Haack's Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
-------------------------------------------
  * **Navidrome Setup**
  * **oemb1905**
  * **gnulinux.studio**
  * **webmaster@gnulinux.studio**

-------------------------------------------

//navidromesetup//

-------------------------------------------

This tutorial is for Debian Trixie users seeking to set up a production-ready Navidrome server. I used virsh+qemu to make a VM with 8TB of storage, and the VM is set up with a LAMP stack, a reverse proxy with Let's Encrypt, automated syncing, scanning, and some hardening measures. Im using fpm with the mpm_event handler for concurrency. My standard fail2ban setup is in place for protection. This instance is designed for public listening. The library is imaged off my master library via a remote source and includes aggressive cover art fetching. Let's setup our lamp stack and add the basic packages required. If you don't know how to setup TLS / LAMP properly, please see [[https://wiki.haacksnetworking.org/doku.php?id=computing:apachesurvival|my tutorial]].

  sudo apt update && sudo apt upgrade -y
  sudo apt install ffmpeg wget nano curl snapd ufw fail2ban postfix apache2 php8.4-fpm php8.4-mysql php8.4-curl php8.4-gd php8.4-mbstring php8.4-xml php8.4-zip

Next, we download and install Navidrome:

  wget https://github.com/navidrome/navidrome/releases/download/v0.54.1/navidrome_0.54.1_linux_amd64.deb
  sudo apt install ./navidrome_0.54.1_linux_amd64.deb

Let's set up a music directory:

  sudo mkdir -p /opt/navidrome/music
  sudo chown -R navidrome:navidrome /opt/navidrome/music
  sudo find /opt/navidrome/music -type d -exec chmod 755 {} +
  sudo find /opt/navidrome/music -type f -exec chmod 644 {} +

Make sure you enable proper modules and conf files:

  sudo a2enmod proxy proxy_http ssl headers rewrite proxy_fcgi setenvif
  sudo a2enconf php8.4-fpm
  sudo a2dismod mpm_prefork php8.4
  sudo a2enmod mpm_event

Setup regular Let's Encrypt with the default vhost and and then replace the vhost with the reverse proxy once everything is setup. Let's setup Let's Encrypt and TLS:
 
  sudo a2ensite gnulinux.studio.conf
  sudo apache2ctl configtest
  sudo apt install certbot letsencrypt python3-certbot-apache
  sudo certbot --authenticator standalone --installer apache -d gnulinux.studio --pre-hook "systemctl stop apache2" --post-hook "systemctl start apache2"
  
Once the default configuration is working for both http and https, disable the let's encrypt configuration with ''a2dissite gnulinux.studio-le.conf'' and then edit the primary configuration ''nano /etc/apache2/sites-enabled/gnulinux.studio.conf'' with the following:

  <VirtualHost *:80>
      ServerName gnulinux.studio
      Redirect permanent / https://gnulinux.studio/
  </VirtualHost>
  <VirtualHost *:443>
      ServerName gnulinux.studio
      SSLEngine on
      SSLCertificateFile /etc/letsencrypt/live/gnulinux.studio/fullchain.pem
      SSLCertificateKeyFile /etc/letsencrypt/live/gnulinux.studio/privkey.pem
      ProxyPreserveHost On
      ProxyRequests Off
      ProxyPass / http://127.0.0.1:4533/
      ProxyPassReverse / http://127.0.0.1:4533/
      <FilesMatch \.php$>
          SetHandler "proxy:unix:/run/php/php8.4-fpm.sock|fcgi://localhost/"
      </FilesMatch>
      <Location />
          Require all granted
      </Location>
      RequestHeader set X-Real-IP %{REMOTE_ADDR}s
      RequestHeader set X-Forwarded-For %{REMOTE_ADDR}s
      Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
      Header always set X-Frame-Options "SAMEORIGIN"
  </VirtualHost>

Since TLS was already setup under the regular vhost, and the reverse proxy configuration simply uses the same cert, you can just drop this in and restart apache ''systemctl restart apache2''. This is a good time to visit your site's domain and make sure everything is working. If it won't serve navidrome, check syntax, check logs, and make sure modules/configurations in apache are functioning properly and configured with proper syntax. Next, let's tune the php handler, ''mpm_event'', over in ''nano /etc/apache2/mods-available/mpm_event.conf'', assuming 8 cores and an upper limit of 400 workers:

  StartServers 4
  MinSpareThreads 25
  MaxSpareThreads 75
  ThreadLimit 64
  ThreadsPerChild 25
  MaxRequestWorkers 400
  MaxConnectionsPerChild 0
  ServerLimit 16
  
