I think I have it working. I didn't want to have to give rw permissions to Network Service on metadata.db, but that seems to be the only way to make it work.
So, recapping:
- Move config to a different location using CALIBRE_CONFIG_DIRECTORY, prepopulate it with the existing configuration files, and give Network Service rw access to the folder
- Give Network Service read access to your library path (file system and share)
- Give Network Service rw access to the database path. I actually did it at the folder level, but you might be able to do it at the file level. Also, because the database apparently needs rw access but I don't want to give write access to the library itself this is another good reason to separate the database from the library.
I really don't like that calibre-server, ostensibly a read-only process, has to have rw access to the database in order to run. Any thoughts on changing that? Should I file a ticket?