Default-Lautstärke auf 40% senken

Betrifft alle Sender, insbesondere creamfresh radio.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Drq8o4HfFmwkXz2AgvaQ4p

.env.example

@@ -3,3 +3,8 @@ DEBUG=True
 AMAZON_AFFILIATE_TAG=diora-20
 LASTFM_API_KEY=
 LASTFM_API_SECRET=
+
+# Cloud import (WebDAV/Nextcloud): allow connections to LAN/loopback addresses.
+# Leave False on any instance with open registration — it is what stops a user
+# from probing the internal network through the import proxy.
+WEBDAV_ALLOW_PRIVATE_HOSTS=False

.forgejo/workflows/test.yml

@@ -11,16 +11,25 @@ jobs:
   test:
     runs-on: ubuntu-latest
     container:
-      image: catthehacker/ubuntu:act-22.04
+      # 22.04 ships Python 3.10, which cannot install the pinned Django (it
+      # needs >= 3.12). While requirements.txt still said "django>=4.2" that
+      # went unnoticed and pip quietly resolved a 4.x here — so CI was testing
+      # a different Django than the image actually shipped. 24.04 gives us
+      # 3.12, matching the Dockerfile's python:3.12-slim.
+      image: catthehacker/ubuntu:act-24.04
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install Python dependencies
-        run: pip install --no-cache-dir -r requirements.txt
+        # 24.04 marks its system Python as externally managed (PEP 668), so a
+        # bare `pip install` is refused. A venv is the sanctioned way in.
+        run: |
+          python -m venv /tmp/venv
+          /tmp/venv/bin/pip install --no-cache-dir -r requirements.txt
 
       - name: Django system check
-        run: python manage.py check
+        run: /tmp/venv/bin/python manage.py check
 
       - name: Run tests
-        run: python manage.py test
+        run: /tmp/venv/bin/python manage.py test

.gitignore

@@ -19,6 +19,7 @@ env/
 media/
 staticfiles/
 .env
+tts_models/
 
 # IDE
 .idea/

Dockerfile

@@ -4,10 +4,26 @@ WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc \
+    curl \
     && rm -rf /var/lib/apt/lists/*
 
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt gunicorn
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Piper voices for the reader's read-aloud feature (see tts/piper_engine.py).
+# Fetched at build time rather than kept in git or bind-mounted — there's no
+# existing volume-mount pattern for extra binary assets in this repo, and
+# baking them into the image keeps the watchtower "just pull the new image"
+# deploy flow working unchanged.
+RUN mkdir -p /app/tts_models && \
+    curl -fsSL -o /app/tts_models/de_DE-thorsten-medium.onnx \
+      https://huggingface.co/rhasspy/piper-voices/resolve/main/de/de_DE/thorsten/medium/de_DE-thorsten-medium.onnx && \
+    curl -fsSL -o /app/tts_models/de_DE-thorsten-medium.onnx.json \
+      https://huggingface.co/rhasspy/piper-voices/resolve/main/de/de_DE/thorsten/medium/de_DE-thorsten-medium.onnx.json && \
+    curl -fsSL -o /app/tts_models/en_US-lessac-medium.onnx \
+      https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/lessac/medium/en_US-lessac-medium.onnx && \
+    curl -fsSL -o /app/tts_models/en_US-lessac-medium.onnx.json \
+      https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/lessac/medium/en_US-lessac-medium.onnx.json
 
 ARG BUILD_TIME
 ENV BUILD_TIME=${BUILD_TIME}

accounts/migrations/0005_webdavsource.py

@@ -0,0 +1,33 @@
+# Generated by Django 6.1 on 2026-08-28 08:01
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0004_apitoken'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='WebDAVSource',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('label', models.CharField(max_length=100)),
+                ('base_url', models.URLField(max_length=500)),
+                ('username', models.CharField(blank=True, max_length=200)),
+                ('password', models.CharField(blank=True, max_length=500)),
+                ('root_path', models.CharField(blank=True, default='', max_length=500)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('last_used_at', models.DateTimeField(blank=True, null=True)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='webdav_sources', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'ordering': ['created_at'],
+            },
+        ),
+    ]

accounts/models.py

@@ -1,4 +1,5 @@
 import secrets
+from urllib.parse import urlsplit
 
 from django.db import models
 from django.contrib.auth.models import User
@@ -37,6 +38,57 @@ def save_user_profile(sender, instance, **kwargs):
         instance.profile.save()
 
 
+class WebDAVSource(models.Model):
+    """A user-supplied WebDAV endpoint that ebooks can be imported from.
+
+    Deliberately generic rather than Nextcloud-specific — any WebDAV server
+    (Nextcloud, ownCloud, Synology, rclone serve, …) works, Nextcloud just gets
+    a URL-shorthand in `normalized_base_url`.
+
+    The password is stored in the clear because the server has to replay it on
+    every PROPFIND/GET (same trade-off as `lastfm_session_key` above). The UI
+    therefore tells users to create a revocable *app password* rather than
+    handing over their account password.
+    """
+    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='webdav_sources')
+    label = models.CharField(max_length=100)
+    base_url = models.URLField(max_length=500)
+    username = models.CharField(max_length=200, blank=True)
+    password = models.CharField(max_length=500, blank=True)
+    root_path = models.CharField(max_length=500, blank=True, default='')
+    created_at = models.DateTimeField(auto_now_add=True)
+    last_used_at = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        ordering = ['created_at']
+
+    def __str__(self):
+        return f"WebDAVSource({self.label}, user={self.user_id})"
+
+    def normalized_base_url(self) -> str:
+        """Collection root to resolve browse paths against, always ending in '/'.
+
+        A bare host ('https://cloud.example.com') is expanded to the Nextcloud
+        files endpoint, since that is the URL users actually have at hand; an
+        URL that already points into a DAV tree is left alone so non-Nextcloud
+        servers stay usable.
+        """
+        url = self.base_url.strip()
+        if not url.endswith('/'):
+            url += '/'
+        # Match against the path only — a host literally named "webdav.…" or
+        # "dav.…" must not be mistaken for a URL that already points into a
+        # DAV tree.
+        path = urlsplit(url).path.lower()
+        is_dav = any(marker in path for marker in ('/remote.php/', '/dav/', '/webdav'))
+        if not is_dav and self.username:
+            url += f'remote.php/dav/files/{self.username}/'
+        root = self.root_path.strip().strip('/')
+        if root:
+            url += root + '/'
+        return url
+
+
 def _generate_token():
     return secrets.token_hex(32)
 

accounts/tests.py

@@ -1,9 +1,13 @@
 import json
+import socket
+from types import SimpleNamespace
+from unittest.mock import patch
 
 from django.contrib.auth.models import User
-from django.test import TestCase
+from django.test import TestCase, override_settings
 
-from .models import ApiToken
+from .models import ApiToken, WebDAVSource
+from .webdav import WebDAVError, assert_safe_url, fetch_file, list_directory, safe_rel_path
 from books.models import EBook, EBookProgress, EBookHighlights
 
 
@@ -89,3 +93,436 @@ class SyncSnapshotTests(TestCase):
 
