Navidrome server on a dedicated machine

What Navidrome asks of the hardware

The Navidrome docs publish no CPU or RAM minimum. They say the server has very low resource usage, runs on a Raspberry Pi Zero and old hardware, and handles very large collections. Releases exist for Linux on Intel and ARM, 32 and 64 bits, and the Docker image covers linux/amd64, arm/v6, arm/v7 and arm64. Navidrome needs read-only access to the music and read-write access to its data folder, which holds the database and the cache.

Three things do cost resources. Disk is the library itself plus the data folder. CPU goes to ffmpeg when a client asks for a different format or a lower bitrate. Time goes to the first scan, which the Getting Started guide estimates as follows:

Navidrome browses by tags, not folders. The FAQ is explicit that an untagged library is not supported, so tag files with a tool such as MusicBrainz Picard or beets before the scan, not after.

Choosing the machine

Our reasoning, not the project's: a music server spends its life mostly idle and wakes for a scan or a transcode, so the deciding figure is how many terabytes the library needs and how they are protected. The dedicated server range maps onto that like this.

• Moonshot cartridge for one service per box: the Intel Atom C2750 line ships with a 500 GB SATA disk, the Xeon E3-1284L v4 with a 256 GB SATA-SSD. Neither of these two cartridges has a RAID controller and each has one disk in its listed build, so the library has no mirror unless you keep a copy elsewhere.
• Xeon D-1587, 16 cores with a 1.92 TB NVMe-SSD in its listed build, for a mid-sized lossless collection plus fast scans.
• A build to order when the library outgrows that: the custom build takes up to 24 drive bays in RAID 0, 1, 5, 6, 10 or JBOD, handed over 4 to 24 hours after the order clears review.
• Every line's port is unmetered, at 1 Gbps or 500 Mbps depending on the line, so remote listening and the initial upload are never billed by the gigabyte.

Racked machines are handed over in about 30 minutes once payment is approved. Rack servers and blades come with an out-of-band console (HPE iLO, Dell iDRAC or a Supermicro BMC), as do the m510 and m710x cartridges; the other cartridges have power control only. Pick the city nearest your listeners on the data center page.

Installing from the .deb on Ubuntu

The packaged route in the Linux guide sets up a systemd unit running under a navidrome account, with its config in /etc/navidrome/navidrome.toml. Turn the firewall on first, with IPv6 rules enabled and only SSH open, so nothing on 4533 is reachable while the config is still empty. Replace 0.XX.X with the current release from the project's GitHub releases page.

sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw allow OpenSSH
sudo ufw --force enable
sudo apt update && sudo apt install -y ffmpeg
wget https://github.com/navidrome/navidrome/releases/download/v0.XX.X/navidrome_0.XX.X_linux_amd64.deb
sudo apt install ./navidrome_0.XX.X_linux_amd64.deb
sudo mkdir -p /srv/music && sudo chmod -R o+rX /srv/music
sudo tee /etc/navidrome/navidrome.toml > /dev/null <<'EOF'
DataFolder = "/var/lib/navidrome"
MusicFolder = "/srv/music"
Address = "127.0.0.1"
Port = 4533
EnforceNonRootUser = true
EOF
sudo systemctl enable navidrome
sudo systemctl restart navidrome
sudo journalctl -u navidrome -n 50

MusicFolder is the library (it becomes the default library if you add more later), Address and Port set where the HTTP server listens, and EnforceNonRootUser makes Navidrome refuse to start as root. DataFolder holds the database and cache; /var/lib/navidrome is the working directory the Linux guide uses, so keep it there unless the database belongs on another disk. Without MusicFolder the package falls back to /opt/navidrome/music. Keep the library outside /home if you later add ProtectHome to the unit. The log should end with a scan starting.

If you prefer containers, the official image is navidrome/navidrome:latest, with /data and /music as volumes and a user directive that owns the data folder. Publish it as 127.0.0.1:4533:4533, not the docs' plain 4533:4533, which listens on every interface and is not filtered by ufw.

Creating the admin account privately

On a new install the web UI opens on an admin creation screen, and the CLI's navidrome user commands only work once an admin exists. Whoever reaches that screen first owns the server. From your workstation, through your own login on the server, forward the loopback port:

1. In a spare terminal, run ssh -N -L 4533:127.0.0.1:4533 you@server.example.com.
2. Browse to http://localhost:4533, choose a username and a long password, and press Create Admin.
3. Add the other listeners under Users, each with their own password. They get their own play counts, playlists and favourites.
4. Copy music in over the same SSH login with sftp or rsync. Navidrome has no upload feature by design and never writes to the music folder.

