HTTPS mode is Off and Trusted proxies contains 172.30.90.2/32, or the address you chose.

books.example.com:28443/admin

Open Server > Settings > General. Confirm Public address is https://books.example.com, with no :8080.

books.example.com:28443/admin

These fields are locked by environment variables, as expected: supported AUDIOSILO_* variables override config.yaml. To change one, edit Compose or .env and run docker compose up -d. docker compose restart keeps the old environment.

Trusted proxies decides whose forwarded client IP is believed for rate limits and sign-in lockouts. It does not disable HTTPS redirects. Trust the one proxy IP, not your whole LAN.

Step 6: Add your audiobook library

Go to Library > Libraries > Add library. Name it, set Folder to /audiobooks (the path inside the container) and click Add library and scan.

books.example.com:28443/admin

If the folder is empty, check the host path in .env, its mount and read permissions for your PUID/PGID. The mount is read-only, so keep managing files on the host. See the library documentation.

Step 7: Pair your phone and test playback

1. Open https://books.example.com/ in a browser and enter the auth code. The connect page shows a pairing QR code.
2. In the AudioSilo iOS or Android app, choose Scan a QR code and scan it. Pairing the admin account is fine.

books.example.com:28443/

For someone else, use People > Invite someone. They open the invite link in a browser for a pairing QR, or enter the server address and invite code in the app. App 2.4.0’s scanner also accepts the invite card’s QR directly; earlier apps need the connect page’s pairing QR.

Open https://books.example.com/web. Start a book, seek forward, pause and resume.

books.example.com:28443/web

Then turn Wi-Fi off on your phone and repeat the test over mobile data. Home Wi-Fi alone can’t confirm remote access. If mobile data works but Wi-Fi does not, check your router’s NAT loopback support or point the hostname at the host’s LAN address in local DNS.

Leave Home address empty unless you have a separate home endpoint with a certificate your app trusts. This stack does not publish port 8080, so http://192.168.x.x:8080 won’t work. Pair your phone and Connecting and signing in cover other sign-in routes.

Troubleshooting

• An https://...:80 redirect or a redirect loop: confirm AUDIOSILO_TLS_MODE is exactly off on the running container and recreate it with docker compose up -d. The upstream must be HTTP on 8080.
• A changed setting is ignored: environment variables win. Check docker compose config for the resolved values, then recreate the service.
• A port is already allocated: see If you already run Caddy, or use a different host.
• A subnet overlap error: pick an unused PROXY_SUBNET and update PROXY_IP and AUDIOSILO_IP to match.
• Caddy returns 502: check docker compose logs audiosilo, then check that the Caddyfile uses audiosilo:8080. Inside the Caddy container, localhost means Caddy itself.
• Certificate errors in Caddy’s log: check the A and AAAA records, public access to ports 80/443 and the host firewall. If another proxy or CDN is in front, start with a direct DNS record to the host. Caddy’s automatic HTTPS documentation explains its certificate challenges.

Check the Caddy configuration with:

docker compose exec caddy caddy validate --config /etc/caddy/Caddyfile

If you already run Caddy

Use the proxy that already owns ports 80/443; the download above is for a new proxy instance.

Add this site to the existing Caddyfile, using your real hostname:

books.example.com {
    reverse_proxy audiosilo:8080
}

Then:

1. Join AudioSilo and Caddy to the same Docker network, so the name audiosilo resolves from Caddy.
2. Set AudioSilo’s AUDIOSILO_TLS_MODE=off, AUDIOSILO_PUBLIC_URL=https://books.example.com and AUDIOSILO_TRUSTED_PROXIES with the actual Caddy container IP plus /32.
3. Give Caddy a stable address on that network, so the trust rule survives recreation.
4. Validate and reload the existing Caddy configuration.

The Caddy reverse proxy reference covers upstream and header behaviour.

Updating the pinned images

The download pins the image versions in What we tested; docker compose pull never picks a newer one by itself.

1. Back up AudioSilo’s configuration/database and the proxy’s certificate state. Use AudioSilo’s backup feature, or stop the container before copying its database files.
2. Edit the image: tags in compose.yaml to the versions you want.
3. Pull and recreate:

docker compose pull
docker compose up -d
docker compose ps

Read both logs, then repeat sign-in, pairing, playback and seeking. docker compose down keeps named volumes; down -v removes them.

From server 2.5.0, the server also copies its database before an upgrade that changes it (Before an upgrade in Settings > Backups). How to back up a self-hosted app before you upgrade it covers rolling back.

What we tested

Date	21 October 2026
AudioSilo	LinuxServer v2.3.1-ls6 image
Proxy	Caddy 2.11.7
Test address	books.example.com, mapped locally, HTTPS on 28443

The screenshots come from a local Docker test of these files, hence :28443; the public recipe uses ports 80/443 and no port in Public address. The test used a local certificate authority, so public DNS, router forwarding and Let’s Encrypt issuance were not verified: do the outside checks in steps 1 and 7. It did check the admin UI, locked settings, library access, connect-page pairing, the web player, audio, redirects and forwarded client IPs through the proxy.

For background, see remote access and HTTPS and the docs’ Remote access page.