Media tier: Navidrome

[Gerrrt]

Sub-issue of #95. Not named in ADR-0008 — proposed as an addition to the tier it created.

What and why

Navidrome Music Server GPL-3.0 Docker/Go — awesome-selfhosted README.md:1375.

A single Go binary, small enough to be uninteresting on the resource graphs, and Subsonic-API compatible — which is the reason to pick it over anything else in the category. The client problem is solved before deployment starts: a dozen mature apps already exist on every platform, and none of them need this project to maintain them.

Why the media tier is the right place

Same reasoning as #140: replaceable media, same trust level as the film library, no new firewall rule beyond the 50→40 that #138 adds. Jellyfin can serve music, and its music experience is the weakest part of it — a purpose-built server with the Subsonic ecosystem behind it is a better answer for the same files.

What it needs

• The NAS, per Plan and build the NAS on VLAN 40 #95, and a share of its storage. It can point at the same library path as Jellyfin, read-only.
• Admin credentials in secrets/*.sops.yaml.
• Nothing else. No transcoding requirement, no database server — it keeps its own SQLite.

Which VLAN this touches

🟡 40 — CasaBonita (media)

Security review

• Does not weaken the default-deny posture between VLANs — no rule beyond the 50→40 in Media tier: Jellyfin — placement answers the terminal-VLAN problem #138
• Any new credential goes in secrets/*.sops.yaml
• Any new device is added to docs/network.md with an OUI-truncated MAC — n/a

Depends on

#95 (the NAS).

---

Note

Status, 2026-09-17. The host exists and the tier has a shape; the storage
does not.

smaug — the NAS, named by
ADR-0038
and running TrueNAS by
ADR-0040
— has held 10.0.40.30 since 2026-09-16, with four inbound passes created and
verified in position. The 50→40 rule this issue inherits from #138 is among
them, so no new firewall rule is needed here and none was ever going to be.

stacks/media/ is
authored and CI-validated, with Jellyfin alone in it. It is not deployed —
docs/runbooks/build-the-nas.md §6 deploys it, after the two Exos X20 drives
land and the pool erebor and its erebor/media dataset exist.

The storage decision §4 made applies here too: erebor/media is not backed up
and erebor/apps — where a service's database and config go — is.

Depends on #413, not #95, which
closed on 2026-09-04.

stacks/media/compose.yaml already names this service as a future one in its
own comments — "Audiobookshelf (#140) and Navidrome (#141) land here later, in
the shape this file already has" — so the shape to add it to exists: pinned by
digest, non-root, read_only, cap_drop: ALL, a healthcheck that works with
what the image actually ships, and a memory limit set from a measured idle RSS
rather than from a guess.

---

Corrected 2026-09-19

The 2026-09-17 note is wrong in two places now: the storage exists (erebor, ONLINE since 2026-09-19) and the stack is deployed (stacks/media on smaug, #522, Jellyfin live, #138 closed). stacks/media/compose.yaml holds jellyfin and node-exporter and nothing else, so this is straightforwardly addable in the shape the file already has. Re-sequenced to seq/2: with #484 first, these are the unblocked builds in this milestone. The admin credential question is #528, and it applies here too.