@@ -23,6 +23,7 @@ ../roles/syncthing.nix
     ../roles/tailscale-subnet-router.nix
     ../roles/uptime-monitor.nix
     ../roles/video-library.nix
+    ../roles/music-library/all.nix
     ../roles/webserver/local-ca.nix
     ../roles/webserver/reverse-proxy.nix
     ../settings/services/searchix.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./importer.nix
+    ./streaming-server.nix
+  ];
+}

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  ...
+}:
+let
+  python = pkgs.python3;
+  beets = python.pkgs.beets.override {
+    pluginOverrides = {
+      alternatives = {
+        enable = true;
+        propagatedBuildInputs = [ python.pkgs.beets-alternatives ];
+      };
+    };
+  };
+in
+{
+  environment.systemPackages = [
+    beets
+    pkgs.rclone
+  ];
+
+  users.groups.music = {
+    gid = 983;
+    members = [ "alin" ];
+  };
+}

@@ -0,0 +1,69 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (config.networking) domain fqdn;
+  inherit (import ../../../data) homenet tailnet;
+  navidromeUpstream =
+    let
+      navidrome = config.services.navidrome.settings;
+    in
+    ''
+      reverse_proxy ${navidrome.Address}:${toString navidrome.Port}
+    '';
+in
+{
+  services.navidrome = {
+    enable = true;
+    plugins = with pkgs.navidromePlugins; [
+      apple-music
+    ];
+    settings = {
+      MusicFolder = "/srv/music/library";
+
+      Agents = "listenbrainz,deezer";
+
+      AutoTranscodeDownload = true;
+      DefaultTheme = "Auto";
+      EnableMediaFileCoverArt = false;
+      PreferSortTags = true;
+      TranscodingCacheSize = "1GiB";
+
+      Subsonic.AppendAlbumVersion = false;
+      Scanner = {
+        ScanOnStartup = false;
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "music.${domain}" = {
+      extraConfig = ''
+        ${lib.optionalString (domain == homenet) ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+        ''}
+        ${navidromeUpstream}
+      '';
+    };
+    "music.${tailnet}" = {
+      extraConfig = ''
+        bind tailscale/music
+        tls {
+          get_certificate tailscale
+        }
+        ${navidromeUpstream}
+      '';
+    };
+  };
+
+  services.dnsmasq.settings.cname = [
+    "music.${domain},${fqdn}"
+  ];
+}