         # No data_ct/data_iv leaked into the snapshot (book bytes stay lazy-fetched)
         self.assertNotIn('data_ct', data['books'][0])
+
+
+# ---------------------------------------------------------------------------
+# WebDAV cloud import
+# ---------------------------------------------------------------------------
+
+PROPFIND_RESPONSE = b'''<?xml version="1.0"?>
+<d:multistatus xmlns:d="DAV:">
+  <d:response>
+    <d:href>/remote.php/dav/files/alice/Books/</d:href>
+    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop></d:propstat>
+  </d:response>
+  <d:response>
+    <d:href>/remote.php/dav/files/alice/Books/Sci-Fi/</d:href>
+    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop></d:propstat>
+  </d:response>
+  <d:response>
+    <d:href>/remote.php/dav/files/alice/Books/Der%20Steppenwolf.epub</d:href>
+    <d:propstat><d:prop><d:resourcetype/><d:getcontentlength>4096</d:getcontentlength></d:prop></d:propstat>
+  </d:response>
+  <d:response>
+    <d:href>/remote.php/dav/files/alice/Books/notes.txt</d:href>
+    <d:propstat><d:prop><d:resourcetype/><d:getcontentlength>12</d:getcontentlength></d:prop></d:propstat>
+  </d:response>
+</d:multistatus>'''
+
+
+class _FakeSocket:
+    def __init__(self, peer):
+        self._peer = peer
+
+    def getpeername(self):
+        return (self._peer, 443)
+
+
+class _FakeResponse:
+    def __init__(self, status_code=207, content=b'', headers=None, peer=None):
+        self.status_code = status_code
+        self.content = content
+        self.headers = headers or {}
+        self.closed = False
+        # Mirrors requests' response.raw._connection.sock, which is what
+        # _assert_peer_is_safe introspects. None means "nothing to check".
+        if peer is None:
+            self.raw = None
+        else:
+            self.raw = SimpleNamespace(_connection=SimpleNamespace(sock=_FakeSocket(peer)))
+
+    def iter_content(self, chunk_size=None):
+        yield self.content
+
+    def close(self):
+        self.closed = True
+
+
+class NormalizedBaseUrlTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+
+    def _source(self, **kwargs):
+        kwargs.setdefault('label', 'cloud')
+        kwargs.setdefault('username', 'alice')
+        return WebDAVSource(user=self.user, **kwargs)
+
+    def test_bare_host_expands_to_nextcloud_files_endpoint(self):
+        source = self._source(base_url='https://cloud.example.com')
+        self.assertEqual(
+            source.normalized_base_url(),
+            'https://cloud.example.com/remote.php/dav/files/alice/',
+        )
+
+    def test_root_path_is_appended(self):
+        source = self._source(base_url='https://cloud.example.com', root_path='/Buecher/')
+        self.assertEqual(
+            source.normalized_base_url(),
+            'https://cloud.example.com/remote.php/dav/files/alice/Buecher/',
+        )
+
+    def test_explicit_dav_url_is_left_alone(self):
+        source = self._source(base_url='https://dav.example.com/webdav')
+        self.assertEqual(source.normalized_base_url(), 'https://dav.example.com/webdav/')
+
+    def test_generic_server_without_username_is_not_rewritten(self):
+        source = self._source(base_url='https://files.example.com/share', username='')
+        self.assertEqual(source.normalized_base_url(), 'https://files.example.com/share/')
+
+
+class SafeRelPathTests(TestCase):
+    def test_traversal_is_rejected(self):
+        with self.assertRaises(WebDAVError):
+            safe_rel_path('Books/../../etc/passwd')
+
+    def test_leading_slashes_and_dots_are_stripped(self):
+        self.assertEqual(safe_rel_path('/Books/./Sci-Fi/'), 'Books/Sci-Fi')
+
+    def test_empty_path_is_root(self):
+        self.assertEqual(safe_rel_path(''), '')
+        self.assertEqual(safe_rel_path('/'), '')
+
+
+class AssertSafeUrlTests(TestCase):
+    def _resolve_to(self, ip):
+        return [(2, 1, 6, '', (ip, 443))]
+
+    def test_non_http_scheme_rejected(self):
+        with self.assertRaises(WebDAVError):
+            assert_safe_url('file:///etc/passwd')
+
+    def test_private_address_rejected(self):
+        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('172.18.0.4')):
+            with self.assertRaises(WebDAVError):
+                assert_safe_url('https://internal.example.com/dav/')
+
+    def test_loopback_rejected(self):
+        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('127.0.0.1')):
+            with self.assertRaises(WebDAVError):
+                assert_safe_url('http://localhost:11000/remote.php/dav/')
+
+    def test_link_local_metadata_endpoint_rejected(self):
+        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('169.254.169.254')):
+            with self.assertRaises(WebDAVError):
+                assert_safe_url('http://metadata.example.com/')
+
+    def test_public_address_allowed(self):
+        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('85.214.6.118')):
+            assert_safe_url('https://nc.example.com/remote.php/dav/')
+
+    def test_unresolvable_host_rejected(self):
+        with patch('accounts.webdav.socket.getaddrinfo', side_effect=socket.gaierror):
+            with self.assertRaises(WebDAVError):
+                assert_safe_url('https://nope.example.com/')
+
+    @override_settings(WEBDAV_ALLOW_PRIVATE_HOSTS=True)
+    def test_private_allowed_when_opted_in(self):
+        assert_safe_url('http://192.168.1.10/dav/')
+
+
+class ListDirectoryTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+        self.source = WebDAVSource.objects.create(
+            user=self.user, label='cloud', base_url='https://cloud.example.com',
+            username='alice', password='app-pw', root_path='Books',
+        )
+
+    def _list(self, response=None):
+        with patch('accounts.webdav.assert_safe_url'), \
+             patch('accounts.webdav.requests.request',
+                   return_value=response or _FakeResponse(content=PROPFIND_RESPONSE)):
+            return list_directory(self.source)
+
+    def test_entries_are_parsed_and_sorted_dirs_first(self):
+        entries = self._list()
+        self.assertEqual([e['name'] for e in entries],
+                         ['Sci-Fi', 'Der Steppenwolf.epub', 'notes.txt'])
+
+    def test_collection_itself_is_excluded(self):
+        self.assertNotIn('Books', [e['name'] for e in self._list()])
+
+    def test_book_flag_and_size(self):
+        by_name = {e['name']: e for e in self._list()}
+        self.assertTrue(by_name['Der Steppenwolf.epub']['is_book'])
+        self.assertEqual(by_name['Der Steppenwolf.epub']['size'], 4096)
+        self.assertFalse(by_name['notes.txt']['is_book'])
+        self.assertTrue(by_name['Sci-Fi']['is_dir'])
+
+    def test_redirect_is_refused_rather_than_followed(self):
+        redirect_response = _FakeResponse(status_code=302, headers={'Location': 'http://127.0.0.1/'})
+        with self.assertRaises(WebDAVError):
+            self._list(redirect_response)
+
+    def test_bad_credentials_surface_clearly(self):
+        with self.assertRaises(WebDAVError) as ctx:
+            self._list(_FakeResponse(status_code=401))
+        self.assertIn('App-Passwort', str(ctx.exception))
+
+
+class FetchFileTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+        self.source = WebDAVSource.objects.create(
+            user=self.user, label='cloud', base_url='https://cloud.example.com', username='alice',
+        )
+
+    def test_non_book_extension_refused_before_any_request(self):
+        with patch('accounts.webdav.requests.request') as mock_request:
+            with self.assertRaises(WebDAVError):
+                fetch_file(self.source, 'secrets.env', 1024)
+        mock_request.assert_not_called()
+
+    def test_declared_oversize_refused(self):
+        response = _FakeResponse(status_code=200, headers={'Content-Length': '99999'})
+        with patch('accounts.webdav.assert_safe_url'), \
+             patch('accounts.webdav.requests.request', return_value=response):
+            with self.assertRaises(WebDAVError):
+                fetch_file(self.source, 'big.epub', 1024)
+
+    def test_streamed_oversize_refused_even_without_content_length(self):
+        response = _FakeResponse(status_code=200, content=b'x' * 5000)
+        with patch('accounts.webdav.assert_safe_url'), \
+             patch('accounts.webdav.requests.request', return_value=response):
+            with self.assertRaises(WebDAVError):
+                fetch_file(self.source, 'sneaky.epub', 1024)
+
+    def test_successful_fetch_returns_bytes(self):
+        response = _FakeResponse(status_code=200, content=b'EPUB-BYTES')
+        with patch('accounts.webdav.assert_safe_url'), \
+             patch('accounts.webdav.requests.request', return_value=response):
+            self.assertEqual(fetch_file(self.source, 'ok.epub', 1024), b'EPUB-BYTES')
+
+
+class CloudImportViewTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+        self.other = User.objects.create_user(username='bob', password='pw12345678')
+        self.source = WebDAVSource.objects.create(
+            user=self.user, label='cloud', base_url='https://cloud.example.com', username='alice',
+        )
+        self.foreign = WebDAVSource.objects.create(
+            user=self.other, label='bobs', base_url='https://other.example.com', username='bob',
+        )
+
+    def test_endpoints_require_authentication(self):
+        self.assertEqual(self.client.get('/books/cloud/sources/').status_code, 401)
+        self.assertEqual(self.client.get(f'/books/cloud/{self.source.pk}/browse/').status_code, 401)
+        self.assertEqual(self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=a.epub').status_code, 401)
+
+    def test_sources_are_scoped_to_the_owner(self):
+        self.client.force_login(self.user)
+        labels = [s['label'] for s in self.client.get('/books/cloud/sources/').json()['sources']]
+        self.assertEqual(labels, ['cloud'])
+
+    def test_foreign_source_is_not_browsable(self):
+        self.client.force_login(self.user)
+        resp = self.client.get(f'/books/cloud/{self.foreign.pk}/browse/')
+        self.assertEqual(resp.status_code, 404)
+
+    def test_browse_returns_entries(self):
+        self.client.force_login(self.user)
+        entries = [{'name': 'Dune.epub', 'path': 'Dune.epub', 'is_dir': False,
+                    'size': 10, 'modified': '', 'is_book': True}]
+        with patch('books.webdav.list_directory', return_value=entries):
+            resp = self.client.get(f'/books/cloud/{self.source.pk}/browse/')
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.json()['entries'], entries)
+
+    def test_browse_reports_upstream_failure_as_502(self):
+        self.client.force_login(self.user)
+        with patch('books.webdav.list_directory', side_effect=WebDAVError('kaputt')):
+            resp = self.client.get(f'/books/cloud/{self.source.pk}/browse/')
+        self.assertEqual(resp.status_code, 502)
+        self.assertEqual(resp.json()['error'], 'kaputt')
+
+    def test_bad_user_input_is_400_not_502(self):
+        self.client.force_login(self.user)
+        resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=../../etc/passwd')
+        self.assertEqual(resp.status_code, 400)
+        resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=notes.txt')
+        self.assertEqual(resp.status_code, 400)
+
+    def test_fetch_streams_bytes_without_storing_them(self):
+        self.client.force_login(self.user)
+        with patch('books.webdav.fetch_file', return_value=b'EPUB-BYTES'):
+            resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=Dune.epub')
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.content, b'EPUB-BYTES')
+        # The proxy is a pass-through: nothing is persisted server-side.
+        self.assertEqual(EBook.objects.count(), 0)
+
+
+BILLION_LAUGHS = b'''<?xml version="1.0"?>
+<!DOCTYPE lolz [
+ <!ENTITY lol "lol">
+ <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
+ <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
+ <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
+ <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
+]>
+<d:multistatus xmlns:d="DAV:"><d:response><d:href>&lol4;</d:href></d:response></d:multistatus>'''
+
+# A server that answers with the 404 propstat first — legal per RFC 4918, and
+# what made directories disappear from the listing before _select_prop existed.
+PROPSTAT_404_FIRST = b'''<?xml version="1.0"?>
+<d:multistatus xmlns:d="DAV:">
+  <d:response>
+    <d:href>/remote.php/dav/files/alice/Books/</d:href>
+    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop>
+      <d:status>HTTP/1.1 200 OK</d:status></d:propstat>
+  </d:response>
+  <d:response>
+    <d:href>/remote.php/dav/files/alice/Books/Sci-Fi/</d:href>
+    <d:propstat><d:prop><d:getcontentlength/></d:prop>
+      <d:status>HTTP/1.1 404 Not Found</d:status></d:propstat>
+    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop>
+      <d:status>HTTP/1.1 200 OK</d:status></d:propstat>
+  </d:response>
+</d:multistatus>'''
+
+RELATIVE_HREF_RESPONSE = b'''<?xml version="1.0"?>
+<d:multistatus xmlns:d="DAV:">
+  <d:response><d:href>Dune.epub</d:href>
+    <d:propstat><d:prop><d:resourcetype/><d:getcontentlength>7</d:getcontentlength></d:prop>
+      <d:status>HTTP/1.1 200 OK</d:status></d:propstat>
+  </d:response>
+</d:multistatus>'''
+
+
+class WebDAVHardeningTests(TestCase):
+    """Regressions for the SSRF / resource-exhaustion review findings."""
+
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+        self.source = WebDAVSource.objects.create(
+            user=self.user, label='cloud', base_url='https://cloud.example.com',
+            username='alice', password='app-pw', root_path='Books',
+        )
+
+    def _list(self, response):
+        with patch('accounts.webdav.assert_safe_url'), \
+             patch('accounts.webdav.requests.request', return_value=response):
+            return list_directory(self.source)
+
+    # --- DNS rebinding -----------------------------------------------------
+
+    def test_peer_address_is_rechecked_after_connecting(self):
+        """A resolver that answers public-then-private must not leak a body.
+
+        assert_safe_url passes (it is given a public answer), but the socket
+        actually landed on a Docker-internal address.
+        """
+        response = _FakeResponse(content=PROPFIND_RESPONSE, peer='172.18.0.5')
+        with self.assertRaises(WebDAVError):
+            self._list(response)
+        self.assertTrue(response.closed)
+
+    def test_public_peer_is_accepted(self):
+        response = _FakeResponse(content=PROPFIND_RESPONSE, peer='85.214.6.118')
+        self.assertTrue(self._list(response))
+
+    @override_settings(WEBDAV_ALLOW_PRIVATE_HOSTS=True)
+    def test_peer_check_respects_the_opt_out(self):
+        response = _FakeResponse(content=PROPFIND_RESPONSE, peer='192.168.1.10')
+        self.assertTrue(self._list(response))
+
+    # --- Resource exhaustion ----------------------------------------------
+
+    def test_entity_expansion_is_refused(self):
+        with self.assertRaises(WebDAVError):
+            self._list(_FakeResponse(content=BILLION_LAUGHS))
+
+    def test_oversized_listing_is_refused(self):
+        oversized = _FakeResponse(headers={'Content-Length': str(9 * 1024 * 1024)})
+        with self.assertRaises(WebDAVError):
+            self._list(oversized)
+        self.assertTrue(oversized.closed)
+
+    # --- Information disclosure -------------------------------------------
+
+    def test_rejection_message_leaks_neither_ip_nor_resolvability(self):
+        private = [(2, 1, 6, '', ('172.18.0.5', 443))]
+        with patch('accounts.webdav.socket.getaddrinfo', return_value=private):
+            with self.assertRaises(WebDAVError) as private_ctx:
+                assert_safe_url('http://forgejo-db/')
+        with patch('accounts.webdav.socket.getaddrinfo', side_effect=socket.gaierror):
+            with self.assertRaises(WebDAVError) as missing_ctx:
+                assert_safe_url('http://forgejo-db/')
+
+        self.assertNotIn('172.18.0.5', str(private_ctx.exception))
+        # Same wording either way, so the endpoint cannot be used to tell an
+        # existing internal host from a nonexistent one.
+        self.assertEqual(str(private_ctx.exception), str(missing_ctx.exception))
+
+    # --- Malformed input ---------------------------------------------------
+
+    def test_invalid_port_is_reported_not_crashed(self):
+        with self.assertRaises(WebDAVError):
+            assert_safe_url('https://example.com:99999/dav/')
+
+    def test_ipv6_transition_ranges_are_rejected(self):
+        for address in ('64:ff9b::7f00:1', '::127.0.0.1'):
+            with patch('accounts.webdav.socket.getaddrinfo',
+                       return_value=[(10, 1, 6, '', (address, 443, 0, 0))]):
+                with self.assertRaises(WebDAVError, msg=address):
+                    assert_safe_url('https://nat64.example.com/')
+
+    # --- PROPFIND parsing --------------------------------------------------
+
+    def test_directory_survives_a_404_propstat_listed_first(self):
+        entries = self._list(_FakeResponse(content=PROPSTAT_404_FIRST))
+        by_name = {e['name']: e for e in entries}
+        self.assertTrue(by_name['Sci-Fi']['is_dir'])
+
+    def test_relative_hrefs_are_resolved(self):
+        entries = self._list(_FakeResponse(content=RELATIVE_HREF_RESPONSE))
+        self.assertEqual([e['name'] for e in entries], ['Dune.epub'])
+
+    # --- URL normalisation -------------------------------------------------
+
+    def test_host_named_webdav_still_gets_the_nextcloud_path(self):
+        source = WebDAVSource(user=self.user, label='x',
+                              base_url='https://webdav.example.com', username='alice')
+        self.assertEqual(
+            source.normalized_base_url(),
+            'https://webdav.example.com/remote.php/dav/files/alice/',
+        )
+
+
+class WebDAVSourceLimitTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+        self.client.force_login(self.user)
+
+    @override_settings(WEBDAV_MAX_SOURCES_PER_USER=2)
+    def test_sources_are_capped_per_user(self):
+        with patch('accounts.views._probe_source', return_value=(20, 'ok')):
+            for i in range(3):
+                self.client.post('/accounts/webdav/add/',
+                                 {'label': f'c{i}', 'base_url': 'https://example.com'})
+        self.assertEqual(self.user.webdav_sources.count(), 2)
+
+
+class CloudFetchCachingTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+        self.source = WebDAVSource.objects.create(
+            user=self.user, label='cloud', base_url='https://cloud.example.com', username='alice',
+        )
+
+    def test_plaintext_bytes_are_not_cacheable(self):
+        self.client.force_login(self.user)
+        with patch('books.webdav.fetch_file', return_value=b'EPUB-BYTES'):
+            resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=Dune.epub')
+        self.assertEqual(resp['Cache-Control'], 'no-store')

