From 76f63f0ae32f888bf4d942c3822fd498f8956a1e Mon Sep 17 00:00:00 2001
From: DannyDannyDanny <dth@taiga.ai>
Date: Mon, 6 Apr 2026 15:36:07 +0200
Subject: [PATCH] =?UTF-8?q?fix(sunken-ship):=20move=20navidrome=20music=20?=
 =?UTF-8?q?folder=20to=20/srv/music=20=E2=80=94=20ProtectHome=20bypass=20?=
 =?UTF-8?q?=F0=9F=8E=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nixos/hosts/sunken-ship.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/nixos/hosts/sunken-ship.nix b/nixos/hosts/sunken-ship.nix
index 1eaed4a..5b18a80 100644
--- a/nixos/hosts/sunken-ship.nix
+++ b/nixos/hosts/sunken-ship.nix
@@ -80,17 +80,22 @@ in
   };
 
   # Navidrome — self-hosted music streaming server (Subsonic API).
-  # Music library: /home/danny/music
+  # Music library: /srv/music (bind-mounted from /home/danny/music).
   # Web UI + Substreamer client on port 4533.
   services.navidrome = {
     enable = true;
     settings = {
       Address = "0.0.0.0";
       Port = 4533;
-      MusicFolder = "/home/danny/music";
+      MusicFolder = "/srv/music";
     };
   };
-  users.users.navidrome.extraGroups = [ "users" ];
+
+  # Persist the bind mount so navidrome can read music outside ProtectHome.
+  fileSystems."/srv/music" = {
+    device = "/home/danny/music";
+    options = [ "bind" "ro" ];
+  };
 
   # UxPlay AirPlay receiver — audio-only, outputs directly to Scarlett Solo via ALSA.
   # Runs as a system service (no PipeWire needed on a headless server).