diff --git a/hosts/glyph/secrets/navidrome-env.age b/hosts/glyph/secrets/navidrome-env.age
new file mode 100644
index 00000000..e9b16742
--- /dev/null
+++ b/hosts/glyph/secrets/navidrome-env.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 rSr+rA G59mwm0s8J7IjOdA3bg+u7/khONss0qNTenWOIUGVGQ
+0DDeAzt5iLOTRsH35ajUZdEhXb2wKcDpurDrLIxWAf4
+-> ssh-ed25519 3EWhnQ UeouypZwC0npSNaIvPTVcEHBRFzeY8Fto/lQRKtBRBw
+qe9nYlHYVxIiHZgs9WNmn+N675R5+g5ureimnW3v8ss
+--- XesUDgqqbDcNT0jR4VhXhHHp0RzP6GiQBjiiE5/sF0w
+A8�!A`���%�:c�s%Tͦ��ZC%��3;ί�}#è����4�˺�N�^&��k�"/�q���Ӟ3�T�$�$��|�#u�P�+\�MB��=�4	�{�����(��5��c.��:��c;��3@�
\ No newline at end of file
diff --git a/hosts/glyph/services/default.nix b/hosts/glyph/services/default.nix
index f7ca4f8e..468d631a 100644
--- a/hosts/glyph/services/default.nix
+++ b/hosts/glyph/services/default.nix
@@ -13,6 +13,7 @@
     ./filebrowser.nix
     ./jellyfin.nix
     ./loki.nix
+    ./navidrome.nix
     ./nfs.nix
     ./ntfy.nix
     ./open-terminal.nix
diff --git a/hosts/glyph/services/navidrome.nix b/hosts/glyph/services/navidrome.nix
new file mode 100644
index 00000000..9c520aa1
--- /dev/null
+++ b/hosts/glyph/services/navidrome.nix
@@ -0,0 +1,21 @@
+{config, ...}: {
+  age.secrets.navidrome-env = {
+    file = ./../secrets/navidrome-env.age;
+    mode = "440";
+    owner = config.services.navidrome.user;
+    group = config.services.navidrome.group;
+  };
+
+  services.navidrome = {
+    enable = true;
+    openFirewall = true;
+    group = "media";
+    environmentFile = config.age.secrets.navidrome-env.path;
+    settings = {
+      Address = "0.0.0.0";
+      MusicFolder = "/mnt/media/Music";
+      Scanner.Schedule = "@every 1h";
+      RecentlyAddedByModTime = true;
+    };
+  };
+}
diff --git a/lib/secrets/glyph.nix b/lib/secrets/glyph.nix
index 0105ddfd..d28ea350 100644
--- a/lib/secrets/glyph.nix
+++ b/lib/secrets/glyph.nix
@@ -13,4 +13,5 @@ in {
   "hosts/glyph/secrets/attic-credentials.age".publicKeys = keys;
   "hosts/glyph/secrets/user-password.age".publicKeys = keys;
   "hosts/glyph/secrets/obsidian-auth-token.age".publicKeys = keys;
+  "hosts/glyph/secrets/navidrome-env.age".publicKeys = keys;
 }