accounts/urls.py

@@ -16,4 +16,7 @@ urlpatterns = [
     path('check-password/', views.check_password, name='check_password'),
     path('change-password/', views.change_password, name='change_password'),
     path('api-token/regenerate/', views.regenerate_api_token, name='regenerate_api_token'),
+    path('webdav/add/', views.webdav_add, name='webdav_add'),
+    path('webdav/<int:pk>/test/', views.webdav_test, name='webdav_test'),
+    path('webdav/<int:pk>/delete/', views.webdav_delete, name='webdav_delete'),
 ]

accounts/views.py

@@ -1,6 +1,7 @@
 import base64
 import json
 from django.conf import settings
+from django.contrib import messages
 from django.contrib.auth import authenticate, login, get_user_model, update_session_auth_hash
 from django.contrib.auth.decorators import login_required
 from django.contrib.auth.forms import UserCreationForm, AuthenticationForm, PasswordChangeForm
@@ -11,7 +12,8 @@ from django.views.decorators.http import require_http_methods
 
 from radio import lastfm as lastfm_module
 
-from .models import ApiToken
+from .models import ApiToken, WebDAVSource
+from .webdav import WebDAVError, list_directory
 
 User = get_user_model()
 
@@ -75,6 +77,7 @@ def settings_view(request):
         'has_lastfm': profile.has_lastfm(),
         'password_form': PasswordChangeForm(request.user),
         'api_token': getattr(request.user, 'api_token', None),
+        'webdav_sources': request.user.webdav_sources.all(),
     }
     return render(request, 'accounts/settings.html', context)
 
@@ -213,6 +216,7 @@ def change_password(request):
         'password_form': form,
         'password_form_open': True,
         'api_token': getattr(request.user, 'api_token', None),
+        'webdav_sources': request.user.webdav_sources.all(),
     })
 
 
@@ -236,3 +240,73 @@ def regenerate_api_token(request):
     token, _ = ApiToken.objects.get_or_create(user=request.user)
     token.regenerate()
     return redirect('settings')
+
+
+# ---------------------------------------------------------------------------
+# WebDAV sources (Nextcloud & friends) — used by the ebook cloud import
+# ---------------------------------------------------------------------------
+
+def _probe_source(source):
+    """Report a source's reachability as a (level, message) pair for messages."""
+    try:
+        entries = list_directory(source)
+    except WebDAVError as exc:
+        return messages.WARNING, f'„{source.label}“ gespeichert, aber nicht erreichbar: {exc}'
+    books = sum(1 for e in entries if e['is_book'])
+    folders = sum(1 for e in entries if e['is_dir'])
+    return messages.SUCCESS, (
+        f'„{source.label}“ verbunden — {books} Buch/Bücher und {folders} Ordner im Startverzeichnis.'
+    )
+
+
+@login_required
+@require_http_methods(['POST'])
+def webdav_add(request):
+    label = request.POST.get('label', '').strip()
+    base_url = request.POST.get('base_url', '').strip()
+
+    if not label or not base_url:
+        messages.error(request, 'Name und Server-URL sind erforderlich.')
+        return redirect('settings')
+
+    # Each source costs a synchronous probe on add and is reachable from the
+    # import endpoints, so cap how many one account can pile up.
+    max_sources = getattr(settings, 'WEBDAV_MAX_SOURCES_PER_USER', 10)
+    if request.user.webdav_sources.count() >= max_sources:
+        messages.error(request, f'Maximal {max_sources} Cloud-Verbindungen pro Konto.')
+        return redirect('settings')
+
+    source = WebDAVSource.objects.create(
+        user=request.user,
+        label=label[:100],
+        base_url=base_url[:500],
+        username=request.POST.get('username', '').strip()[:200],
+        password=request.POST.get('password', '')[:500],
+        root_path=request.POST.get('root_path', '').strip()[:500],
+    )
+
+    level, message = _probe_source(source)
+    messages.add_message(request, level, message)
+    return redirect('settings')
+
+
+@login_required
+@require_http_methods(['POST'])
+def webdav_test(request, pk):
+    source = WebDAVSource.objects.filter(pk=pk, user=request.user).first()
+    if not source:
+        messages.error(request, 'Verbindung nicht gefunden.')
+        return redirect('settings')
+
+    level, message = _probe_source(source)
+    messages.add_message(request, level, message)
+    return redirect('settings')
+
+
+@login_required
+@require_http_methods(['POST'])
+def webdav_delete(request, pk):
+    deleted, _ = WebDAVSource.objects.filter(pk=pk, user=request.user).delete()
+    if deleted:
+        messages.success(request, 'Verbindung entfernt.')
+    return redirect('settings')

