Serving a web UI

The release Docker image bundles kmweb, the React UI built for KMServer (dashboard, browsing with facet filters, full-text search, the comic reader, account settings, live updates over SSE), and serves it at / out of the box. Nothing to configure: http://<host>:25600/ works in a browser immediately.

Keeping the UI up to date

The bundled UI is only a baseline. Turn on auto-update and KMServer tracks new kmweb releases at runtime, with no container rebuild or restart:

KOMGA_WEBUI_AUTOUPDATE=true
KOMGA_WEBUI_UPDATEINTERVAL=6h   # how often to check, default 1d

On startup and then on the interval, KMServer checks the latest kmweb release, downloads the bundle, verifies it against the published sha256, and swaps the served directory atomically. The managed copy lives under <config-dir>/webui (/config/webui in the container), so it survives image upgrades, and browsers pick the new version up on the next page load. As long as no managed copy exists (fresh or offline install), the bundled one is served, so the UI always works.

Air-gapped hosts: leave auto-update off and keep the bundled copy.

Bare binary

The standalone binary carries no UI, which is fine for API-only clients (KMReader, KOReader, OPDS readers). To serve a UI anyway, point webui.dir at a kmweb bundle from a kmweb release (or your own build) — this is only needed to force a specific UI:

KOMGA_WEBUI_DIR=/path/to/kmweb kmrs

With auto-update also enabled, the managed copy replaces whatever webui.dir points at once the first download lands. Run with an empty KOMGA_WEBUI_DIR= to explicitly disable the UI.

Notes

KMServer speaks plain HTTP. If you need HTTPS, put any TLS-terminating proxy in front; it can be a dumb pipe, since KMServer tells the SPA and the API apart itself.
Cross-origin hosting (web UI on a different origin than the API) is not supported: KMServer parses KOMGA_CORS_ALLOWEDORIGINS but does not apply CORS headers. Serve same-origin.
The web UI’s files and SPA routes are served without authentication — the login page has to load anonymously. Authentication is enforced by the API, same as the Java version.