Once you've adjusted this, restart apache with ''sudo systemctl restart apache2''. Let's also adjust how php spins up servers for simultaneous requests by adjusting ''nano /etc/php/8.4/fpm/pool.d/www.conf'' as follows:

  pm = dynamic
  pm.max_children = 200
  pm.start_servers = 20
  pm.min_spare_servers = 10
  pm.max_spare_servers = 20
  pm.max_requests = 1000
  request_terminate_timeout = 300s

Once you enter the adjustments test fpm and restart the service as follows: ''sudo php-fpm8.4 -t && sudo systemctl restart php8.4-fpm''. It's now time to edit the main Navidrome configuration file. Let's open ''nano /etc/navidrome/navidrome.toml'' as follows:

  DataFolder = "/var/lib/navidrome"
  MusicFolder = "/opt/navidrome/music"
  Address = "127.0.0.1"
  Port = 4533
  BaseUrl = "https://gnulinux.studio"
  ShareURL = "https://gnulinux.studio"
  EnableUserEditing = false
  EnableDownloads = false
  ImportPlaylists = false
  LogLevel = "info"
  LogFile = "/var/log/navidrome/navidrome.log"
  [Scanner]
  Enabled = true
  Schedule = "@every 24h"
  WatcherWait = "5s"
  ScanOnStartup = true
  [CoverArt]
  Enabled = true
  Embed = true
  CacheSize = "2GB"
  Sources = ["embedded", "folder", "metadata"]
  Priority = ["embedded", "folder", "metadata"]

Let's restart the navidrome service and check its status ''sudo systemctl enable --now navidrome'' and then ''systemctl status navidrome''. To manually scan your library, do the following:

  cd /var/lib/navidrome
  sudo -u navidrome navidrome scan -f

In my case, the navidrome instance is for public listening, and my master library is managed through Airsonic Advanced on a different server. I also use Picard from musicbrainz.org to edit my tags, and even RhythmBox comes in handy from time to time. All of these tools, however, edit a common master file source that's synced with Nextcloud and editable by Airsonic Advanced. It's that library, which I use a cronjob for to pull over to Navidrome, ensuring that Navidrome continues to be a live mirror of my Master Library, or Masters. Let's create a script ''nano /usr/local/bin/sync-music.sh'' and make it executable ''sudo chmod 750 /usr/local/bin/sync-music.sh'' that does all this:

  #!/bin/bash
  SOURCE="root@mail.outsidebox.club:/mnt/Storage/obdata/oemb1905/files/Masters/*"
  DEST="/opt/navidrome/music/"
  LOG="/root/logs/rsync-music.log"
  touch /tmp/sync-music.lock
  echo "$(date): Starting music sync..." >> "$LOG"
  sudo rsync -ai --log-file=/root/logs/rsync-music.log --delete --chown=navidrome:navidrome root@mail.outsidebox.club:/mnt/location/of/your/masters/* /opt/navidrome/music/
  echo "$(date): Music sync completed." >> "$LOG"
  rm /tmp/sync-music.lock

Let's run this via cron every 2 hours: 
  
  0 */2 * * * /usr/bin/flock --nonblock /tmp/sync-music.lock /bin/bash /usr/local/bin/sync-music.sh >> /root/logs/rsync-music.log

Fail2Ban needs to be setup. Users should be familiar with how to do that and can refer to my [[https://wiki.haacksnetworking.org/doku.php?id=computing:fail2ban|wiki entry]] if they need help with basic setup. Here, I am covering how to setup a custom Navidrome jail for extra protection. One should additionally enable the apache protections, sshd, dropbear and/or whatever their instance might benefit from. Let's open ''nano /etc/fail2ban/jail.local'' and add a jail:

  [navidrome]
  enabled = true
  backend = systemd
  filter = navidrome
  maxretry = 5
  findtime = 600
  bantime = 3600

Next, let's create rules for this jail in its configuration file ''nano /etc/fail2ban/filter.d/navidrome.conf'':

  [Definition]
  failregex = ^.*msg="Unsuccessful login".*(X-Real-Ip|X-Forwarded-For):\s*\[<HOST>\].*$
  ignoreregex =
  journalmatch = _SYSTEMD_UNIT=navidrome.service + _TRANSPORT=stderr

After everything is built, let's restart fail2ban ''sudo systemctl restart fail2ban''. For upgradind, simply ''wget'' the new image and then ''sudo apt install ./new.deb''. 

 --- //[[alerts@haacksnetworking.org|oemb1905]] 2025/10/29 02:18//
Haack's Wiki

User Tools

Site Tools

Page Tools
