Mopidy

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Scale up for very large libraries or many concurrent listeners, and attach a data disk or use a generous OS disk for your music collection.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from the networks that your listeners use to reach Mopidy. Also allow 443/tcp once you put your own TLS in front. If you connect an MPD client from another machine, use an SSH tunnel instead of exposing port 6600.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Mopidy by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create. First-boot initialisation takes a few seconds after the VM starts.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mopidy-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name mopidy \
  --image sac1647283583153:mopidy-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name mopidy --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Verify the Mopidy stack

Confirm that the services are active, that Mopidy's HTTP and MPD frontends are bound to loopback, and that nginx is the only public listener:

systemctl is-active mopidy nginx
sudo ss -tlnp | grep -E ':80 |:6680 |:6600 '

Both service lines read active. Port 80 (nginx) listens on all interfaces. The Mopidy HTTP frontend on 6680 and the MPD frontend on 6600 are bound to loopback (127.0.0.1) only.

Step 5 - Retrieve your per-VM passwords

The credentials generated on the first boot of your VM are stored in a root-only file. The file lists the Mopidy URL, the web player username (admin) and password, and the MPD host, port and password:

sudo cat /root/mopidy-credentials.txt

Store the passwords in your password manager, and treat the file as sensitive.

Step 6 - Verify authentication

nginx rejects an unauthenticated request with 401. With the per-VM web password, the Iris player loads and the JSON-RPC API answers. The MPD frontend on loopback also requires the per-VM MPD password:

WPASS=$(sudo grep '^mopidy.web.pass=' /root/mopidy-credentials.txt | cut -d= -f2-)
MPASS=$(sudo grep '^mopidy.mpd.pass=' /root/mopidy-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'no credentials: HTTP %{http_code}\n' http://127.0.0.1/iris/
curl -s -o /dev/null -w 'admin:<per-VM>: HTTP %{http_code}\n' -u "admin:$WPASS" http://127.0.0.1/iris/
curl -s -u "admin:$WPASS" -X POST http://127.0.0.1/mopidy/rpc -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"core.get_version"}' | jq -r '"core.get_version: " + .result' MPD_HOST="$MPASS@127.0.0.1" mpc -p 6600 status | head -1

The unauthenticated request returns 401 and the authenticated request returns 200. JSON-RPC reports the Mopidy version, and the MPD client connects only with the per-VM password.

Step 7 - Sign in to the Iris web player

Open a web browser and go to http://<vm-public-ip>/. When the browser prompts for a username and password, enter admin and the web password from /root/mopidy-credentials.txt.

Mopidy redirects you to the Iris web player, which opens on the Now playing view. From the sidebar you can reach Search, Playlists, Artists, Albums, Tracks, Browse and Settings. The sample album that ships with the image is already in your library, so the player has content to show immediately.

Step 8 - Add and scan your music library

Mopidy plays music that you already own. Copy your audio files to /var/lib/mopidy/media on the VM (the local library folder) and make sure that the mopidy service user can read them. Then run a scan so that Mopidy indexes the new tracks. The scan reads tags and cover art and groups the tracks into albums and artists:

sudo mopidyctl local scan

The scan reports how many files it found and indexed. Refresh the Albums or Tracks view in Iris, and your library appears. You can also confirm the library over the JSON-RPC API:

WPASS=$(sudo grep '^mopidy.web.pass=' /root/mopidy-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$WPASS" -X POST http://127.0.0.1/mopidy/rpc -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"core.library.browse","params":{"uri":"local:directory"}}' \
  | jq -r '.result[].name'

To keep a large library up to date, copy new music into the folder and run sudo mopidyctl local scan again.

Step 9 - Browse and play your music

In Iris, open Albums, Artists or Tracks to browse your collection. Select an album to see its tracks, then play any track.

The transport controls at the bottom of the window show the current track, artwork, a seek bar and volume. The play queue fills from your selection.

Step 10 - Control Mopidy from an MPD client

Mopidy speaks the MPD protocol, so any MPD client (for example ncmpcpp, mpc or a mobile MPD app) can browse and control it. The MPD frontend is bound to loopback and protected by the per-VM MPD password. Reach it over an SSH tunnel from your workstation instead of opening port 6600:

ssh -L 6600:127.0.0.1:6600 azureuser@<vm-public-ip>
# then, on your workstation, with the MPD password from the credentials file: MPD_HOST="<mpd-password>@127.0.0.1" mpc status

From the VM itself, use the per-VM password to confirm that an MPD client sees the library and the player state:

MPASS=$(sudo grep '^mopidy.mpd.pass=' /root/mopidy-credentials.txt | cut -d= -f2-)
export MPD_HOST="$MPASS@127.0.0.1" mpc -p 6600 ls mpc -p 6600 search album "sac Sample Album" mpc -p 6600 status

mpc ls lists the top of the library (Local media), mpc search returns the tracks that it matched, and mpc status shows the current player state. To queue and play an album, an MPD client uses findadd and then play, for example:

mpc findadd album "sac Sample Album"
# queue an album mpc play
# start playback mpc current
# show the current track

Step 11 - Configure a real audio output

A cloud VM has no sound card, so the image ships with Mopidy's audio output set to a null GStreamer sink (fakesink). The playback pipeline runs cleanly, and clients see accurate playback state.

To hear audio, configure a real GStreamer output for your environment, for example an Icecast/shout2send stream that listeners connect to, or a Snapcast multi-room setup. Edit the [audio] section of /etc/mopidy/mopidy.conf and restart Mopidy:

sudo nano /etc/mopidy/mopidy.conf
# set output = <your GStreamer output pipeline>
sudo systemctl restart mopidy

See the Mopidy audio documentation for output pipelines and streaming options.

Step 12 - Extend Mopidy with plugins

Mopidy's plugin ecosystem includes backends for Spotify, SoundCloud, TIDAL, YouTube, podcasts and more. Install an extension with pip into the system packages so that the packaged Mopidy can load it. Then add its [extension] section to /etc/mopidy/mopidy.conf and restart Mopidy:

sudo pip3 install --break-system-packages Mopidy-SoundCloud
sudo nano /etc/mopidy/mopidy.conf
# add the [soundcloud] section with your auth token
sudo systemctl restart mopidy

The Settings page in Iris lists the extensions Mopidy has loaded and lets you manage the connection to the server.

Security baseline

The image is captured with the Ubuntu 24.04 security baseline fully applied, including phased updates. It ships with unattended security upgrades enabled, so your VM keeps patching itself after deployment:

cat /etc/apt/apt.conf.d/20auto-upgrades grep ConditionPathExists /etc/systemd/system/nginx.service.d/*.conf

Every Mopidy frontend binds to loopback only, and nginx is the single public listener. nginx is gated on the first-boot marker, so port 80 never answers before your per-VM password has been generated. The credentials file is root-only, and Mopidy runs as an unprivileged mopidy system user.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Mopidy image or help with your deployment, contact us at sales@secureanycloud.com.

Deploy on Azure

Launch Mopidy on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com