diff --git a/machines/servo/default.nix b/machines/servo/default.nix
index 55737d8b..a3fc5bce 100644
--- a/machines/servo/default.nix
+++ b/machines/servo/default.nix
@@ -12,6 +12,7 @@
     ./services/jackett.nix
     ./services/jellyfin.nix
     ./services/matrix.nix
+    ./services/navidrome.nix
     ./services/nginx.nix
     ./services/nix-serve.nix
     ./services/pleroma.nix
diff --git a/machines/servo/services/navidrome.nix b/machines/servo/services/navidrome.nix
new file mode 100644
index 00000000..14890ca5
--- /dev/null
+++ b/machines/servo/services/navidrome.nix
@@ -0,0 +1,17 @@
+{ ... }:
+
+{
+  sane.impermanence.service-dirs = [
+    { user = "navidrome"; group = "navidrome"; directory = "/var/lib/private/navidrome"; }
+  ];
+  services.navidrome.enable = true;
+  services.navidrome.settings = {
+    # docs: https://www.navidrome.org/docs/usage/configuration-options/
+    Address = "127.0.0.1";
+    Port = 4533;
+    MusicFolder = "/var/lib/uninsane/media/Music";
+    CovertArtPriority = "*.jpg, *.JPG, *.png, *.PNG, embedded";
+    AutoImportPlaylists = false;
+    ScanSchedule = "@every 1h";
+  };
+}
diff --git a/machines/servo/services/nginx.nix b/machines/servo/services/nginx.nix
index 284332d7..b40850dc 100644
--- a/machines/servo/services/nginx.nix
+++ b/machines/servo/services/nginx.nix
@@ -213,6 +213,12 @@
     };
   };
 
+  services.nginx.virtualHosts."music.uninsane.org" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/".proxyPass = "http://127.0.0.1:4533";
+  };
+
   services.nginx.virtualHosts."ipfs.uninsane.org" = {
     # don't default to ssl upgrades, since this may be dnslink'd from a different domain.
     # ideally we'd disable ssl entirely, but some places assume it?