Navidrome on Ubuntu 24.04 on Azure User Guide

Overview

Navidrome is an open source, self hosted music streaming server that streams your personal music collection from anywhere through a modern in browser web player or any Subsonic compatible mobile and desktop app. It scans the audio files you copy into its library and presents your albums, artists and playlists with cover art, on the fly transcoding through ffmpeg, and a Subsonic compatible API that a wide ecosystem of player apps already speak. The cloudimg image serves Navidrome 0.62.0 behind an nginx reverse proxy on a hardened, fully patched Ubuntu 24.04 LTS base. The server listens only on the loopback interface (127.0.0.1:4533) and nginx serves it on port 80.

The image is secure by default: it ships with no administrator account and no media at all, so the very first time you open it you create your own admin with your own password. No shared or default login ever ships in the image. Backed by 24/7 cloudimg support.

What is included:

• Navidrome 0.62.0 served behind nginx, managed by systemd
• The Navidrome web player and Subsonic compatible API on :80
• No default administrator: you create your own admin on the first visit
• ffmpeg for on the fly transcoding to any bitrate or format
• The server bound to 127.0.0.1:4533 only, never exposed directly to the network
• A dedicated Azure data disk at /var/lib/navidrome for the music library, the SQLite database and the transcoding cache
• navidrome.service and nginx.service as enabled systemd units
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger libraries or more concurrent listeners. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web player. Navidrome serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The server is never exposed directly: it listens on 127.0.0.1:4533 only, so port 4533 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Navidrome by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name navidrome \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web player:

az vm open-port --resource-group <your-rg> --name navidrome --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm Navidrome and nginx are active. Note that the server listens only on 127.0.0.1:4533 while nginx serves the web player on port 80.

systemctl is-active navidrome nginx navidrome-firstboot

sudo ss -tlnp | grep -E ':80 |:4533 ' | sed 's/  */ /g'

Step 4 - The first visit info note

Navidrome ships with no administrator account. On the first boot of every VM a one shot service writes an instance info note recording the site URL and the create-admin instruction. There is no password in it, because you set your own on first visit. Read it with sudo:

sudo cat /root/navidrome-credentials.txt

You can confirm the server is healthy from the command line; the health endpoint returns 200:

curl -s -o /dev/null -w 'GET /ping -> HTTP %{http_code}\n' http://127.0.0.1/ping

Step 5 - Create your admin on first visit

Browse to http://<vm-public-ip>/. Because the image ships with no user, Navidrome opens on its create admin screen. Choose a username and a strong password and select CREATE ADMIN. This one screen is where you secure the instance: there are no default credentials to change, because none ship.

Step 6 - Browse your music library

Once your admin is created you land in the web player. The left sidebar lets you browse Albums, Artists, Songs, Radios and Playlists, with filters for recently added, most played, top rated and favourites. Navidrome scans the library automatically and presents your albums with cover art. Because the image ships empty, this is where your music appears once you copy it in (Step 8).

Step 7 - Play a track in the web player

Open an album to see its tracklist, cover art, release year and total running time, with PLAY, SHUFFLE, PLAY NEXT, PLAY LATER, ADD TO PLAYLIST and DOWNLOAD controls.

Select PLAY or double click a track and the persistent player bar appears at the bottom of the window, with the now playing track, a seek bar, volume, the play queue, and skip controls. ffmpeg transcodes on the fly so playback works on any device.

Step 8 - Add your own music

Copy your audio files into the library folder on the data disk and Navidrome scans them automatically. From your workstation you can use scp or rsync over SSH, for example scp -r ~/Music/* azureuser@<vm-public-ip>:/tmp/upload/ then move them into place. The library folder is:

sudo ls -la /var/lib/navidrome/music

Navidrome reads standard tags (title, artist, album, track number, year, genre) and folder or embedded cover art, so a well tagged collection appears organised into albums and artists within seconds of being copied in.

Step 9 - Verify the stack

Confirm the Navidrome version, that the services are enabled, the web player responds through nginx, and the dedicated data disk mount:

/usr/local/bin/navidrome --version

systemctl is-enabled navidrome nginx

curl -s -o /dev/null -w 'GET /app/ -> HTTP %{http_code}\n' http://127.0.0.1/app/

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/navidrome

Step 10 - Where your data lives

The music library, the SQLite database and the transcoding cache all live on a dedicated Azure data disk mounted at /var/lib/navidrome, separate from the OS disk. This disk is captured into the image and re provisioned on every VM, and you can snapshot and resize it independently. Confirm the mount and the free space:

df -h /var/lib/navidrome | tail -1

sudo du -sh /var/lib/navidrome/music /var/lib/navidrome/data /var/lib/navidrome/cache

Step 11 - Connect a Subsonic compatible app

Navidrome exposes a Subsonic compatible API, so a wide range of mobile and desktop players (play:Sub, DSub, Symfonium, Feishin, Sonixd and others) can stream from your server. Point the app at http://<vm-public-ip>/, then sign in with the admin username and password you created in Step 5. You can also create additional users from Settings so a household or team shares one server while you keep administrative control.

Security notes

• Navidrome serves plain HTTP on port 80. For production, put it behind your own TLS terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks. A common approach is certbot with your-domain on a front end proxy.
• The server listens on 127.0.0.1:4533 only and is never exposed directly; only nginx on port 80 faces the network.
• The image ships with no administrator and no media. You create the first admin on first visit, so there are no shared or default credentials to rotate. Keep the admin password somewhere safe and create scoped user accounts for other listeners.
• Keep the VM patched. The image ships fully patched with unattended security upgrades enabled.

Support

cloudimg images come with 24/7 support. If you have any questions about this Navidrome image or need help with your deployment, contact us through the cloudimg website.