diff --git a/modules/services/navidrome/default.nix b/modules/services/navidrome/default.nix
new file mode 100644
index 0000000..902672c
--- /dev/null
+++ b/modules/services/navidrome/default.nix
@@ -0,0 +1,67 @@
+# A FLOSS self-hosted, subsonic compatible music server
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.my.services.navidrome;
+  domain = config.networking.domain;
+in
+{
+  options.my.services.navidrome = with lib; {
+    enable = mkEnableOption "Navidrome Music Server";
+
+    settings = mkOption {
+      type = (pkgs.formats.json { }).type;
+      default = { };
+      example = {
+        "LastFM.ApiKey" = "MYKEY";
+        "LastFM.Secret" = "MYSECRET";
+        "Spotify.ID" = "MYKEY";
+        "Spotify.Secret" = "MYSECRET";
+      };
+      description = ''
+        Additional settings.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 4533;
+      example = 8080;
+      description = "Internal port for webui";
+    };
+
+    musicFolder = mkOption {
+      type = types.str;
+      example = "/mnt/music/";
+      description = "Music folder";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.navidrome = {
+      enable = true;
+
+      settings = cfg.settings // {
+        Port = cfg.port;
+        Address = "127.0.0.1"; # Behind reverse proxy, so only loopback
+        MusicFolder = cfg.musicFolder;
+        LogLevel = "info";
+      };
+    };
+
+    my.services.nginx.virtualHosts = [
+      {
+        subdomain = "music";
+        inherit (cfg) port;
+      }
+    ];
+
+    webapps.apps.navidrome = {
+      dashboard = {
+        name = "Navidrome";
+        category = "media";
+        icon = "music";
+        link = "https://music.${domain}/app/#/login";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/webapps/navidrome.nix b/nixos/modules/webapps/navidrome.nix
deleted file mode 100644
index 5188cac..0000000
--- a/nixos/modules/webapps/navidrome.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ config, pkgs, ... }:
-{
-  services.navidrome = {
-    enable = true;
-    settings = {
-      Address = "0.0.0.0";
-      MusicFolder = "/srv/data/music";
-    };
-  };
-  networking.firewall.allowedTCPPorts = [ 4533 ];
-
-  systemd.services.navidrome = {
-    after = [ "network-online.target" ];
-    #unitConfig.RequiresMountsFor = [ "/storage" ];
-  };
-
-  webapps.apps.navidrome = {
-    dashboard = {
-      name = "Navidrome";
-      category = "media";
-      icon = "music";
-      link = "https://music.buehler.rocks";
-    };
-  };
-}