Navidrome

A self-hosted music streaming server compatible with the Subsonic API.

Navidrome is a lightweight, high-performance music server that scans your audio library and streams it through a web UI or any Subsonic-compatible client. It supports transcoding, scrobbling to Last.fm/ListenBrainz, and multi-user libraries. Self-hosting means streaming your own music collection without monthly subscription fees.

Alternatives considered

Cloud Hosted

Tool	Open Source	Free Tier	Monthly Cost
Spotify	No	Limited	$12.99/mo
Plex	No	Limited	From $4.99/mo

Self Hosted

Tool	Open Source	Full Features	Notes
Subsonic	No	Limited	Original Subsonic API server; less maintained
Airsonic-Advanced	Yes	Yes	Navidrome predecessor; heavier

Installation

Architecture

• Deployment: Single navidrome deployment in the navidrome namespace
• Image: deluan/navidrome, digest-pinned via Renovate
• Storage: Longhorn PVC (navidrome-data, annotated k8up.io/backup: "true") for database; NFS PV from TrueNAS for the music library
• Networking: HTTPRoute via internal gateway

Security

• Runs as runAsUser: 1000, runAsNonRoot: true, allowPrivilegeEscalation: false, capabilities dropped
• Longhorn PVC encrypted at rest via SOPS-managed keys

Updates

Managed by Renovate. Image is digest-pinned.

Data Management

• Database: SQLite on navidrome-data Longhorn PVC (annotated k8up.io/backup: "true")
• NFS: TrueNAS NFS PV for music library (read-only)
• Backups: k8up Schedules to Hetzner and Backblaze via restic, covering the Longhorn PVC.

User Management

No OIDC configured. User accounts managed through the Navidrome admin UI. Supports multi-user libraries.

Configuration Management

• Spotify API credentials (ND_SPOTIFY_ID, ND_SPOTIFY_SECRET) from SOPS-encrypted secret
• Scanner schedule and other settings configured via env vars in the Deployment
• Longhorn encryption key from SOPS-encrypted secret

Usage

Browse and stream your music library via the web UI Connect mobile apps (DSub, Symfonium, Ultrasonic) using the Subsonic API endpoint. Navidrome automatically scans the NFS audio share for new files on the configured schedule.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/apps/navidrome/talos/README.md.

Cluster Deployment

App URLs

• navidrome.web.kueber.eu

Depends on

• Envoy Gateway
• k8up backups
• Longhorn

Navidrome — Talos cluster

Kubernetes Metadata

• Image: deluan/navidrome:0.64.2@sha256:38dc2727bfcfd5ede290f8ada114fc90368146f265ae4701ddddbcbe2a44ee52

Rendered manifests (kustomize build)

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kustomize.toolkit.fluxcd.io/force: enabled
  labels:
    app.kubernetes.io/name: navidrome
  name: navidrome
  namespace: navidrome
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: navidrome
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: navidrome
    spec:
      automountServiceAccountToken: false
      containers:
        - env:
            - name: ND_SPOTIFY_ID
              valueFrom:
                secretKeyRef:
                  key: spotifyId
                  name: navidrome
            - name: ND_SPOTIFY_SECRET
              valueFrom:
                secretKeyRef:
                  key: spotifySecret
                  name: navidrome
            - name: ND_SCANNER_ENABLED
              value: 'true'
            - name: ND_SCANNER_SCHEDULE
              value: 00 01,13 * * *
            - name: ND_SCANINTERVAL
              value: 12h
          image: deluan/navidrome:0.64.2@sha256:38dc2727bfcfd5ede290f8ada114fc90368146f265ae4701ddddbcbe2a44ee52
          name: navidrome
          ports:
            - containerPort: 4533
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 1
            httpGet:
              path: /
              port: 4533
            initialDelaySeconds: 2
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            limits:
              memory: 1500Mi
            requests:
              cpu: 10m
              memory: 100Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            privileged: false
          volumeMounts:
            - mountPath: /data/
              name: navidrome-data
            - mountPath: /music
              name: navidrome-music
              subPath: music
      priorityClassName: tier-2
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      volumes:
        - name: navidrome-data
          persistentVolumeClaim:
            claimName: navidrome-data
        - name: navidrome-music
          persistentVolumeClaim:
            claimName: navidrome-truenas-nfs-audio