There are several things to think about. I am assuming that you know at least a bit about linux systems admin. If not, what I say below will make little sense.
The first question is whether or not to use standard ports and to use SSL. The calibre server can be "front-facing" if you wish, but then you are limited to a single username/password. If you want to use port 80 or port 443 (SSL), or if you want more than one username/password, then you probably need to use a front-end web server to deal with these issues. I use apache2. Calibre is running in reverse proxy mode, which means that apache2 fields all the requests and send them to calibre. More later....
Second is authentication. Who can access your library, and how? For me, it is members of my family and 2 or three friends who I want to allow to see my lbrary. I decided that the best solution was to offer individual passwords. To do this, I use apache digest authentication. I chose digest because it is reasonably safe over non-encrypted connections.
Third is ensuring that calibre is serving the latest content. I use dropbox to copy content from my "editing" computer to the server. Dropbox on linux apparently uses a "delete then create" scheme to update files. Unfortunately that means that calibre will never see the changes because it holds open the file that was deleted. To get around this I use "monit" to watch the timestamp of the calibre DB and restart the content server if the DB changes. My calibre restart script copies the DB from dropbox to /tmp and sets the environment variable CALIBRE_OVERRIDE_DATABASE_PATH to point at the copy in /tmp. If the timestamp changes then monit will stop and restart calibre-server.
EDIT: Calibre V2 correctly detects that the db has changed, so the copy and monit test are no longer necessary. That said, I am more comfortable ensuring that the DB does not change underneath a running calibre instance and I have some concern about dropbox conflicts because the db is open RW, so I still use monit to stop and start the calibre server
My apache, monit and calibre-server scripts are attached. Note that the apache script will work with a few changes in the non-SSL channel.