accounts/webdav.py

@@ -0,0 +1,380 @@
+"""Minimal, hardened WebDAV client behind the ebook cloud import.
+
+Only PROPFIND (Depth 1) and GET are implemented — enough to browse a remote
+folder and pull a single file out of it.
+
+Every request here is made by the server to a URL the *user* supplied, which
+makes this an SSRF surface: registration is open (accounts/views.py:23) and
+diora normally runs in a Docker network next to other services. Three things
+guard it, and all three are load-bearing:
+
+  * `assert_safe_url` refuses hosts that resolve to non-public addresses,
+  * `_assert_peer_is_safe` re-checks the address we *actually* connected to,
+    because requests resolves the hostname a second time and a hostile resolver
+    can answer differently across the two lookups (DNS rebinding),
+  * redirects are refused rather than followed, so a public host cannot bounce
+    us onto a private one.
+
+Residual risk worth knowing about: a rebinding attacker can still cause a
+single request to be *sent* to an internal address; the peer check runs before
+the body is read, so nothing comes back to them. Fully closing that needs
+connect-time DNS pinning, which requests does not expose without reaching into
+urllib3.
+
+Response bodies are read through `_read_capped` and parsed only after any DTD
+is refused — the remote server is attacker-chosen, so an unbounded read or a
+billion-laughs document would otherwise be a cheap way to OOM the container.
+"""
+
+import ipaddress
+import socket
+import xml.etree.ElementTree as ET
+from urllib.parse import quote, unquote, urljoin, urlsplit
+
+import requests
+from django.conf import settings
+
+DAV_NS = '{DAV:}'
+
+BOOK_EXTENSIONS = ('.epub', '.pdf')
+
+# A directory listing is XML; anything this large is not a real one.
+MAX_LISTING_BYTES = 8 * 1024 * 1024
+
+
+class WebDAVError(Exception):
+    """Failure with a message that is safe to show the user directly."""
+
+
+class WebDAVInputError(WebDAVError):
+    """The user's own URL/path/credentials are at fault, not the remote server.
+
+    Separated so views can answer 400 instead of 502 — a rejected traversal
+    attempt is not an upstream outage.
+    """
+
+
+def _timeout():
+    return getattr(settings, 'WEBDAV_TIMEOUT', 15)
+
+
+def _allow_private():
+    return getattr(settings, 'WEBDAV_ALLOW_PRIVATE_HOSTS', False)
+
+
+# ---------------------------------------------------------------------------
+# SSRF guard
+# ---------------------------------------------------------------------------
+
+def _unreachable(host):
+    """One message for every "we won't talk to this" case.
+
+    Deliberately does not say whether the name failed to resolve or resolved to
+    a private address, and never echoes the resolved IP: telling those apart
+    would turn this endpoint into a scanner for the Docker network's service
+    names and addresses.
+    """
+    return WebDAVInputError(
+        f'„{host}“ ist nicht öffentlich erreichbar. Aus Sicherheitsgründen sind nur '
+        'öffentlich auflösbare Server erlaubt.'
+    )
+
+
+def _is_public(raw_address):
+    """True only for addresses we are willing to open a connection to."""
+    try:
+        # Scope IDs ('fe80::1%eth0') are not part of the address itself.
+        ip = ipaddress.ip_address(raw_address.split('%')[0])
+    except ValueError:
+        return False
+    if not ip.is_global:
+        return False
+    # is_global misses two IPv6 transition ranges that can carry an embedded
+    # private IPv4 address: the well-known NAT64 prefix (RFC 6052) and the
+    # deprecated IPv4-compatible range.
+    if ip.version == 6:
+        for unsafe in ('64:ff9b::/96', '::/96'):
+            if ip in ipaddress.ip_network(unsafe):
+                return False
+    return True
+
+
+def assert_safe_url(url):
+    """Reject URLs that don't resolve to a public address.
+
+    Self-hosted setups that legitimately want a LAN target can opt out with
+    WEBDAV_ALLOW_PRIVATE_HOSTS=True, which is why this is a setting and not a
+    hard rule.
+    """
+    parts = urlsplit(url)
+    if parts.scheme not in ('http', 'https'):
+        raise WebDAVInputError('Nur http:// und https:// werden unterstützt.')
+
+    host = parts.hostname
+    if not host:
+        raise WebDAVInputError('Die URL enthält keinen Hostnamen.')
+
+    try:
+        port = parts.port or (443 if parts.scheme == 'https' else 80)
+    except ValueError:
+        # urlsplit validates the port lazily, on attribute access.
+        raise WebDAVInputError('Die URL enthält einen ungültigen Port.')
+
+    if _allow_private():
+        return
+
+    try:
+        infos = socket.getaddrinfo(host, port, proto=socket.IPPROTO_TCP)
+    except socket.gaierror:
+        raise _unreachable(host)
+
+    for info in infos:
+        if not _is_public(info[4][0]):
+            raise _unreachable(host)
+
+
+def _assert_peer_is_safe(response):
+    """Re-check the address the socket actually connected to.
+
+    `assert_safe_url` validates DNS before the request, but requests resolves
+    the name again when it opens the connection. A resolver answering
+    public-then-private across those two lookups would otherwise hand us an
+    internal service's response body.
+    """
+    if _allow_private():
+        return
+    sock = getattr(getattr(response.raw, '_connection', None), 'sock', None)
+    if sock is None:
+        return  # nothing to introspect (mocked, or already released)
+    try:
+        peer = sock.getpeername()[0]
+    except OSError:
+        return
+    if not _is_public(peer):
+        raise WebDAVInputError('Der Server ist nicht öffentlich erreichbar.')
+
+
+# ---------------------------------------------------------------------------
+# Path helpers
+# ---------------------------------------------------------------------------
+
+def safe_rel_path(raw):
+    """Normalise a client-supplied path and keep it inside the source root.
+
+    Whatever survives here is percent-encoded by `_build_url` with `quote()`'s
+    default `safe='/'`, and that is what stops double-encoded traversal
+    ('%252e%252e%252f') and smuggled absolute URLs: '%' and ':' both get
+    escaped, so they land as literal filename characters. Widening that safe
+    set would reopen those paths.
+    """
+    raw = (raw or '').strip().strip('/')
+    if not raw:
+        return ''
+    segments = []
+    for segment in raw.split('/'):
+        if not segment or segment == '.':
+            continue
+        if segment == '..':
+            raise WebDAVInputError('Ungültiger Pfad.')
+        segments.append(segment)
+    return '/'.join(segments)
+
+
+def _build_url(source, rel_path):
+    base = source.normalized_base_url()
+    if not rel_path:
+        return base
+    return base + quote(rel_path)
+
+
+def _request(method, url, source, **kwargs):
+    assert_safe_url(url)
+    auth = (source.username, source.password) if source.username else None
+    try:
+        # Always streamed: it keeps the connection open long enough to inspect
+        # the peer, and stops requests from buffering an unbounded body before
+        # we get the chance to cap it.
+        response = requests.request(
+            method, url, auth=auth, timeout=_timeout(),
+            allow_redirects=False, stream=True, **kwargs
+        )
+    except requests.Timeout:
+        raise WebDAVError('Zeitüberschreitung beim Server.')
+    except requests.RequestException as exc:
+        raise WebDAVError(f'Verbindung fehlgeschlagen: {exc.__class__.__name__}')
+
+    try:
+        _assert_peer_is_safe(response)
+
+        if response.status_code in (301, 302, 303, 307, 308):
+            raise WebDAVError(
+                'Der Server hat eine Weiterleitung geschickt. '
+                'Bitte trage die Ziel-URL direkt ein.'
+            )
+        if response.status_code in (401, 403):
+            raise WebDAVInputError('Anmeldung abgelehnt — Benutzername oder App-Passwort prüfen.')
+        if response.status_code == 404:
+            raise WebDAVError('Pfad auf dem Server nicht gefunden.')
+        if response.status_code >= 400:
+            raise WebDAVError(f'Server antwortete mit HTTP {response.status_code}.')
+    except Exception:
+        response.close()
+        raise
+
+    return response
+
+
+def _read_capped(response, max_bytes, oversize_error):
+    """Read a streamed body, aborting as soon as it exceeds `max_bytes`."""
+    declared = response.headers.get('Content-Length')
+    if declared and declared.isdigit() and int(declared) > max_bytes:
+        response.close()
+        raise oversize_error()
+
+    chunks = []
+    total = 0
+    try:
+        for chunk in response.iter_content(chunk_size=64 * 1024):
+            total += len(chunk)
+            if total > max_bytes:
+                raise oversize_error()
+            chunks.append(chunk)
+    except requests.RequestException:
+        raise WebDAVError('Übertragung abgebrochen.')
+    finally:
+        response.close()
+
+    return b''.join(chunks)
+
+
+# ---------------------------------------------------------------------------
+# PROPFIND / GET
+# ---------------------------------------------------------------------------
+
+_PROPFIND_BODY = (
+    '<?xml version="1.0" encoding="utf-8"?>'
+    '<d:propfind xmlns:d="DAV:"><d:prop>'
+    '<d:resourcetype/><d:getcontentlength/><d:getlastmodified/>'
+    '</d:prop></d:propfind>'
+)
+
+
+def _parse_listing_xml(payload):
+    """Parse a multistatus body, refusing any document that carries a DTD.
+
+    The remote server is chosen by the user, so a billion-laughs document is
+    within an attacker's reach, and ElementTree *does* expand internal entities
+    (verified on 3.12: a 3-level document expands). Installing an expat
+    EntityDeclHandler is not an option either — `XMLParser.parser` no longer
+    exists in 3.12, so setting it silently does nothing.
+
+    That leaves rejecting the DTD before parsing. It costs nothing: a real
+    multistatus never has one, and a filename containing this text would arrive
+    escaped as `&lt;!DOCTYPE`, so these bytes can only ever be markup.
+    """
+    lowered = payload.lower()
+    if b'<!doctype' in lowered or b'<!entity' in lowered:
+        raise WebDAVError('Die Antwort enthält eine DTD und wurde abgelehnt.')
+
+    try:
+        return ET.fromstring(payload)
+    except (ET.ParseError, ValueError):
+        raise WebDAVError('Unerwartete Antwort — ist das wirklich eine WebDAV-URL?')
+
+
+def _select_prop(node):
+    """Return the <prop> block that actually applies.
+
+    RFC 4918 lets a server split its answer across several <propstat> blocks —
+    typically a 200 for the properties it found and a 404 for the ones it did
+    not, in no guaranteed order. Taking the first one blindly mislabels
+    directories (whose getcontentlength is the missing property) as files, and
+    the client then filters them out of the listing entirely.
+    """
+    fallback = None
+    for propstat in node.findall(f'{DAV_NS}propstat'):
+        prop = propstat.find(f'{DAV_NS}prop')
+        if prop is None:
+            continue
+        if ' 200 ' in (propstat.findtext(f'{DAV_NS}status') or ''):
+            return prop
+        if fallback is None:
+            fallback = prop
+    return fallback
+
+
+def list_directory(source, rel_path=''):
+    """PROPFIND Depth 1, returned as entries relative to the source root."""
+    rel_path = safe_rel_path(rel_path)
+    url = _build_url(source, rel_path)
+    if not url.endswith('/'):
+        url += '/'
+
+    response = _request(
+        'PROPFIND', url, source,
+        headers={'Depth': '1', 'Content-Type': 'application/xml; charset=utf-8'},
+        data=_PROPFIND_BODY.encode('utf-8'),
+    )
+    payload = _read_capped(
+        response, MAX_LISTING_BYTES,
+        lambda: WebDAVError('Verzeichnisliste ist unerwartet groß.'),
+    )
+
+    root = _parse_listing_xml(payload)
+    base_path = unquote(urlsplit(url).path)
+    entries = []
+
+    for node in root.findall(f'{DAV_NS}response'):
+        href = node.findtext(f'{DAV_NS}href') or ''
+        # hrefs come as absolute URLs, absolute paths, or relative references.
+        href_path = unquote(urlsplit(urljoin(url, href)).path)
+        if not href_path.startswith(base_path):
+            continue
+        remainder = href_path[len(base_path):].strip('/')
+        if not remainder:
+            continue  # the collection we asked about
+        if '/' in remainder:
+            continue  # Depth 1 should not return these, but be strict anyway
+
+        prop = _select_prop(node)
+        is_dir = (
+            prop is not None
+            and prop.find(f'{DAV_NS}resourcetype/{DAV_NS}collection') is not None
+        )
+        size_text = prop.findtext(f'{DAV_NS}getcontentlength') if prop is not None else None
+        try:
+            size = int(size_text) if size_text else 0
+        except ValueError:
+            size = 0
+
+        entries.append({
+            'name': remainder,
+            'path': f'{rel_path}/{remainder}' if rel_path else remainder,
+            'is_dir': is_dir,
+            'size': size,
+            'modified': (prop.findtext(f'{DAV_NS}getlastmodified') or '') if prop is not None else '',
+            'is_book': (not is_dir) and remainder.lower().endswith(BOOK_EXTENSIONS),
+        })
+
+    entries.sort(key=lambda e: (not e['is_dir'], e['name'].lower()))
+    return entries
+
+
+def fetch_file(source, rel_path, max_bytes):
+    """Download one file, refusing anything larger than `max_bytes`.
+
+    Reads into memory rather than to disk: the caller hands the bytes straight
+    back to the browser, which encrypts them. Nothing readable is persisted
+    server-side.
+    """
+    rel_path = safe_rel_path(rel_path)
+    if not rel_path:
+        raise WebDAVInputError('Kein Pfad angegeben.')
+    if not rel_path.lower().endswith(BOOK_EXTENSIONS):
+        raise WebDAVInputError('Nur .epub- und .pdf-Dateien können importiert werden.')
+
+    response = _request('GET', _build_url(source, rel_path), source)
+    return _read_capped(
+        response, max_bytes,
+        lambda: WebDAVInputError(f'Datei ist zu groß (max. {max_bytes // 1024 // 1024} MB).'),
+    )

books/urls.py

@@ -1,9 +1,12 @@
 from django.urls import path
-from . import views
+from . import views, webdav
 
 urlpatterns = [
     path('', views.book_list, name='book_list'),
     path('upload/', views.upload_book, name='upload_book'),
+    path('cloud/sources/', webdav.cloud_sources, name='cloud_sources'),
+    path('cloud/<int:pk>/browse/', webdav.cloud_browse, name='cloud_browse'),
+    path('cloud/<int:pk>/fetch/', webdav.cloud_fetch, name='cloud_fetch'),
     path('metadata-lookup/', views.lookup_book_metadata, name='lookup_book_metadata'),
     path('<int:pk>/data/', views.get_book_data, name='get_book_data'),
     path('<int:pk>/delete/', views.delete_book, name='delete_book'),

books/webdav.py

@@ -0,0 +1,89 @@
+"""Cloud import endpoints for the ebook library.
+
+These let the browser browse a user-configured WebDAV server and pull one book
+out of it. The fetch is proxied through the server rather than done in the
+browser because the WebDAV host is a different origin and will not send CORS
+headers for it.
+
+That proxy is a deliberate, narrow relaxation of the same rule the ISBN lookup
+in books/views.py bends: the server sees the file's bytes in memory for the
+duration of one request, but never persists them. The book is encrypted in the
+browser and only then POSTed to /books/upload/ as ciphertext, exactly like a
+local upload — nothing readable is ever stored server-side.
+"""
+
+from django.conf import settings
+from django.http import HttpResponse, JsonResponse
+from django.utils import timezone
+from django.views.decorators.http import require_http_methods
+
+from accounts.models import WebDAVSource
+from accounts.webdav import WebDAVError, WebDAVInputError, list_directory, fetch_file
+from .views import _require_auth
+
+
+def _get_source(request, pk):
+    return WebDAVSource.objects.filter(pk=pk, user=request.user).first()
+
+
+@require_http_methods(['GET'])
+def cloud_sources(request):
+    unauthorized = _require_auth(request)
+    if unauthorized:
+        return unauthorized
+
+    sources = request.user.webdav_sources.all()
+    return JsonResponse({'sources': [
+        {'id': s.id, 'label': s.label, 'host': s.base_url}
+        for s in sources
+    ]})
+
+
+@require_http_methods(['GET'])
+def cloud_browse(request, pk):
+    unauthorized = _require_auth(request)
+    if unauthorized:
+        return unauthorized
+
+    source = _get_source(request, pk)
+    if not source:
+        return JsonResponse({'error': 'unknown source'}, status=404)
+
+    path = request.GET.get('path', '')
+    try:
+        entries = list_directory(source, path)
+    except WebDAVInputError as exc:
+        return JsonResponse({'error': str(exc)}, status=400)
+    except WebDAVError as exc:
+        return JsonResponse({'error': str(exc)}, status=502)
+
+    source.last_used_at = timezone.now()
+    source.save(update_fields=['last_used_at'])
+
+    return JsonResponse({'ok': True, 'path': path, 'entries': entries})
+
+
+@require_http_methods(['GET'])
+def cloud_fetch(request, pk):
+    unauthorized = _require_auth(request)
+    if unauthorized:
+        return unauthorized
+
+    source = _get_source(request, pk)
+    if not source:
+        return JsonResponse({'error': 'unknown source'}, status=404)
+
+    path = request.GET.get('path', '')
+    try:
+        payload = fetch_file(source, path, settings.EBOOK_MAX_BYTES)
+    except WebDAVInputError as exc:
+        return JsonResponse({'error': str(exc)}, status=400)
+    except WebDAVError as exc:
+        return JsonResponse({'error': str(exc)}, status=502)
+
+    response = HttpResponse(payload, content_type='application/octet-stream')
+    # These are the book's plaintext bytes, on their way to be encrypted in the
+    # browser. Keeping them out of the HTTP disk cache (and any reverse proxy
+    # in front) is what makes "nothing readable is stored" true end to end.
+    response['Cache-Control'] = 'no-store'
+    return response

diora/settings.py

@@ -30,6 +30,7 @@ INSTALLED_APPS = [
     'podcasts',
     'books',
     'gpodder',
+    'tts',
 ]
 
 EBOOK_MAX_BYTES = 50 * 1024 * 1024  # 50 MB
@@ -97,7 +98,23 @@ STATIC_URL = '/static/'
 STATICFILES_DIRS = [BASE_DIR / 'static']
 STATIC_ROOT = BASE_DIR / 'staticfiles'
 
-STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
+# Django 5.1 removed STATICFILES_STORAGE in favour of STORAGES. The old setting
+# sat here being silently ignored, so whitenoise fell back to plain
+# StaticFilesStorage and served everything uncompressed — app.js went out at
+# 251 KB instead of 62 KB on every cold load.
+#
+# The hashed filenames this also generates are inert: no template uses
+# {% static %}, they all hardcode /static/… paths. Cache busting comes from the
+# service worker's CACHE version instead (static/js/sw.js), which is why it is
+# bumped on each release.
+STORAGES = {
+    'default': {
+        'BACKEND': 'django.core.files.storage.FileSystemStorage',
+    },
+    'staticfiles': {
+        'BACKEND': 'whitenoise.storage.CompressedManifestStaticFilesStorage',
+    },
+}
 
 MEDIA_URL = '/media/'
 MEDIA_ROOT = BASE_DIR / 'media'
@@ -106,9 +123,11 @@ BG_MAX_BYTES = 5 * 1024 * 1024          # 5 MB
 HIGHLIGHTS_MAX_BYTES = 700 * 1024       # 700 KB
 BOOKMARKS_MAX_BYTES = 100 * 1024        # 100 KB
 
-VOLUME_DEFAULT = 204                    # out of 255
+VOLUME_DEFAULT = 102                    # out of 255 (40%)
 ITUNES_TIMEOUT = 6                      # seconds
 BOOK_METADATA_TIMEOUT = 6               # seconds (DNB / Open Library shelf lookup)
+WEBDAV_TIMEOUT = 15                     # seconds (cloud import browse/fetch)
+WEBDAV_MAX_SOURCES_PER_USER = 10
 PODCAST_INBOX_PAGE_SIZE = 200
 
 DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
@@ -125,4 +144,18 @@ LASTFM_API_SECRET = os.environ.get('LASTFM_API_SECRET', '')
 AMAZON_AFFILIATE_TAG = os.environ.get('AMAZON_AFFILIATE_TAG', 'diora-20')
 AMAZON_AFFILIATE_ENABLED = os.environ.get('AMAZON_AFFILIATE_ENABLED', 'True') == 'True'
 
+# WebDAV cloud import (ebooks). Users supply the target URL, so by default the
+# server refuses to talk to non-public addresses — otherwise any registered
+# account could probe the internal network through it. Set to True only when
+# every account on this instance is trusted and the WebDAV server is on the LAN.
+WEBDAV_ALLOW_PRIVATE_HOSTS = os.environ.get('WEBDAV_ALLOW_PRIVATE_HOSTS', 'False') == 'True'
+
 BUILD_TIME = os.environ.get('BUILD_TIME', '')
+
+# Piper voice models for the reader's read-aloud feature (see tts/piper_engine.py).
+TTS_VOICES = {
+    'de': os.environ.get(
+        'TTS_MODEL_PATH_DE', str(BASE_DIR / 'tts_models' / 'de_DE-thorsten-medium.onnx')),
+    'en': os.environ.get(
+        'TTS_MODEL_PATH_EN', str(BASE_DIR / 'tts_models' / 'en_US-lessac-medium.onnx')),
+}

diora/urls.py

@@ -11,6 +11,7 @@ urlpatterns = [
     path('accounts/', include('accounts.urls')),
     path('podcasts/', include('podcasts.urls')),
     path('books/', include('books.urls')),
+    path('tts/', include('tts.urls')),
     path('api/2/', include('gpodder.urls')),
     path('api/sync/', sync_snapshot, name='api_sync'),
     # Served at the root (not /static/js/sw.js) so its default scope covers

radio/urls.py

@@ -19,4 +19,6 @@ urlpatterns = [
     path('radio/focus/record/', views.record_focus_session, name='record_focus_session'),
     path('radio/focus/stats/', views.focus_stats, name='focus_stats'),
     path('radio/stream-player/', views.stream_player, name='stream_player'),
+    path('radio/creamfresh-stream/', views.creamfresh_stream, name='creamfresh_stream'),
+    path('radio/creamfresh-feedback/', views.creamfresh_feedback, name='creamfresh_feedback'),
 ]

radio/views.py

@@ -581,6 +581,74 @@ def import_m3u(request):
 # Minimal HTTP stream player (standalone tab for mixed-content streams)
 # ---------------------------------------------------------------------------
 
+# ---------------------------------------------------------------------------
+# creamfresh radio proxy
+# ---------------------------------------------------------------------------
+
+# Held server-side only -- never exposed to the browser this way. The
+# upstream is protected by HTTP Basic Auth; a plain <audio src="user:pass@..">
+# doesn't get credentials honoured consistently across browsers, so this
+# transparently relays the request instead (including the client's own
+# Icy-MetaData header, so the existing icy.py-based metadata SSE keeps
+# working unmodified when pointed at this URL instead of the direct one).
+CREAMFRESH_STREAM_URL = 'https://radio.creamfresh.xyz/stream.mp3'
+CREAMFRESH_AUTH = ('player', 'MJMr58p83zAU5zZaDGU0_BIn')
+
+
+def creamfresh_stream(request):
+    headers = {}
+    if request.META.get('HTTP_ICY_METADATA'):
+        headers['Icy-MetaData'] = request.META['HTTP_ICY_METADATA']
+    try:
+        upstream = requests.get(
+            CREAMFRESH_STREAM_URL,
+            auth=CREAMFRESH_AUTH,
+            headers=headers,
+            stream=True,
+            timeout=15,
+        )
+    except requests.RequestException:
+        return HttpResponse(status=502)
+
+    response = StreamingHttpResponse(
+        upstream.iter_content(chunk_size=4096),
+        content_type=upstream.headers.get('Content-Type', 'audio/mpeg'),
+        status=upstream.status_code,
+    )
+    for h in ('icy-metaint', 'icy-name', 'icy-genre', 'icy-br', 'icy-description', 'icy-url'):
+        if h in upstream.headers:
+            response[h] = upstream.headers[h]
+    response['Cache-Control'] = 'no-cache'
+    return response
+
+
+@csrf_exempt
+@require_http_methods(['POST'])
+def creamfresh_feedback(request):
+    """Relays a thumbs up/down to the creamfresh DJ's own /dj/feedback --
+    same server-side-credentials reasoning as creamfresh_stream above."""
+    try:
+        body = json.loads(request.body)
+    except (json.JSONDecodeError, ValueError):
+        return JsonResponse({'error': 'invalid JSON'}, status=400)
+
+    vote = body.get('vote')
+    if vote not in ('up', 'down'):
+        return JsonResponse({'error': "vote must be 'up' or 'down'"}, status=400)
+
+    try:
+        upstream = requests.post(
+            'https://radio.creamfresh.xyz/dj/feedback',
+            auth=CREAMFRESH_AUTH,
+            json={'vote': vote},
+            timeout=15,
+        )
+    except requests.RequestException:
+        return JsonResponse({'error': 'upstream unreachable'}, status=502)
+
+    return JsonResponse(upstream.json(), status=upstream.status_code, safe=False)
+
+
 def stream_player(request):
     url  = request.GET.get('url',  '').strip()
     name = request.GET.get('name', '').strip()

requirements.txt

@@ -1,7 +1,19 @@
-django>=4.2
-pylast>=5.2
-requests>=2.31
-python-dotenv>=1.0
-whitenoise>=6.6
-feedparser>=6.0
-gevent>=24.0
+# Pinned to exact versions. These are what production runs and what the test
+# suite is green against — with `>=` the image you get depends on the day you
+# build it, which is how a rebuild once swapped in a gunicorn that could not
+# boot the gevent worker at all.
+#
+# Nothing here updates on its own any more, so bump deliberately: change a
+# version, let CI run, then deploy.
+Django==6.1
+pylast==7.1.0
+requests==2.34.2
+python-dotenv==1.2.3
+whitenoise==6.12.0
+feedparser==6.0.14
+gevent==26.8.0
+# gunicorn 26.2.0 imports packaging.version in ggevent.py while declaring no
+# dependencies of its own, so packaging has to be requested explicitly.
+gunicorn==26.2.0
+packaging==26.3
+piper-tts==1.7.0

static/css/app.css

@@ -710,6 +710,161 @@ a:hover {
   padding: 1.5rem 0;
 }
 
+/* --- WebDAV cloud connections (settings) --- */
+
+.webdav-list {
+  list-style: none;
+  margin: 0 0 1rem;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.webdav-item {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 0.6rem 0.75rem;
+}
+
+.webdav-item-info {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  min-width: 0;
+  word-break: break-all;
+}
+
+.webdav-item-actions {
+  display: flex;
+  gap: 0.5rem;
+}
+
+.webdav-form {
+  display: flex;
+  flex-direction: column;
+  gap: 0.6rem;
+  border-top: 1px solid var(--border);
+  padding-top: 1rem;
+}
+
+.webdav-field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+  font-size: 0.85rem;
+  color: var(--text-muted);
+}
+
+.webdav-field input {
+  background: var(--bg-alt);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  color: var(--text);
+  font-family: var(--font);
+  font-size: 0.9rem;
+  padding: 0.45rem 0.7rem;
+  outline: none;
+  width: 100%;
+}
+
+.webdav-field input:focus {
+  border-color: var(--accent);
+}
+
+.webdav-form .btn {
+  align-self: flex-start;
+}
+
+/* --- Cloud import browser (books tab) --- */
+
+.cloud-browser {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 0.75rem;
+  margin-bottom: 1rem;
+}
+
+.cloud-browser-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+}
+
+.cloud-browser-head select {
+  background: var(--bg-alt);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  color: var(--text);
+  font-family: var(--font);
+  font-size: 0.85rem;
+  padding: 0.3rem 0.5rem;
+  outline: none;
+}
+
+.cloud-path {
+  font-size: 0.8rem;
+  color: var(--text-muted);
+  word-break: break-all;
+}
+
+.cloud-entries {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  max-height: 320px;
+  overflow-y: auto;
+  display: flex;
+  flex-direction: column;
+}
+
+.cloud-entry {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  padding: 0.4rem 0.25rem;
+  border-bottom: 1px solid var(--border);
+}
+
+.cloud-entry:last-child {
+  border-bottom: none;
+}
+
+.cloud-entry-name {
+  background: none;
+  border: none;
+  color: inherit;
+  font-family: var(--font);
+  font-size: 0.9rem;
+  text-align: left;
+  padding: 0;
+  cursor: pointer;
+  word-break: break-all;
+  flex: 1;
+  min-width: 0;
+}
+
+.cloud-entry-name:hover {
+  color: var(--accent);
+}
+
+.cloud-entry-size {
+  font-size: 0.75rem;
+  color: var(--text-muted);
+  white-space: nowrap;
+}
+
 /* =========================================================
    RESPONSIVE
    ========================================================= */
@@ -1481,6 +1636,12 @@ body.dnd-mode .timer-display {
   padding: 4px 6px; font-size: 0.82rem; cursor: pointer;
 }
 
+.tts-lang-select {
+  background: var(--surface, #1e1e2e); color: var(--fg, #fff);
+  border: 1px solid var(--border, #444); border-radius: 4px;
+  padding: 2px 4px; font-size: 0.8rem; cursor: pointer;
+}
+
 .reader-marker-btn-mobile { display: none; }
 
 @media (max-width: 600px) {
@@ -2042,6 +2203,12 @@ mark.reader-search-match { background:rgba(241,196,15,.6); color:inherit; border
 mark.reader-search-match.active { background:rgba(230,57,70,.7); }
 #rs-search-count { font-size:12px; min-width:50px; }
 
+/* Read-aloud (TTS) */
+mark.tts-current { background:rgba(230,57,70,.55); color:inherit; border-radius:2px; }
+.tts-bar { position:fixed; bottom:calc(var(--bar-h) + 16px); left:50%; transform:translateX(-50%); display:flex; align-items:center; gap:14px; background:var(--bg-card,#1a1a1a); border:1px solid var(--border); border-radius:var(--radius); padding:8px 16px; box-shadow:0 4px 16px rgba(0,0,0,.5); z-index:600; }
+.tts-bar button { background:none; border:none; color:inherit; font-size:16px; cursor:pointer; padding:2px 4px; line-height:1; }
+.tts-bar button:hover { opacity:0.7; }
+
 /* Bookmarks sidebar */
 .bookmark-entry { display:flex; width:100%; padding:6px 0; font-size:13px; justify-content:space-between; border-bottom:1px solid var(--border); }
 

static/js/app.js

@@ -9,6 +9,10 @@
 // State
 // ---------------------------------------------------------------------------
 
