Listen to your audiobooks away from home: remote access and HTTPS

To listen to a self-hosted audiobook server away from home, it needs an address that works from the internet and HTTPS with a certificate your devices trust. You get there in one of three ways: let the server fetch a free Let’s Encrypt certificate itself, put it behind a reverse proxy you already run, or keep it private and reach it over a VPN. This guide walks through each with AudioSilo, then sets up the home and away addresses so the phone apps switch between them by themselves.

Why the certificate matters

AudioSilo serves HTTPS from the start, with a self-signed certificate it makes itself. A browser shows a warning the first time and lets you accept it, which is fine at home. Two things can’t accept that warning:

• The iPhone and Android apps. They need a certificate they trust.
• Installing the web player to a phone’s home screen, which needs a connection the browser fully trusts.

So for listening on the go, or with the apps at all, give the server a real certificate. Server 2.3 also answers plain HTTP to devices on your home network so the apps can connect at home without one; the store apps (2.0.0) don’t use that yet, as it arrives with app 2.1, so for now the trusted certificate is the way.

Option 1: Let the server get a certificate (autocert)

If you have a domain name pointing at your home’s public address, AudioSilo can get and renew a free Let’s Encrypt certificate itself. In config.yaml in the server’s data folder:

bind: "0.0.0.0:443"
tls:
  mode: "autocert"
  hosts: ["books.example.com"]
public_url: "https://books.example.com"

Or as environment variables: AUDIOSILO_TLS_MODE=autocert, AUDIOSILO_TLS_HOSTS=books.example.com, AUDIOSILO_PUBLIC_URL=https://books.example.com. Let’s Encrypt must be able to reach the server on port 443 of that name: either bind to 443 as above, or keep the default 8080 and forward port 443 on your router to it. Certificates are cached in the data folder and renewed automatically.

This is the simplest route when AudioSilo is the only thing you expose.

Option 2: Behind a reverse proxy

If you already run Caddy, nginx, Traefik, SWAG or Nginx Proxy Manager for other services, let the proxy handle HTTPS and run AudioSilo as plain HTTP behind it:

tls:
  mode: "off"                                    # the proxy terminates TLS
public_url: "https://books.example.com"          # the address people use
trusted_proxies: ["127.0.0.1/32"]                # where the proxy connects from

trusted_proxies tells AudioSilo to believe the proxy’s X-Forwarded-For header, so rate limiting and sign-in lockouts apply to each real visitor instead of to the proxy. List only your proxy’s address or range: trusting too wide a range lets anyone fake their address.

AudioSilo needs no special proxy rules. With Caddy, which gets its own certificate:

books.example.com {
    reverse_proxy localhost:8080
}

With nginx:

server {
    listen 443 ssl;
    server_name books.example.com;
    # ssl_certificate     /etc/letsencrypt/live/books.example.com/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/books.example.com/privkey.pem;

    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_set_header   Host $host;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

Never use tls.mode: "off" without a proxy in front that serves HTTPS: plain HTTP over the internet sends passwords and audio unencrypted.

Option 3: Keep it private with a VPN

If you’d rather open no ports at all, a VPN such as WireGuard or Tailscale puts your phone on your home network wherever you are. The server stays invisible to the internet. The apps still need HTTPS with a trusted certificate on whatever address they use over the VPN, so pair this with a reverse proxy on your network and a certificate for a name that resolves there.

Ports and firewalls

• AudioSilo listens on port 8080 by default (bind, or AUDIOSILO_BIND).
• Everything goes over that one port: the API, the admin console, the web player and audio streaming. There’s nothing else to open.
• To reach it from outside, forward one TCP port on your router to the server (or to your proxy), and allow it through the machine’s firewall.

Home and away addresses

Once the server has a public address, tell it its home address too:

lan_url: "http://192.168.1.20:8080"

(or AUDIOSILO_LAN_URL, or Home address under Server > Settings > General in the admin console). The iPhone and Android apps learn both addresses when they connect and switch on their own: the home address on your Wi-Fi, which is quicker, and the public one when you leave. Before using the home address they check that the server answering there really is yours.

Behind a reverse proxy, set the home address yourself: the server only sees the proxy’s internal address, so it can’t work it out. The web player doesn’t switch; it stays on the address you opened it at.

Is it safe to expose?

AudioSilo’s server is designed to sit on the internet, and its protections are on by default:

• No default password: the admin password is random, printed once on the first run.
• No sign-ups: nobody can create an account from outside. The admin invites people (and, from server 2.3, signed-in people can add their own household), and devices join with short-lived codes.
• Rate limiting and lockout: 10 failed sign-ins in 15 minutes locks that address out.
• Hashed secrets: passwords use argon2id; tokens and invite codes are stored only as hashes and can be revoked per device.
• Contained file access: streaming can’t reach outside your library folders.

Keep the server updated, as with anything you expose.

A checklist

1. A domain name (or a dynamic DNS name) pointing at your home.
2. One of: autocert on port 443, a reverse proxy with tls.mode: "off" and trusted_proxies, or a VPN plus a proxy.
3. public_url set, so invites and QR codes carry the public address.
4. lan_url set if you’re behind a proxy, so the apps use the fast route at home.
5. Then pair your phone.

Every setting here is in Remote access in the docs.