SecureAnyCloud
Deployment guide

Navidrome

Videos

Overview: Navidrome on Ubuntu 24.04 LTS on Azure: overview (watch on YouTube)

Launch and log in: Navidrome on Ubuntu 24.04 LTS on Azure: launch and log in (watch on YouTube)

Deep Dive: Navidrome on Ubuntu 24.04 LTS on Azure: deep dive (watch on YouTube)

Overview

Navidrome is an open-source, self-hosted music streaming server. It streams your personal music collection from anywhere through a modern in-browser web player or any Subsonic-compatible mobile or desktop app. It scans the audio files that you copy into its library and presents your albums, artists and playlists with cover art. It also provides on-the-fly transcoding through ffmpeg and a Subsonic-compatible API that many player apps already support.

This SecureAnyCloud image serves Navidrome 0.62.0 behind an nginx reverse proxy on a hardened Ubuntu 24.04 LTS base, patched at build time. The server listens only on the loopback interface (127.0.0.1:4533), and nginx serves it on port 80.

The image is secure by default. It ships with no administrator account and no media, so the first time you open it, you create your own admin with your own password. No shared or default login ships in the image.

What you get:

  • Navidrome 0.62.0 served behind nginx, managed by systemd
  • The Navidrome web player and Subsonic-compatible API on :80
  • No default administrator, so you create your own admin on the first visit
  • ffmpeg for on-the-fly transcoding to any bitrate or format
  • The server bound to 127.0.0.1:4533 only, never exposed directly to the network
  • A dedicated Azure data disk at /var/lib/navidrome for the music library, the SQLite database and the transcoding cache
  • navidrome.service and nginx.service as enabled systemd units
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger libraries or more concurrent listeners.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web player. Navidrome serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain. The server listens on 127.0.0.1:4533 only, so port 4533 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Navidrome by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:navidrome-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name navidrome \
  --image sac1647283583153:navidrome-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web player:

az vm open-port --resource-group <your-rg> --name navidrome --port 80

Step 3 - Confirm the services are running

Connect over SSH as azureuser and confirm that Navidrome and nginx are active. The server listens only on 127.0.0.1:4533, while nginx serves the web player on port 80.

systemctl is-active navidrome nginx navidrome-firstboot
sudo ss -tlnp | grep -E ':80 |:4533 ' | sed 's/ */ /g'

Step 4 - Read the first-visit info note

Navidrome ships with no administrator account. On the first boot of every VM, a one-shot service writes an instance info note that records the site URL and the create-admin instruction. The note contains no password, because you set your own on your first visit. Read it with sudo:

sudo cat /root/navidrome-credentials.txt

Confirm from the command line that the server is healthy. The health endpoint returns 200:

curl -s -o /dev/null -w 'GET /ping -> HTTP %{http_code}\n' http://127.0.0.1/ping

Step 5 - Create your admin on first visit

Browse to http://<vm-public-ip>/. The image ships with no user, so Navidrome opens on its create admin screen.

Choose a username and a strong password, and select CREATE ADMIN. This screen is where you secure the instance. No default credentials ship, so there is nothing to change.

Step 6 - Browse your music library

After you create your admin, you land in the web player. Use the left sidebar to browse Albums, Artists, Songs, Radios and Playlists, with filters for recently added, most played, top rated and favourites.

Navidrome scans the library automatically and presents your albums with cover art. The image ships empty, so your music appears here after you copy it in (Step 8).

Step 7 - Play a track in the web player

Open an album to see its tracklist, cover art, release year and total running time. The album page offers PLAY, SHUFFLE, PLAY NEXT, PLAY LATER, ADD TO PLAYLIST and DOWNLOAD controls.

Select PLAY, or double-click a track, and the persistent player bar appears at the bottom of the window. It shows the now-playing track, a seek bar, volume, the play queue and skip controls. ffmpeg transcodes on the fly, so playback works on any device.

Step 8 - Add your own music

Copy your audio files into the library folder on the data disk, and Navidrome scans them automatically. From your workstation, use scp or rsync over SSH, for example scp -r ~/Music/* azureuser@<vm-public-ip>:/tmp/upload/, and then move the files into place. The library folder is:

sudo ls -la /var/lib/navidrome/music

Navidrome reads standard tags (title, artist, album, track number, year, genre) and folder or embedded cover art. A well-tagged collection appears organised into albums and artists within seconds of being copied in.

Step 9 - Verify the stack

Confirm the Navidrome version, that the services are enabled, that the web player responds through nginx, and that the dedicated data disk is mounted:

/usr/local/bin/navidrome --version
systemctl is-enabled navidrome nginx
curl -s -o /dev/null -w 'GET /app/ -> HTTP %{http_code}\n' http://127.0.0.1/app/
findmnt -no SOURCE,TARGET,FSTYPE /var/lib/navidrome

Step 10 - Where your data lives

The music library, the SQLite database and the transcoding cache all live on a dedicated Azure data disk mounted at /var/lib/navidrome, separate from the OS disk. The disk is captured into the image and re-provisioned on every VM, and you can snapshot and resize it independently. Confirm the mount and the free space:

df -h /var/lib/navidrome | tail -1
sudo du -sh /var/lib/navidrome/music /var/lib/navidrome/data /var/lib/navidrome/cache

Step 11 - Connect a Subsonic compatible app

Navidrome exposes a Subsonic-compatible API, so a wide range of mobile and desktop players (play:Sub, DSub, Symfonium, Feishin, Sonixd and others) can stream from your server. Point the app at http://<vm-public-ip>/, then sign in with the admin username and password that you created in Step 5.

You can also create additional users from Settings, so that a household or team shares one server while you keep administrative control.

Security notes

  • Encrypt web traffic. Navidrome serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks. A common approach is certbot with your-domain on a front-end proxy.
  • Keep the server private. The server listens on 127.0.0.1:4533 only and is never exposed directly. Only nginx on port 80 faces the network.
  • Protect the admin account. The image ships with no administrator and no media. You create the first admin on your first visit, so there are no shared or default credentials to rotate. Keep the admin password in a safe place, and create scoped user accounts for other listeners.
  • Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Navidrome image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch Navidrome on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure