I wanted to listen to my music collection from everywhere, so I've been setting up Navidrome behind my FreedomBox using Podman quadlets for systemd integration (all based on Debian Trixie). Here's how:
First I've installed Navidrome as Podman quadlet, based on the official docker compose installation manual:
Docs: https://www.navidrome.org/docs/installation/docker/
This is what my /etc/containers/systemd/navidrome.container looks like:
[Unit]
Description=Navidrome
Wants=network-online.target
After=network-online.target
[Container]
Image=docker.io/deluan/navidrome:0.60.0
User=1001:119
UserNS=keep-id
Environment=ND_ENABLEINSIGHTSCOLLECTOR=false
Environment=ND_BASEURL=https://www.example.org/music/
Environment=ND_LASTFM_ENABLED=false
Environment=ND_LISTENBRAINZ_ENABLED=false
Environment=ND_ENABLECOVERANIMATION=false
Volume=/home/navidrome/data:/data:rw,U,z
Volume=/media/data/my-mp3-collection/:/music:ro,U,z
PublishPort=127.0.0.1:4533:4533
[Service]
TimeoutStartSec=900
Restart=always
[Install]
WantedBy=multi-user.target
Things to note:
- I've pinned the version to not automatically pull
latestbut have control over upgrades. User 1001:119refers to a dedicated non-system user I've created withadduser navidrome --disabled-loginwhich has a home directory to hold the data dir. 119 is the group my music collection folder belongs to. I'm automatically synchronizing it using syncthing, hence the differing GID.
After setting up this quadlet, I reloaded systemd config, started the container and checked the logs. It came up fine, scanning my library on first start:
sudo systemctl daemon-reload
sudo systemctl start navidrome
sudo journalctl -u navidrome -f
Afterwards I set up FreedomBox integration, so I can potentially re-use SSO and have Navidrome run on a URL path on the same domain. In order to do that I created a new Apache2 config /etc/apache2/conf-available/navidrome.conf:
<Location /music/>
Include includes/freedombox-single-sign-on.conf
<IfModule mod_auth_pubtkt.c>
TKTAuthToken "admin"
</IfModule>
# allow websockets
RewriteEngine On
RewriteCond %{HTTP:Connection} Upgrade [NC]
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /(.*) wss://127.0.0.1:4533/$1 [P,L]
ProxyPass http://127.0.0.1:4533/music/ retry=1
ProxyPassReverse http://127.0.0.1:4533/music/
ProxyPreserveHost On
</Location>
This config uses FreedomBox's SSO and enforces a user account with "admin" role. In addition, it enables WebSockets and proxies through to the Navidrome container on port 4533.
I enabled it and reloaded Apache:
sudo a2enconf navidrome
sudo systemctl reload apache2
All of this done, I was able to open the Navidrome web UI on the configured path /music of my FreedomBox and set up a first admin account. Hooray!
Next up: Figure out how to enable Navidrome to use FreedomBox's SSO. The docs are straight-forward:
https://www.navidrome.org/docs/getting-started/extauth-quickstart/
And FreedomBoxs already sets a REMOTE_USER header. But I've not been able to make this work, yet. Inside the podman container, the proxy IP is reported as 10.88.0.1, but setting this and the header in my config did not work. I'll figure it out eventually and post an update. Happy selfhosting!
