Your own Navidrome server, streaming your music anywhere

What does Navidrome need from a server?

Very little processing power, and as much disk as your collection takes. The project's own overview promises very low resource usage and says it handles very large libraries; it publishes no minimum CPU or memory figure, so nobody can honestly quote you one. Three jobs do use the machine:

• Scanning. On first start Navidrome reads the tags of every file. Its guide expects a collection of between ten and fifty thousand tracks to take roughly 5 to 15 minutes, and you can play music while it works.
• Converting. When a phone on mobile data asks for a smaller stream, or a browser cannot play a format, ffmpeg converts the track on the fly. That is the one place a faster processor helps.
• Storing. The music itself, plus a data folder for the database and caches. Lossless files fill disks quickly, so measure your collection before you pick a machine.

One thing to sort out before you copy anything: Navidrome organises music purely by its tags, not by folder names, and its FAQ says untagged libraries are not supported. Run your files through MusicBrainz Picard or beets first and the albums will appear the way you expect.

Why your music deserves a whole machine

A rented dedicated server is one physical computer that runs your work and nobody else's. For a music library that means the disks are yours alone, you log in as root to install what you like, and the port is unmetered: there is no transfer allowance to run over, however many hours your family streams. If you ever shut yourself out with a bad firewall setting, rack servers, blades and two cartridge models (m510 and m710x) give you a console screen and power button of your own; the remaining cartridges can only be switched on and off remotely.

There is no contract. A ready server is handed over within 30 minutes of your payment being approved, and you can cancel when any month ends. If you also keep films and TV shows, compare this page with our Jellyfin workload or our Plex workload: Navidrome plays music only.

The server that fits your collection

Start from the size of the library, then look at the cards on the dedicated server page. A few that suit a music server, as listed there:

For the last row, the storage servers and the build-to-order form let you pick drives and RAID. A build takes 4 to 24 hours when we hold the parts, and 5 to 10 working days when they have to be bought in. Choose a city close to where you listen from on our data center page.

Up and running with Docker

These steps assume Ubuntu with Docker Engine and its compose plugin installed. First switch the firewall on with only SSH allowed, IPv6 included, and make the folders. The 1000:1000 is a placeholder: use the numbers id -u and id -g print for your own account.

sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw allow OpenSSH
sudo ufw --force enable
sudo mkdir -p /srv/navidrome/data /srv/navidrome/backup /srv/music
sudo chown -R 1000:1000 /srv/navidrome
sudo chown -R "$USER": /srv/music
sudo chmod -R a+rX /srv/music

Then save this as /srv/navidrome/compose.yaml. It uses the official navidrome/navidrome image and differs from the documentation's example in one important way: the port is published on 127.0.0.1 only. Docker inserts firewall rules of its own, which means a bare 4533:4533 mapping exposes the setup page no matter what ufw says.

services:
  navidrome:
    image: navidrome/navidrome:latest
    user: 1000:1000
    ports:
      - "127.0.0.1:4533:4533"
    restart: unless-stopped
    environment:
      ND_ENFORCENONROOTUSER: "true"
      ND_BACKUP_PATH: /backup
      ND_BACKUP_SCHEDULE: "0 0 * * *"
      ND_BACKUP_COUNT: 7
    volumes:
      - "/srv/navidrome/data:/data"
      - "/srv/music:/music:ro"
      - "/srv/navidrome/backup:/backup"

Start it from that folder with docker compose up -d and watch docker compose logs -f navidrome until the scan begins. Inside the container /music is your library, mounted read-only, and /data holds the database. If the log says it is unable to open the database file, the data folder does not belong to the user in the file; Navidrome ignores PUID and PGID, so fix the ownership instead. Prefer no containers? The project also ships a .deb package and a systemd service, described in its Linux guide.

Claim the admin login before anyone else can

The very first visit to a new Navidrome shows a form that creates the administrator, so you want to be that first visitor. Because the port only listens on the server itself, reach it by tunnelling through the SSH account you log in with:

1. On your own computer, run ssh -L 8080:127.0.0.1:4533 you@your-server and keep that window open.
2. Open http://localhost:8080 in your browser, pick a username and a strong password, and click Create Admin.
3. Add an account for each person who will listen. Everyone keeps their own playlists, favourites and play counts.
4. Copy your music up over SFTP or rsync through the same login. Navidrome has no upload button, on purpose: it never writes to your music folder.