+// Hardcoded for now -- only creamfresh radio gets the vote buttons, since
+// only its backend (the DJ) actually does anything with them.
+const CREAMFRESH_RADIO_URL = 'https://diora.creamfresh.xyz/radio/creamfresh-stream/';
+
 let currentStation = null;   // { url, name, id } | null
 let currentTrack = '';
 let sseSource = null;
@@ -176,6 +180,12 @@ function playStation(url, name, stationId) {
   $('play-stop-btn').classList.add('playing');
   $('save-station-btn').style.display = '';
 
+  const isCreamfresh = url === CREAMFRESH_RADIO_URL;
+  $('creamfresh-vote-up-btn').style.display = isCreamfresh ? '' : 'none';
+  $('creamfresh-vote-down-btn').style.display = isCreamfresh ? '' : 'none';
+  $('creamfresh-vote-up-btn').classList.remove('active');
+  $('creamfresh-vote-down-btn').classList.remove('active');
+
   startMetadataSSE(url);
   startPlaySession(name, url);
   maybeShowDonationHint(url, name);
@@ -220,6 +230,8 @@ function stopPlayback(clearStation = true) {
   $('play-stop-btn').textContent = '▶ Play';
   $('play-stop-btn').classList.remove('playing');
   $('save-station-btn').style.display = 'none';
+  $('creamfresh-vote-up-btn').style.display = 'none';
+  $('creamfresh-vote-down-btn').style.display = 'none';
   $('affiliate-section').style.display = 'none';
 
   stopPlaySession();
@@ -604,6 +616,36 @@ async function saveCurrentStation() {
   await saveStation(data);
 }
 
+// ---------------------------------------------------------------------------
+// creamfresh radio: DJ feedback (hardcoded to this one station, see
+// CREAMFRESH_RADIO_URL above)
+// ---------------------------------------------------------------------------
+
+async function creamfreshVote(direction) {
+  const upBtn = $('creamfresh-vote-up-btn');
+  const downBtn = $('creamfresh-vote-down-btn');
+  upBtn.disabled = true;
+  downBtn.disabled = true;
+  try {
+    const res = await fetch('/radio/creamfresh-feedback/', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRFToken': getCsrfToken(),
+      },
+      body: JSON.stringify({ vote: direction }),
+    });
+    if (!res.ok) throw new Error(`feedback returned ${res.status}`);
+    upBtn.classList.toggle('active', direction === 'up');
+    downBtn.classList.toggle('active', direction === 'down');
+  } catch (err) {
+    console.warn('creamfresh vote failed', err);
+  } finally {
+    upBtn.disabled = false;
+    downBtn.disabled = false;
+  }
+}
+
 async function saveStation(station) {
   try {
     const res = await fetch('/radio/save/', {
@@ -3776,23 +3818,31 @@ async function deriveAndStoreKey() {
 
 async function uploadEbook(file) {
   const statusEl = $('book-upload-status');
-  const isPdf = /\.pdf$/i.test(file.name);
-  const isEpub = /\.epub$/i.test(file.name);
-  if (!isPdf && !isEpub) {
-    if (statusEl) statusEl.textContent = 'Only .epub and .pdf files are supported.';
-    return;
-  }
   if (file.size > DIORA_CONFIG.ebookMaxBytes) {
     if (statusEl) statusEl.textContent = `File too large (max ${DIORA_CONFIG.ebookMaxBytes / 1024 / 1024} MB).`;
-    return;
+    return false;
+  }
+  return _importEbookBuffer(await file.arrayBuffer(), file.name, statusEl);
+}
+
+// Shared tail of every import path (local file, cloud): parse metadata, encrypt
+// with the user's key and POST ciphertext. Plaintext never leaves the browser.
+async function _importEbookBuffer(buf, filename, statusEl) {
+  const isPdf = /\.pdf$/i.test(filename);
+  const isEpub = /\.epub$/i.test(filename);
+  if (!isPdf && !isEpub) {
+    if (statusEl) statusEl.textContent = 'Only .epub and .pdf files are supported.';
+    return false;
+  }
+  if (buf.byteLength > DIORA_CONFIG.ebookMaxBytes) {
+    if (statusEl) statusEl.textContent = `File too large (max ${DIORA_CONFIG.ebookMaxBytes / 1024 / 1024} MB).`;
+    return false;
   }
 
   if (statusEl) statusEl.textContent = 'Encrypting…';
 
   try {
-    const buf = await file.arrayBuffer();
-
-    let title = file.name.replace(/\.(epub|pdf)$/i, '');
+    let title = filename.replace(/\.(epub|pdf)$/i, '');
     let author = '';
     let isbn = '';
     const type = isPdf ? 'pdf' : 'epub';
@@ -3821,7 +3871,7 @@ async function uploadEbook(file) {
     }
 
     const key = await getOrCreateEncKey();
-    const metaJson = new TextEncoder().encode(JSON.stringify({title, author, filename: file.name, type, isbn, folder: '', shelfTag: ''}));
+    const metaJson = new TextEncoder().encode(JSON.stringify({title, author, filename, type, isbn, folder: '', shelfTag: ''}));
     const [metaEnc, dataEnc] = await Promise.all([
       encryptBytes(key, metaJson),
       encryptBytes(key, buf),
@@ -3843,11 +3893,165 @@ async function uploadEbook(file) {
     if (data.ok) {
       if (statusEl) statusEl.textContent = `✓ "${title}" uploaded`;
       loadBookList();
-    } else {
-      if (statusEl) statusEl.textContent = 'Error: ' + (data.error || 'upload failed');
+      return true;
     }
+    if (statusEl) statusEl.textContent = 'Error: ' + (data.error || 'upload failed');
+    return false;
   } catch (e) {
     if (statusEl) statusEl.textContent = 'Upload failed: ' + e.message;
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Cloud import — browse a user-configured WebDAV server and pull a book in.
+//
+// The download is proxied by the server because the remote host is a different
+// origin and sends no CORS headers. It still lands here as raw bytes and goes
+// through _importEbookBuffer like any local file, so what gets stored is
+// ciphertext the server cannot read.
+// ---------------------------------------------------------------------------
+
+let _cloudSources = [];
+let _cloudSourceId = null;
+let _cloudPath = '';
+
+async function toggleCloudImport() {
+  const panel = $('cloud-browser');
+  if (!panel) return;
+  if (panel.style.display !== 'none') { closeCloudImport(); return; }
+
+  try {
+    const res = await fetch('/books/cloud/sources/');
+    _cloudSources = (await res.json()).sources || [];
+  } catch (e) {
+    await customAlert('Cloud-Verbindungen konnten nicht geladen werden: ' + e.message);
+    return;
+  }
+
+  if (!_cloudSources.length) {
+    await customAlert(
+      'Noch keine Cloud-Verbindung eingerichtet. Unter Einstellungen → '
+      + '„Cloud-Verbindungen für Bücher“ kannst du eine hinzufügen.'
+    );
+    return;
+  }
+
+  const select = $('cloud-source-select');
+  if (select) {
+    select.innerHTML = '';
+    for (const source of _cloudSources) {
+      const option = document.createElement('option');
+      option.value = source.id;
+      option.textContent = source.label;
+      select.appendChild(option);
+    }
+    select.style.display = _cloudSources.length > 1 ? '' : 'none';
+  }
+
+  panel.style.display = '';
+  _cloudSourceId = _cloudSources[0].id;
+  _cloudBrowse('');
+}
+
+function closeCloudImport() {
+  const panel = $('cloud-browser');
+  if (panel) panel.style.display = 'none';
+}
+
+function _onCloudSourceChange(value) {
+  _cloudSourceId = parseInt(value, 10);
+  _cloudBrowse('');
+}
+
+function _cloudParentPath(path) {
+  const parts = path.split('/').filter(Boolean);
+  parts.pop();
+  return parts.join('/');
+}
+
+function _formatBytes(n) {
+  if (!n) return '';
+  if (n < 1024) return n + ' B';
+  if (n < 1024 * 1024) return Math.round(n / 1024) + ' KB';
+  return (n / 1024 / 1024).toFixed(1) + ' MB';
+}
+
+function _cloudEntryRow(label, onClick, sizeText) {
+  const li = document.createElement('li');
+  li.className = 'cloud-entry';
+
+  const button = document.createElement('button');
+  button.type = 'button';
+  button.className = 'cloud-entry-name';
+  button.textContent = label;
+  button.addEventListener('click', onClick);
+  li.appendChild(button);
+
+  if (sizeText) {
+    const size = document.createElement('span');
+    size.className = 'cloud-entry-size';
+    size.textContent = sizeText;
+    li.appendChild(size);
+  }
+  return li;
+}
+
+async function _cloudBrowse(path) {
+  const listEl = $('cloud-entries');
+  const pathEl = $('cloud-path');
+  const statusEl = $('cloud-status');
+  if (!listEl) return;
+
+  if (statusEl) statusEl.textContent = 'Lade…';
+  listEl.innerHTML = '';
+
+  let data;
+  try {
+    const res = await fetch(`/books/cloud/${_cloudSourceId}/browse/?path=${encodeURIComponent(path)}`);
+    data = await res.json();
+    if (!res.ok) throw new Error(data.error || `HTTP ${res.status}`);
+  } catch (e) {
+    if (statusEl) statusEl.textContent = 'Fehler: ' + e.message;
+    return;
+  }
+
+  _cloudPath = data.path || '';
+  if (pathEl) pathEl.textContent = '/' + _cloudPath;
+  if (statusEl) statusEl.textContent = '';
+
+  if (_cloudPath) {
+    listEl.appendChild(_cloudEntryRow('⬑ ..', () => _cloudBrowse(_cloudParentPath(_cloudPath))));
+  }
+
+  const entries = (data.entries || []).filter(e => e.is_dir || e.is_book);
+  if (!entries.length && statusEl) {
+    statusEl.textContent = 'Keine Bücher oder Ordner in diesem Verzeichnis.';
+  }
+
+  for (const entry of entries) {
+    listEl.appendChild(entry.is_dir
+      ? _cloudEntryRow('📁 ' + entry.name, () => _cloudBrowse(entry.path))
+      : _cloudEntryRow('📖 ' + entry.name, () => _cloudImport(entry), _formatBytes(entry.size)));
+  }
+}
+
+async function _cloudImport(entry) {
+  const statusEl = $('cloud-status');
+  if (statusEl) statusEl.textContent = `Lade „${entry.name}“…`;
+
+  try {
+    const res = await fetch(`/books/cloud/${_cloudSourceId}/fetch/?path=${encodeURIComponent(entry.path)}`);
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new Error(err.error || `HTTP ${res.status}`);
+    }
+    const buf = await res.arrayBuffer();
+    if (await _importEbookBuffer(buf, entry.name, statusEl) && statusEl) {
+      statusEl.textContent = `✓ „${entry.name}“ importiert`;
+    }
+  } catch (e) {
+    if (statusEl) statusEl.textContent = 'Import fehlgeschlagen: ' + e.message;
   }
 }
 
@@ -3974,6 +4178,239 @@ async function renderPdf(arrayBuffer, contentEl, scaleOverride, pivotPage) {
   return {title: pdfTitle, author: pdfAuthor, toc, numPages: pdf.numPages};
 }
 
