OPDS is on different URL /calibre/opds. This requires basic authentication and not FreedomBox single sign-on. I was able to create separate Apache configuration (like we did for tt-rss).
OPDS URLs spewed out by calibre contain calibre’s local hostname and running port. This can possibly be fixed with Apache ProxyPassReverse directive which rewrites URLs inside documents. I have not tried it.
Automatic server discovery feature using local LAN broadcasting has not been tested.
The final book download URLs used by the OPDS feeds contain links to regular book URLs under /calibre. If it is protected by single sign-on, then basic authentication won’t work. I believe it might be possible to setup both kinds of authentication on single URL in Apache configuration. That is, if basic auth header is provided, use it. Otherwise use single sign-on authentication.
Someone with some Apache/sysadmin skills should able to deal with above. I just didn’t spend enough time.