Listening from your phone over HTTPS

Once the admin exists, put a reverse proxy in front: a web server such as Caddy, Nginx or Traefik that holds the HTTPS certificate and passes requests to Navidrome. The project's security guide recommends exactly that, with Navidrome listening on localhost only. Point a domain name at the server, have the proxy forward it to 127.0.0.1:4533, and allow 80/tcp and 443/tcp in ufw. Never open 4533.

• If Navidrome gets a whole hostname, such as music.example.com, you need nothing else. If it lives under a path, set ND_BASEURL (for example /music) and recreate the container.
• Phone and desktop apps speak the Subsonic API under /rest/, and share links use /share/. Let both through the proxy.
• Leave externalized authentication off unless your proxy really does the logging in. It is not needed for HTTPS.

For apps, Navidrome is compatible with Subsonic API 1.16.1, with some exceptions, plus the OpenSubsonic extensions, and the project keeps a directory of clients for Android, iOS, Windows, macOS, Linux, CarPlay and Android Auto. You sign in with the server address, your username and your password.

Keeping it safe: limits, passwords, backups

Transcoding runs through ffmpeg, which Navidrome requires. The project says its official Docker image includes everything needed to run Navidrome, which we take to cover ffmpeg. You can confirm with docker compose exec navidrome ffmpeg -version. When an app wants a smaller stream but doesn't say which format, Navidrome picks Opus, its DefaultDownsamplingFormat. By default there is no limit on simultaneous conversions; set ND_TRANSCODING_MAXCONCURRENT and ND_TRANSCODING_MAXCONCURRENTPERUSER to numbers that suit your processor. The screen for editing transcoding commands stays locked unless you start with ND_ENABLETRANSCODINGCONFIG=true, because whoever edits those commands can run programs on your server. Switch it back off when you are done.

To work with Subsonic apps, Navidrome has to keep passwords in a form it can read back, scrambled by default with a key shared by every Navidrome install, which the project says is only for obfuscation. Setting ND_PASSWORDENCRYPTIONKEY re-encrypts them with your own key, once and for good: change it later and nobody can log in. Treat it like a password, and keep it out of anything you share. The login rate limiter is on by default; leave it that way.

The compose file above already saves a copy of the database once a day at midnight, container time, and keeps seven. That covers users, playlists and play counts, but not your music and not your settings. Backing up is your job, since you manage the server and we keep the hardware and the network running. Keep second copies of your music and of /srv/navidrome/backup somewhere else. To make a copy right now, run docker compose run --rm navidrome backup create. Restoring overwrites everything that changed since that copy, so stop the server first:

docker compose stop navidrome
docker compose run --rm navidrome backup restore --backup-file navidrome_backup_2026.04.01_04.00.00.db
docker compose start navidrome

Only music you have the right to stream

Fill the library with albums you bought, CDs you ripped yourself, your own recordings, or tracks whose licence lets you stream them. Navidrome plays whatever sits in the folder; making sure you are allowed to is up to you.

Questions people ask

What port should I open for Navidrome?

None besides SSH, 80 and 443. Navidrome listens on 4533 by default, but on a public machine it is safer to keep that port on the loopback address and put a reverse proxy in charge of HTTPS. Your apps then connect to the proxy's address, not to 4533.

Is Navidrome a good fit for a family?

Yes. It is multi-user: each person gets a login of their own, with separate play counts, playlists and favourites. Multiple libraries with per-user access are supported too, if some music should be visible to only some people.

Can Navidrome play my videos as well?

No. The project states it will not implement any video features and focuses on music only. If you also want films and series, run a video server beside it or instead of it.

What do I lose if the server's disk fails?

Whatever is not copied elsewhere. Navidrome's own backup saves only its database, and looking after copies is up to you: we look after the machine and the network, not your software. Keep a spare copy of the songs and the nightly database files on another machine or service you control.