+// ---------------------------------------------------------------------------
+// Read-aloud (TTS) — server-side Piper synthesis, one sentence per request.
+// EPUB only (no block model for PDFs). Highlights the sentence currently
+// playing and scrolls it into view; playback advances sentence-by-sentence,
+// then block-by-block, until stopped or the book ends.
+// ---------------------------------------------------------------------------
+const TTS_MAX_CHARS = 480; // stay under the server's 500-char cap with margin
+
+let ttsActive = false;
+let ttsPaused = false;
+let ttsRunToken = 0;
+let ttsAudio = null;
+let ttsCurrentMark = null;
+let ttsBarEl = null;
+let ttsLang = localStorage.getItem('diora_tts_lang') || 'de';
+
+function setTtsLang(lang) {
+  ttsLang = lang;
+  localStorage.setItem('diora_tts_lang', lang);
+}
+
+function _ttsSplitSentences(text) {
+  const raw = text.split(/(?<=[.!?])\s+/).map(s => s.trim()).filter(Boolean);
+  const pieces = raw.length ? raw : [text];
+  const out = [];
+  for (const piece of pieces) {
+    let rest = piece;
+    while (rest.length > TTS_MAX_CHARS) {
+      let cut = rest.lastIndexOf(' ', TTS_MAX_CHARS);
+      if (cut <= 0) cut = TTS_MAX_CHARS;
+      out.push(rest.slice(0, cut).trim());
+      rest = rest.slice(cut).trim();
+    }
+    if (rest) out.push(rest);
+  }
+  return out;
+}
+
+async function _ttsFetchAudio(sentence) {
+  const resp = await fetch('/tts/synthesize/', {
+    method: 'POST',
+    headers: {'Content-Type': 'application/json'},
+    body: JSON.stringify({text: sentence, lang: ttsLang}),
+  });
+  if (!resp.ok) throw new Error('tts request failed');
+  return await resp.blob();
+}
+
+function _ttsClearHighlight() {
+  if (ttsCurrentMark && ttsCurrentMark.parentNode) {
+    const parent = ttsCurrentMark.parentNode;
+    while (ttsCurrentMark.firstChild) parent.insertBefore(ttsCurrentMark.firstChild, ttsCurrentMark);
+    parent.removeChild(ttsCurrentMark);
+    parent.normalize();
+  }
+  ttsCurrentMark = null;
+}
+
+// Finds `sentence` as a substring of block.textContent starting at fromOffset
+// (so repeated sentence text earlier in the block isn't matched again), turns
+// it into a DOM Range via the same char-offset addressing highlights use, and
+// wraps it in a <mark>. Returns the offset to resume searching from.
+function _ttsHighlightSentence(block, sentence, fromOffset) {
+  _ttsClearHighlight();
+  const full = block.textContent;
+  const idx = full.indexOf(sentence, fromOffset);
+  if (idx === -1) return fromOffset;
+  const start = _nodeAtCharOffset(block, idx);
+  const end = _nodeAtCharOffset(block, idx + sentence.length);
+  if (!start || !end) return idx + sentence.length;
+  try {
+    const range = document.createRange();
+    range.setStart(start.node, start.offset);
+    range.setEnd(end.node, end.offset);
+    const mark = document.createElement('mark');
+    mark.className = 'tts-current';
+    range.surroundContents(mark);
+    ttsCurrentMark = mark;
+    _ttsScrollIntoView(mark);
+  } catch (e) {}
+  return idx + sentence.length;
+}
+
+function _ttsScrollIntoView(el) {
+  const contentEl = $('reader-content');
+  if (!contentEl) return;
+  const top = el.getBoundingClientRect().top - contentEl.getBoundingClientRect().top;
+  if (top < 40 || top > contentEl.clientHeight - 80) {
+    _suppressScrollJumpDetect();
+    contentEl.scrollBy({top: top - contentEl.clientHeight * 0.3, behavior: 'smooth'});
+  }
+}
+
+function _ttsPlayBlob(blob) {
+  return new Promise((resolve) => {
+    const url = URL.createObjectURL(blob);
+    const audio = new Audio(url);
+    ttsAudio = audio;
+    const done = () => { URL.revokeObjectURL(url); resolve(); };
+    audio.addEventListener('ended', done);
+    audio.addEventListener('error', done);
+    if (!ttsPaused) audio.play().catch(done);
+  });
+}
+
+// Walks blocks/sentences from startBlockIndex onward, fetching one sentence
+// ahead while the current one plays so there's no gap between them.
+async function _ttsPlayLoop(blocks, startBlockIndex, runToken) {
+  function* sentenceStream() {
+    for (let bi = startBlockIndex; bi < blocks.length; bi++) {
+      const block = blocks[bi];
+      const text = (block.textContent || '').trim();
+      if (!text) continue;
+      for (const sentence of _ttsSplitSentences(text)) yield {block, sentence};
+    }
+  }
+
+  const iter = sentenceStream();
+  let cur = iter.next();
+  if (cur.done) { stopReadAloud(); return; }
+  let curFetch = _ttsFetchAudio(cur.value.sentence);
+  let lastBlock = null;
+  let blockSearchOffset = 0;
+
+  while (!cur.done) {
+    if (runToken !== ttsRunToken) return;
+    const {block, sentence} = cur.value;
+    const next = iter.next();
+    const nextFetch = next.done ? null : _ttsFetchAudio(next.value.sentence).catch(() => null);
+
+    let audioBlob;
+    try {
+      audioBlob = await curFetch;
+    } catch (e) {
+      stopReadAloud();
+      return;
+    }
+    if (runToken !== ttsRunToken) return;
+
+    if (block !== lastBlock) { lastBlock = block; blockSearchOffset = 0; }
+    blockSearchOffset = _ttsHighlightSentence(block, sentence, blockSearchOffset);
+
+    await _ttsPlayBlob(audioBlob);
+    if (runToken !== ttsRunToken) return;
+
+    cur = next;
+    curFetch = nextFetch;
+  }
+  if (runToken === ttsRunToken) stopReadAloud();
+}
+
+function _ttsTogglePause() {
+  ttsPaused = !ttsPaused;
+  if (ttsAudio) {
+    if (ttsPaused) ttsAudio.pause();
+    else ttsAudio.play().catch(() => {});
+  }
+  _ttsUpdateBar();
+}
+
+function _ttsUpdateBar() {
+  if (!ttsBarEl) return;
+  const btn = ttsBarEl.querySelector('.tts-pause-btn');
+  if (btn) btn.textContent = ttsPaused ? '▶' : '⏸';
+}
+
+function _ttsShowBar() {
+  _ttsRemoveBar();
+  const bar = document.createElement('div');
+  bar.className = 'tts-bar';
+  bar.innerHTML = `
+    <button type="button" class="tts-pause-btn" title="Pause/Weiter">⏸</button>
+    <button type="button" class="tts-stop-btn" title="Vorlesen beenden">■</button>
+  `;
+  document.body.appendChild(bar);
+  ttsBarEl = bar;
+  bar.querySelector('.tts-pause-btn').addEventListener('click', _ttsTogglePause);
+  bar.querySelector('.tts-stop-btn').addEventListener('click', stopReadAloud);
+}
+
+function _ttsRemoveBar() {
+  if (ttsBarEl) { ttsBarEl.remove(); ttsBarEl = null; }
+}
+
+function toggleReadAloud() {
+  if (ttsActive) stopReadAloud();
+  else startReadAloud();
+}
+
+function startReadAloud() {
+  if (ttsActive) return;
+  if (currentPdfDoc) {
+    const toast = document.createElement('div');
+    toast.className = 'reader-toast';
+    toast.textContent = 'Vorlesen ist aktuell nur für EPUB-Bücher verfügbar.';
+    document.body.appendChild(toast);
+    setTimeout(() => toast.remove(), 2200);
+    return;
+  }
+  const contentEl = $('reader-content');
+  if (!contentEl) return;
+  const blocks = Array.from(contentEl.querySelectorAll(EPUB_BLOCK_SELECTOR));
+  if (!blocks.length) return;
+
+  const [anchorBlock] = _anchorParts(getPositionAnchor(contentEl));
+  const startIndex = (anchorBlock >= 0 && anchorBlock < blocks.length) ? anchorBlock : 0;
+
+  ttsActive = true;
+  ttsPaused = false;
+  ttsRunToken++;
+  const runToken = ttsRunToken;
+
+  const btn = $('reader-tts-btn');
+  if (btn) { btn.classList.add('active'); btn.title = 'Vorlesen beenden'; }
+  _ttsShowBar();
+
+  _ttsPlayLoop(blocks, startIndex, runToken);
+}
+
+function stopReadAloud() {
+  ttsRunToken++;
+  ttsActive = false;
+  ttsPaused = false;
+  if (ttsAudio) {
+    try { ttsAudio.pause(); ttsAudio.src = ''; } catch (e) {}
+    ttsAudio = null;
+  }
+  _ttsClearHighlight();
+  _ttsRemoveBar();
+  const btn = $('reader-tts-btn');
+  if (btn) { btn.classList.remove('active'); btn.title = 'Vorlesen'; }
+}
+
 // ---------------------------------------------------------------------------
 // Immersive reader mode — tap centre of screen to toggle bars
 // ---------------------------------------------------------------------------
@@ -3981,7 +4418,7 @@ let _immBarsVisible = true;
 
 function _immHandleTap(e) {
   // Ignore taps on interactive elements (buttons, links, inputs, settings panel, footnote popover)
-  if (e.target.closest('button, a, input, select, label, #reader-settings-panel, .reader-header, .footnote-popover, #reader-margin, #highlight-popover, .note-bottom-sheet')) return;
+  if (e.target.closest('button, a, input, select, label, #reader-settings-panel, .reader-header, .footnote-popover, #reader-margin, #highlight-popover, .note-bottom-sheet, .tts-bar')) return;
   // In marker mode, taps have a dedicated meaning (highlight/create a note) —
   // don't also toggle the immersive bars underneath.
   if (markerModeActive) return;
@@ -4380,6 +4817,7 @@ async function saveReaderProgress(force = false) {
 
 function closeReader() {
   exitReaderImmersiveMode();
+  stopReadAloud();
   // Save progress BEFORE hiding — scrollHeight/clientHeight return 0 once display:none
   saveReaderProgress();
   if (bookmarksDirty) saveBookmarks();
@@ -6379,6 +6817,10 @@ function openRadioSidebar() {
     setVolume(vol);
   }
 
+  // Restore persisted read-aloud language
+  const ttsLangSelect = $('reader-tts-lang');
+  if (ttsLangSelect) ttsLangSelect.value = ttsLang;
+
   // Load recommendations on page load
   loadRecommendations();
 

static/js/sw.js

@@ -2,7 +2,7 @@
  * diora service worker — caches the app shell for offline use.
  */
 
-const CACHE = 'diora-v40';
+const CACHE = 'diora-v43';
 const PODCAST_CACHE = 'diora-podcast-v1';
 const SHELL = [
   '/static/css/app.css',
@@ -53,6 +53,7 @@ self.addEventListener('fetch', function (event) {
   if (url.pathname.startsWith('/radio/sse/') ||
       url.pathname.startsWith('/radio/record/') ||
       url.pathname.startsWith('/radio/affiliate/') ||
+      url.pathname.startsWith('/tts/') ||
       url.pathname.startsWith('/admin/') ||
       url.pathname.startsWith('/podcasts/progress/') ||
       url.pathname.startsWith('/podcasts/queue/') ||

