diff --git a/compose.yaml b/compose.yaml
index 76a2867402d0d01835e8bd2a8898b90d3b0a0370..ae48160196b83237e47a411b9e8c78afe2a6bd4f 100755
--- a/compose.yaml
+++ b/compose.yaml
@@ -242,7 +242,7 @@ services:
       net.paperclover.list.access: media
     depends_on:
       keycloak:
-        condition: service_healthy
+        condition: service_started
   navidrome: # port 4533
     container_name: navidrome
     image: deluan/navidrome:latest
@@ -252,14 +252,19 @@ services:
       - "${APP_ROOT}/navidrone:/data:rw"
       - "${MEDIA_ROOT}/music:/music:ro"
     environment:
-      - ND_SCANNER_GROUPALBUMRELEASES=1
-      - ND_BASEURL=https://nd.${HOME_DOMAIN}/
-      - ND_PID_ALBUM=folder
+      ND_SCANNER_GROUPALBUMRELEASES: "1"
+      ND_BASEURL: "https://music.${HOME_DOMAIN}/"
+      ND_PID_ALBUM: "folder"
+      ND_EXTAUTH_TRUSTEDSOURCES: "0.0.0.0/0" # troll
+      ND_PORT: "80"
     labels:
       net.paperclover.list.name: Navidrome Music
       net.paperclover.list.domain: nd
       net.paperclover.list.priority: 109
       net.paperclover.list.access: media
+    depends_on:
+      forward-auth:
+        condition: service_started
   # media aquisition
   qbittorrent: # webui on port 23938
     platform: linux/amd64 # not available for aarch64
diff --git a/config/Caddyfile b/config/Caddyfile
index f14578dcfcae18d5aa07020b4a479d2795b4d54b..6f414842dae07ef6584c18cd8c603edb64af0a38 100644
--- a/config/Caddyfile
+++ b/config/Caddyfile
@@ -101,7 +101,51 @@ import ./jellyfin/Caddyfile
 # 	}
 # }
 music.{$HOME_DOMAIN} {
-	reverse_proxy "http://navidrome:4533"
+	handle_path /app/sw.js {
+    header Content-Type "application/javascript"
+		respond "// sw disabled" 200
+	}
+
+	handle /snow.oauth2/* {
+		reverse_proxy "http://forward-auth" {
+			header_up X-Real-IP {remote_host}
+			header_up X-Forwarded-Uri {uri}
+		}
+	}
+
+  @protected not path /share/* /rest/* /snow.oauth2/* /app/sw.js
+  forward_auth @protected "http://forward-auth" {
+    uri /snow.oauth2/auth
+    header_up X-Real-IP {remote_host}
+    copy_headers X-Auth-Request-Preferred-Username>Remote-User
+    @error status 401
+    handle_response @error {
+      redir * /snow.oauth2/sign_in?rd={scheme}://{host}{uri}
+    }
+  }
+
+  @subsonic path /rest/*
+  forward_auth @subsonic "http://forward-auth" {
+    uri /snow.oauth2/auth
+    header_up X-Real-IP {remote_host}
+    copy_headers X-Auth-Request-Preferred-Username>Remote-User
+
+    # Some clients that claim to support basicauth still expect a subsonic
+    # response in case of authentication failure instead of a proper basicauth
+    # response.
+    @error status 1xx 3xx 4xx 5xx
+    handle_response @error {
+      respond <<SUBSONICERR
+        <subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="proxy-auth" serverVersion="n/a" openSubsonic="true">
+          <error code="40" message="Invalid credentials or unsupported client"></error>
+        </subsonic-response>
+        SUBSONICERR 200
+    }
+  }
+
+  handle {
+    reverse_proxy "http://navidrome"
+  }
 } 
 # opencode.{$HOME_DOMAIN} {
 # 	import auth