diff --git a/hosts/koi/configuration.nix b/hosts/koi/configuration.nix
index 1ae1db2..e20b9fe 100755
--- a/hosts/koi/configuration.nix
+++ b/hosts/koi/configuration.nix
@@ -26,6 +26,7 @@
     ./containers/verdaccio
     ./containers/sharkey
     ./containers/pds
+    ./containers/navidrome
     ./containers/zond
     ./containers/bots/pcre-sub-bot.nix
     ./vms/hass.nix
diff --git a/hosts/koi/containers/navidrome/default.nix b/hosts/koi/containers/navidrome/default.nix
new file mode 100644
index 0000000..ebafe5e
--- /dev/null
+++ b/hosts/koi/containers/navidrome/default.nix
@@ -0,0 +1,53 @@
+{ abs, config, ... } @ inputs:
+
+let 
+  secrets = import (abs "lib/secrets.nix");
+
+  UID = 1102;
+in {
+  imports = [
+    (secrets.declare [{
+      name = "navidrome-env";
+      owner = "navidrome";
+    }])
+  ];
+
+  users.groups.navidrome = {};
+  users.users.navidrome = {
+    isNormalUser = true;
+    uid = UID;
+  };
+
+  virtualisation.oci-containers.containers.navidrome = {
+    image = "deluan/navidrome:0.52.5@sha256:b154aebe8b33bae82c500ad0a3eb743e31da54c3bfb4e7cc3054b9a919b685c7";
+    volumes = [
+      "${./navidrome.toml}:/navidrome.toml"
+      "/mnt/puffer/Downloads/music:/music:ro"
+      "/mnt/puffer/navidrome:/data"
+    ];
+    environment = {
+      ND_CONFIGFILE = "/navidrome.toml";
+    };
+    environmentFiles = [
+      (secrets.file config "navidrome-env")
+    ];
+    user = builtins.toString UID;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /mnt/puffer/navidrome 0755 navidrome navidrome  -"
+  ];
+
+  services.nginx.virtualHosts."navi.stupid.fish" = {
+    forceSSL = true;
+    useACMEHost = "stupid.fish";
+
+    locations."/" = {
+      proxyPass = "http://navidrome.docker:4533/";
+
+      extraConfig = ''
+        proxy_buffering off;
+      '';
+    };
+  };
+}
\ No newline at end of file
diff --git a/hosts/koi/containers/navidrome/navidrome.toml b/hosts/koi/containers/navidrome/navidrome.toml
new file mode 100644
index 0000000..98ebd9f
--- /dev/null
+++ b/hosts/koi/containers/navidrome/navidrome.toml
@@ -0,0 +1,17 @@
+LogLevel = 'DEBUG'
+ScanSchedule = '@every 24h'
+TranscodingCacheSize = '150MiB'
+BaseUrl = 'https://navi.stupid.fish'
+
+EnableSharing = true
+EnableTranscodingConfig = true
+
+UILoginBackgroundUrl = 'https://upload.wikimedia.org/wikipedia/en/9/9a/Trollface_non-free.png' # idk why lol
+UIWelcomeMessage = 'mrrp meow!'
+
+# values sourced from secret env:
+# ND_LASTFM_APIKEY=
+# ND_LASTFM_SECRET=
+# ND_PASSWORDENCRYPTIONKEY=
+# ND_SPOTIFY_ID=
+# ND_SPOTIFY_SECRET=
\ No newline at end of file
diff --git a/hosts/koi/containers/puffer.nix b/hosts/koi/containers/puffer.nix
index 511c72d..747801f 100644
--- a/hosts/koi/containers/puffer.nix
+++ b/hosts/koi/containers/puffer.nix
@@ -125,9 +125,11 @@ let
     };
 
     folders.Public.path = "/mnt/puffer/Public";
+    folders.Downloads.path = "/mnt/puffer/Downloads";
 
     usersFolders = [
       { username = "guest"; folder = "Public"; }
+      { username = "guest"; folder = "Downloads"; }
     ];
   };
 
diff --git a/secrets/navidrome-env.age b/secrets/navidrome-env.age
new file mode 100644
index 0000000..eea33fa
Binary files /dev/null and b/secrets/navidrome-env.age differ