templates/accounts/settings.html

@@ -125,6 +125,75 @@
       </form>
     {% endif %}
   </section>
+
+  <!-- Cloud connections (WebDAV / Nextcloud) for the ebook import -->
+  <section class="settings-section">
+    <h2>Cloud-Verbindungen für Bücher</h2>
+    <p class="lastfm-description">
+      Verbinde einen WebDAV-Server — Nextcloud, ownCloud, Synology oder was auch immer WebDAV
+      spricht — und importiere <code>.epub</code>- und <code>.pdf</code>-Dateien direkt daraus in
+      deine Bibliothek. Die Datei läuft dabei nur durch den Server hindurch; verschlüsselt wird sie
+      wie immer erst in deinem Browser, gespeichert wird ausschließlich der Geheimtext.
+    </p>
+    <p class="lastfm-description">
+      Lege dafür bitte ein <strong>App-Passwort</strong> an (bei Nextcloud unter
+      Einstellungen → Sicherheit) statt dein Konto-Passwort einzutragen — es wird serverseitig
+      gespeichert und lässt sich jederzeit einzeln widerrufen.
+    </p>
+
+    {% if webdav_sources %}
+      <ul class="webdav-list">
+        {% for source in webdav_sources %}
+          <li class="webdav-item">
+            <div class="webdav-item-info">
+              <strong>{{ source.label }}</strong>
+              <span class="muted">{{ source.base_url }}{% if source.root_path %} · /{{ source.root_path }}{% endif %}</span>
+            </div>
+            <div class="webdav-item-actions">
+              <form method="post" action="{% url 'webdav_test' source.pk %}" class="inline-form">
+                {% csrf_token %}
+                <button type="submit" class="btn">Testen</button>
+              </form>
+              <form method="post" action="{% url 'webdav_delete' source.pk %}" class="inline-form"
+                    onsubmit="return confirm('Verbindung „{{ source.label|escapejs }}“ entfernen?');">
+                {% csrf_token %}
+                <button type="submit" class="btn btn-danger">Entfernen</button>
+              </form>
+            </div>
+          </li>
+        {% endfor %}
+      </ul>
+    {% endif %}
+
+    <form method="post" action="{% url 'webdav_add' %}" class="webdav-form">
+      {% csrf_token %}
+      <label class="webdav-field">
+        <span>Name</span>
+        <input type="text" name="label" required placeholder="Meine Nextcloud">
+      </label>
+      <label class="webdav-field">
+        <span>Server-URL</span>
+        <input type="url" name="base_url" required placeholder="https://cloud.example.com">
+      </label>
+      <label class="webdav-field">
+        <span>Benutzername</span>
+        <input type="text" name="username" autocomplete="off" placeholder="dein-login">
+      </label>
+      <label class="webdav-field">
+        <span>App-Passwort</span>
+        <input type="password" name="password" autocomplete="new-password">
+      </label>
+      <label class="webdav-field">
+        <span>Unterordner <span class="muted">(optional)</span></span>
+        <input type="text" name="root_path" placeholder="Buecher">
+      </label>
+      <p class="lastfm-description" style="margin:0;">
+        Bei Nextcloud/ownCloud genügt die Server-Adresse — der WebDAV-Pfad wird aus dem
+        Benutzernamen ergänzt. Andere Server brauchen die vollständige WebDAV-URL.
+      </p>
+      <button type="submit" class="btn">Verbindung hinzufügen</button>
+    </form>
+  </section>
 </div>
 {% endblock %}
 

templates/radio/player.html

@@ -13,10 +13,12 @@
     <button class="btn btn-play" id="play-stop-btn" onclick="togglePlayStop()" style="display:none;">&#9654; Play</button>
     <label class="volume-label">
       <span>vol</span>
-      <input type="range" id="volume" min="0" max="255" value="204" class="volume-slider">
-      <input type="number" id="volume-num" min="0" max="255" value="204" class="volume-num">
+      <input type="range" id="volume" min="0" max="255" value="102" class="volume-slider">
+      <input type="number" id="volume-num" min="0" max="255" value="102" class="volume-num">
     </label>
     <button class="btn btn-save" id="save-station-btn" style="display:none;" onclick="saveCurrentStation()">&#9733; Save</button>
+    <button class="btn-icon" id="creamfresh-vote-up-btn" style="display:none;" onclick="creamfreshVote('up')" title="Gefällt mir">&#128077;</button>
+    <button class="btn-icon" id="creamfresh-vote-down-btn" style="display:none;" onclick="creamfreshVote('down')" title="Gefällt mir nicht">&#128078;</button>
     <button class="btn-icon" id="dnd-btn" onclick="toggleDND()" title="Focus mode (hides UI, press Esc to exit)">⊙</button>
     <button class="btn-icon" id="focus-station-btn" onclick="openRadioSidebar()" title="Radio">◉</button>
   </div>
@@ -319,6 +321,16 @@
       <input type="file" id="book-file-input" accept=".epub,.pdf" style="display:none;" onchange="bookFileSelected(this)">
       <span id="book-upload-status" class="muted"></span>
     </div>
+    <button type="button" class="btn" style="margin:0.5rem 0;" onclick="toggleCloudImport()">☁ Aus Cloud importieren</button>
+    <div id="cloud-browser" class="cloud-browser" style="display:none;">
+      <div class="cloud-browser-head">
+        <select id="cloud-source-select" onchange="_onCloudSourceChange(this.value)"></select>
+        <button type="button" class="btn" onclick="closeCloudImport()">Schließen</button>
+      </div>
+      <div id="cloud-path" class="cloud-path"></div>
+      <ul id="cloud-entries" class="cloud-entries"></ul>
+      <span id="cloud-status" class="muted"></span>
+    </div>
   </div>
   <label class="book-list-filter">
     <input type="checkbox" id="book-show-read-toggle" onchange="_onBookShowReadToggle(this.checked)">
@@ -344,6 +356,11 @@
       </span>
       <button class="btn-icon" id="reader-search-btn"   onclick="toggleReaderSearch()"        title="Search">⌕</button>
       <button class="btn-icon" id="reader-settings-btn" onclick="toggleSettingsPanel()"        title="Font &amp; layout">⚙</button>
+      <select id="reader-tts-lang" class="tts-lang-select" title="Vorlese-Sprache" onchange="setTtsLang(this.value)">
+        <option value="de">DE</option>
+        <option value="en">EN</option>
+      </select>
+      <button class="btn-icon" id="reader-tts-btn"      onclick="toggleReadAloud()"           title="Vorlesen">▶</button>
       <button class="btn-icon" id="reader-bookmark-btn" onclick="addBookmark()"               title="Bookmark">★</button>
       <button class="btn-icon" id="reader-bm-list-btn"  onclick="openBookmarksSidebar()"      title="Bookmarks">▤</button>
       <button class="btn-icon" id="reader-toc-btn"      onclick="openTocSidebar()"            title="Table of contents">≡</button>

tts/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class TtsConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'tts'

tts/piper_engine.py

@@ -0,0 +1,41 @@
+import io
+import threading
+import wave
+
+from django.conf import settings
+
+DEFAULT_LANGUAGE = 'de'
+SUPPORTED_LANGUAGES = tuple(settings.TTS_VOICES.keys())
+
+# Lazy per-process singletons, one per language: each gunicorn worker loads a
+# voice only once it's actually requested, rather than all workers loading
+# every model at startup (the host runs several other containers with limited
+# spare RAM). One lock guards both the lazy-load and the inference call below
+# — a single self-hosted user never needs concurrent synthesis across
+# languages, so there's no reason for a lock per voice.
+_voices = {}
+_lock = threading.Lock()
+
+
+def _get_voice(lang):
+    if lang not in _voices:
+        with _lock:
+            if lang not in _voices:
+                from piper import PiperVoice
+                _voices[lang] = PiperVoice.load(str(settings.TTS_VOICES[lang]))
+    return _voices[lang]
+
+
+def synthesize_wav(text, lang=DEFAULT_LANGUAGE):
+    """Synthesize `text` (in `lang`) to WAV bytes.
+
+    Never persists or logs `text` — callers must not log it either. The lock
+    also serializes inference, since one onnxruntime session isn't meant to
+    run concurrent calls within a process.
+    """
+    voice = _get_voice(lang)
+    buf = io.BytesIO()
+    with _lock:
+        with wave.open(buf, 'wb') as wav_file:
+            voice.synthesize_wav(text, wav_file)
+    return buf.getvalue()

tts/tests.py

@@ -0,0 +1,55 @@
+from unittest.mock import patch
+
+from django.contrib.auth.models import User
+from django.test import TestCase
+
+from . import piper_engine
+
+
+class TtsSynthesizeTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username='alice', password='pw12345678')
+
+    def test_requires_auth(self):
+        resp = self.client.post('/tts/synthesize/', {'text': 'Hallo'}, content_type='application/json')
+        self.assertEqual(resp.status_code, 401)
+
+    def test_rejects_empty_text(self):
+        self.client.force_login(self.user)
+        resp = self.client.post('/tts/synthesize/', {'text': '  '}, content_type='application/json')
+        self.assertEqual(resp.status_code, 400)
+
+    def test_rejects_text_over_limit(self):
+        self.client.force_login(self.user)
+        resp = self.client.post(
+            '/tts/synthesize/', {'text': 'a' * 501}, content_type='application/json')
+        self.assertEqual(resp.status_code, 400)
+
+    def test_rejects_invalid_json(self):
+        self.client.force_login(self.user)
+        resp = self.client.post('/tts/synthesize/', 'not json', content_type='application/json')
+        self.assertEqual(resp.status_code, 400)
+
+    @patch.object(piper_engine, 'synthesize_wav', return_value=b'RIFF....WAVEfmt fake')
+    def test_synthesizes_audio_default_lang(self, mock_synth):
+        self.client.force_login(self.user)
+        resp = self.client.post(
+            '/tts/synthesize/', {'text': 'Hallo Welt.'}, content_type='application/json')
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp['Content-Type'], 'audio/wav')
+        self.assertEqual(b''.join(resp.streaming_content), b'RIFF....WAVEfmt fake')
+        mock_synth.assert_called_once_with('Hallo Welt.', 'de')
+
+    @patch.object(piper_engine, 'synthesize_wav', return_value=b'RIFF....WAVEfmt fake')
+    def test_synthesizes_audio_explicit_lang(self, mock_synth):
+        self.client.force_login(self.user)
+        resp = self.client.post(
+            '/tts/synthesize/', {'text': 'Hello world.', 'lang': 'en'}, content_type='application/json')
+        self.assertEqual(resp.status_code, 200)
+        mock_synth.assert_called_once_with('Hello world.', 'en')
+
+    def test_rejects_unsupported_lang(self):
+        self.client.force_login(self.user)
+        resp = self.client.post(
+            '/tts/synthesize/', {'text': 'Hallo', 'lang': 'fr'}, content_type='application/json')
+        self.assertEqual(resp.status_code, 400)

tts/urls.py

@@ -0,0 +1,7 @@
+from django.urls import path
+
+from . import views
+
+urlpatterns = [
+    path('synthesize/', views.synthesize, name='tts_synthesize'),
+]

tts/views.py

@@ -0,0 +1,57 @@
+import json
+
+from django.http import JsonResponse, StreamingHttpResponse
+from django.views.decorators.csrf import csrf_exempt
+from django.views.decorators.http import require_http_methods
+from gevent.threadpool import ThreadPool
+
+from . import piper_engine
+
+# One sentence per request, hard-capped — this is the load-bearing part of the
+# "server never holds more than a small, transient snippet of book text"
+# agreement (see CLAUDE.md), not just a client-side convention.
+MAX_TEXT_LENGTH = 500
+
+# Offloads the CPU-bound Piper inference off the gevent hub's event loop, so a
+# synthesis call doesn't stall other concurrent greenlets (radio SSE, other
+# requests) in the same worker the way a plain in-greenlet call would.
+_synth_pool = ThreadPool(1)
+
+
+def _require_auth(request):
+    if not request.user.is_authenticated:
+        return JsonResponse({'error': 'authentication required'}, status=401)
+    return None
+
+
+@csrf_exempt
+@require_http_methods(['POST'])
+def synthesize(request):
+    err = _require_auth(request)
+    if err:
+        return err
+
+    try:
+        body = json.loads(request.body)
+    except (json.JSONDecodeError, ValueError):
+        return JsonResponse({'error': 'invalid JSON'}, status=400)
+
+    text = body.get('text', '')
+    if not isinstance(text, str) or not text.strip():
+        return JsonResponse({'error': 'text required'}, status=400)
+    if len(text) > MAX_TEXT_LENGTH:
+        return JsonResponse({'error': f'text exceeds {MAX_TEXT_LENGTH} characters'}, status=400)
+
+    lang = body.get('lang', piper_engine.DEFAULT_LANGUAGE)
+    if lang not in piper_engine.SUPPORTED_LANGUAGES:
+        return JsonResponse({'error': 'unsupported lang'}, status=400)
+
+    try:
+        audio = _synth_pool.apply(piper_engine.synthesize_wav, (text, lang))
+    except Exception:
+        return JsonResponse({'error': 'synthesis failed'}, status=500)
+
+    response = StreamingHttpResponse(iter([audio]), content_type='audio/wav')
+    response['Cache-Control'] = 'no-store'
+    response['X-Accel-Buffering'] = 'no'
+    return response