diff --git a/components/network/tinc/private.nix b/components/network/tinc/private.nix
index e364418..80391c4 100644
--- a/components/network/tinc/private.nix
+++ b/components/network/tinc/private.nix
@@ -28,6 +28,7 @@ let
     "photoprism.orbi" = hosts.orbi;
     # chungus
     "video.chungus" = hosts.chungus;
+    "music.chungus" = hosts.chungus;
     "de.tts.chungus" = hosts.chungus;
     "en.tts.chungus" = hosts.chungus;
     "flix.chungus" = hosts.chungus;
diff --git a/machines/chungus/media-navidrome.nix b/machines/chungus/media-navidrome.nix
index 68f5639..5fd290e 100644
--- a/machines/chungus/media-navidrome.nix
+++ b/machines/chungus/media-navidrome.nix
@@ -22,4 +22,24 @@
     settings.MusicFolder = "/media/arr/lidarr";
   };
 
+  services.nginx = {
+    enable = true;
+    virtualHosts."music.${config.networking.hostName}.private" = {
+      serverAliases = [
+        "music.${config.networking.hostName}.wg0"
+        "music.ingolf-wagner.de"
+      ];
+      locations."/" = {
+        recommendedProxySettings = true;
+        proxyWebsockets = true;
+        proxyPass = "http://localhost:${toString config.services.navidrome.settings.Port}";
+        extraConfig = ''
+          allow ${config.tinc.private.subnet};
+          allow ${config.wireguard.wg0.subnet};
+          deny all;
+        '';
+      };
+    };
+  };
+
 }