v0.1.0-2 changelog

.env.example

@@ -1,3 +1,3 @@
 NAVIDROME_MUSIC_FOLDER="/opt/navidrome/music"
-BIND_ADDRESS="192.168.2.24"
+BIND_ADDRESS="0.0.0.0"
 BIND_PORT="5001"

.gitignore

@@ -3,3 +3,5 @@ setup.sh
 navidrome-upload.service
 .idea/
 .env
+/README.md
+__pycache__/

contrib/navidrome-uploader.service

@@ -0,0 +1,47 @@
+[Unit]
+Description=Navidrome Music Uploader Service
+After=network.target,navidrome.service
+
+[Service]
+Type=simple
+User=navidrome-uploader
+Group=navidrome-uploader
+WorkingDirectory=/opt/navidrome-uploader
+Environment="PATH=/opt/navidrome-uploader/venv/bin"
+EnvironmentFile=/etc/default/navidrome-uploader/.env
+ExecStart=/opt/navidrome-uploader/venv/bin/gunicorn --no-control-socket -c gunicorn.conf.py main:app
+Restart=on-failure
+RestartSec=30
+
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/opt/navidrome-uploader /opt/navidrome/music
+InaccessiblePaths=/boot /mnt /media
+
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+PrivateNetwork=no
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+UMask=0027
+
+
+[Install]
+WantedBy=multi-user.target

debian/changelog

@@ -0,0 +1,18 @@
+navidrome-uploader (0.1.0-2) unstable; urgency=high
+
+  * Run pip install stage as navidrome-uploader user instead of root
+
+ -- Arian Nasr <arian@2ari.ca>  Tue, 14 Apr 2026 12:11:00 -0400
+
+navidrome-uploader (0.1.0-1) unstable; urgency=medium
+
+  * Disable gunicorn control socket in systemd service unit
+
+ -- Arian Nasr <arian@2ari.ca>  Thu, 09 Apr 2026 01:58:00 -0400
+
+navidrome-uploader (0.1.0) unstable; urgency=medium
+
+  * Add Debian packaging with systemd service integration and venv setup.
+
+ -- Arian Nasr <arian@2ari.ca>  Tue, 07 Apr 2026 12:00:00 +0000
+

debian/control

@@ -0,0 +1,12 @@
+Source: navidrome-uploader
+Section: web
+Priority: optional
+Maintainer: Arian Nasr <arian@2ari.ca>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.7.0
+Rules-Requires-Root: no
+
+Package: navidrome-uploader
+Architecture: all
+Depends: ${misc:Depends}, adduser, python3, python3-venv
+Description: Navidrome Web Upload Utility

debian/navidrome-uploader.dirs

@@ -0,0 +1,7 @@
+opt/navidrome-uploader
+opt/navidrome-uploader/templates
+opt/navidrome-uploader/static
+opt/navidrome-uploader/static/css
+opt/navidrome-uploader/static/js
+etc/default/navidrome-uploader
+

debian/navidrome-uploader.install

@@ -0,0 +1,9 @@
+main.py opt/navidrome-uploader/
+gunicorn.conf.py opt/navidrome-uploader/
+requirements.txt opt/navidrome-uploader/
+.env.example opt/navidrome-uploader/
+templates/* opt/navidrome-uploader/templates/
+static/css/* opt/navidrome-uploader/static/css/
+static/js/* opt/navidrome-uploader/static/js/
+contrib/navidrome-uploader.service lib/systemd/system/
+

debian/navidrome-uploader.postinst

@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+APP_DIR="/opt/navidrome-uploader"
+VENV_DIR="${APP_DIR}/venv"
+APP_USER="navidrome-uploader"
+
+case "$1" in
+  configure)
+    chown -R "$APP_USER:$APP_USER" "$APP_DIR"
+
+    runuser -u "$APP_USER" -- python3 -m venv "$VENV_DIR"
+    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir --upgrade pip
+    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir -r "$APP_DIR/requirements.txt"
+
+    if command -v systemctl >/dev/null 2>&1; then
+      systemctl daemon-reload || true
+      systemctl enable navidrome-uploader.service || true
+      systemctl restart navidrome-uploader.service || true
+    fi
+    ;;
+esac
+
+exit 0
+
+

debian/navidrome-uploader.postrm

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+if command -v systemctl > /dev/null 2>&1; then
+    systemctl daemon-reload || true
+fi
+
+if [ "$1" = "purge" ]; then
+    rm -rf /etc/default/navidrome-uploader
+    rm -rf /opt/navidrome-uploader/venv
+fi
+
+exit 0
+

debian/navidrome-uploader.preinst

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -e
+
+if ! getent passwd navidrome-uploader > /dev/null 2>&1; then
+    printf "Creating navidrome-uploader user\n"
+    useradd --system --shell /usr/sbin/nologin --user-group navidrome-uploader
+fi
+
+exit 0
+

debian/navidrome-uploader.prerm

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    remove|deconfigure)
+        if command -v systemctl > /dev/null 2>&1; then
+            systemctl stop navidrome-uploader.service || true
+            systemctl disable navidrome-uploader.service || true
+        fi
+        ;;
+esac
+
+exit 0
+

debian/rules

@@ -0,0 +1,10 @@
+#!/usr/bin/make -f
+
+%:
+	dh $@
+
+override_dh_install:
+	dh_install
+	install -d debian/navidrome-uploader/etc/default/navidrome-uploader
+	install -m 0640 .env.example debian/navidrome-uploader/etc/default/navidrome-uploader/.env
+

debian/source/format

@@ -0,0 +1,2 @@
+3.0 (native)
+

gunicorn.conf.py

@@ -0,0 +1,16 @@
+# gunicorn.conf.py
+# Arian Nasr
+# April 4, 2026
+
+import os
+
+
+BIND_ADDRESS = os.environ.get('BIND_ADDRESS', '0.0.0.0')
+BIND_PORT = int(os.environ.get('BIND_PORT', 5001))
+
+bind = f"{BIND_ADDRESS}:{BIND_PORT}"
+workers = 2
+accesslog = "-" # Log to stdout
+errorlog = "-"  # Log to stderr
+
+# gunicorn -c gunicorn.conf.py main:app

main.py

@@ -7,8 +7,6 @@ from flask import Flask, request, render_template
 from werkzeug.utils import secure_filename
 
 UPLOAD_FOLDER = os.environ.get('NAVIDROME_MUSIC_FOLDER', '/opt/navidrome/music')
-BIND_ADDRESS = os.environ.get('BIND_ADDRESS', '0.0.0.0')
-BIND_PORT = int(os.environ.get('BIND_PORT', 5001))
 ALLOWED_EXTENSIONS = {'flac', 'mp3', 'wav'}
 
 app = Flask(__name__)
@@ -35,7 +33,3 @@ def upload_file():
         return render_template('success.html', success_message=f'{len(request.files)} file(s) uploaded successfully!'), 200
 
     return render_template('index.html'), 200
-
-
-if __name__ == '__main__':
-    app.run(host=BIND_ADDRESS, port=BIND_PORT, debug=False)

release/build-deb.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+PROJECT_ROOT="$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${PROJECT_ROOT}"
+dpkg-buildpackage -us -uc -b
+

requirements.txt

@@ -1,7 +1,8 @@
 blinker==1.9.0
-click==8.3.1
+click==8.3.2
 Flask==3.1.3
 itsdangerous==2.2.0
 Jinja2==3.1.6
 MarkupSafe==3.0.3
-Werkzeug==3.1.7
+Werkzeug==3.1.8
+gunicorn==25.3.0