Reverse proxy, TLS and BaseUrl

Navidrome's security page recommends running it behind a reverse proxy such as Caddy, Nginx, Traefik or Apache for TLS, with Address set to localhost so the embedded server is not on every IP. With the admin created, install the proxy on the same machine, point a hostname at it, forward everything to 127.0.0.1:4533, and open the web ports with sudo ufw allow proto tcp to any port 80,443. Port 4533 itself stays closed.

• BaseUrl: leave it empty when Navidrome owns the whole hostname. Set it, for example BaseUrl = "/music", when the proxy serves it under a path, and restart.
• /rest: Subsonic clients talk to the /rest/ endpoints, so the proxy must pass them through.
• /share: public share links live under /share/; allow that path if you use sharing.
• Externalized authentication (ExtAuth.TrustedSources) is not needed for an ordinary proxy. Turn it on only when the proxy itself logs users in, and read the security notes first: on a fresh install, the first user created that way also becomes admin.

Transcoding and Subsonic clients

Navidrome transcodes on the fly with ffmpeg, configurable per user and player, and Opus encoding is supported. A client that asks for a lower bitrate without naming a format gets DefaultDownsamplingFormat, which is opus. Finished transcodes land in a cache set by TranscodingCacheSize (100MB by default). Two settings worth changing on a shared server: Transcoding.MaxConcurrent and Transcoding.MaxConcurrentPerUser both default to 0, meaning no cap, and the docs present a server-wide cap as protection against ffmpeg overload.

Editing transcoding commands in the web UI is off by default, because a command field is a way to run arbitrary programs on the host. If you must change one, start with ND_ENABLETRANSCODINGCONFIG=true, make the change, and remove it again.

Beyond the web UI, Navidrome implements Subsonic API v1.16.1 with listed exceptions, plus OpenSubsonic extensions, so the apps in the project's directory for Android, iOS, desktop, CarPlay and Android Auto connect with a server URL, a username and a password. It is music only: no video endpoints. For films and TV, the Jellyfin page or the Plex page is the right starting point.

Backups and hardening

Since 0.54, Navidrome can export its database on a schedule. It backs up only the database (users, play counts, playlists), not the music and not the config file. Create a folder the navidrome user can write, append a [Backup] table to the config and restart:

sudo install -d -o navidrome -g navidrome -m 700 /var/backups/navidrome
sudo tee -a /etc/navidrome/navidrome.toml > /dev/null <<'EOF'
[Backup]
Path = "/var/backups/navidrome"
Count = 7
Schedule = "0 0 * * *"
EOF
sudo systemctl restart navidrome

That keeps seven nightly copies. With the hand-written unit from the Linux guide instead of the package, add the folder to ReadWritePaths as well. sudo -u navidrome navidrome --configfile /etc/navidrome/navidrome.toml backup create makes one on demand, and backup prune with the same flags trims old ones. Stop the service (sudo systemctl stop navidrome), then restore with sudo -u navidrome navidrome --configfile /etc/navidrome/navidrome.toml backup restore --backup-file navidrome_backup_2026.04.01_04.00.00.db and start it again: the restore replaces the database, and every change since that backup is lost. The scheduled backup lands on the same machine as the database, so copy the backup folder and the music to storage off this machine yourself.

• Never run Navidrome as root; it needs read-only music and a writable data folder, nothing more.
• Passwords are stored reversibly for Subsonic compatibility, under a default key common to all installs; the docs call that obfuscation, nothing more. Set PasswordEncryptionKey to replace it: Navidrome re-encrypts every password with it on restart, and from then on it can never be changed. With the key in it, set navidrome.toml to mode 640, owner root, group navidrome.
• Leave the login rate limiter on (AuthRequestLimit, 5 attempts per AuthWindowLength of 20s by default).
• EnableInsightsCollector sends anonymous usage data and is on by default; set it to false if you prefer.

Whose music it is

Serve music you own or hold the rights to: your ripped CDs, DRM-free purchases, your own recordings. Navidrome indexes whatever is in the folder; what goes in it is your responsibility.