diff --git a/projects/music/project.yaml b/projects/music/project.yaml
new file mode 100644
index 00000000..f34b1e06
--- /dev/null
+++ b/projects/music/project.yaml
@@ -0,0 +1,9 @@
+config:
+  desc: Music Streaming
+
+apps:
+  - name: navidrome
+    repo: bjw-s
+    chart: app-template
+    targetRevision: 1.5.1
+
diff --git a/projects/music/values/navidrome.yaml b/projects/music/values/navidrome.yaml
new file mode 100644
index 00000000..346e1b86
--- /dev/null
+++ b/projects/music/values/navidrome.yaml
@@ -0,0 +1,68 @@
+image:
+  repository: ghcr.io/navidrome/navidrome
+  tag: 0.49.3
+
+env:
+  TZ: "Europe/Amsterdam"
+  ND_DATAFOLDER: /config
+  ND_LOGLEVEL: info
+  ND_MUSICFOLDER: /music
+  ND_PORT: 8080
+  #ND_REVERSEPROXYUSERHEADER: "Remote-User"
+  ND_REVERSEPROXYWHITELIST: "0.0.0.0/0"
+  #ND_SCANSCHEDULE: "@every 1h"
+  ND_SESSIONTIMEOUT: 24h
+  ND_LISTENBRAINZ_ENABLED: "false"
+  ND_LASTFM_ENABLED: "false"
+  ND_PROMETHEUS_ENABLED: "false"
+  ND_ENABLEGRAVATAR: "false"
+
+service:
+  main:
+    ports:
+      http:
+        port: 8080
+
+ingress:
+  main:
+    enabled: true
+    ingressClassName: "ingress-internal"
+    annotations:
+      cert-manager.io/cluster-issuer: vault-issuer
+      traefik.ingress.kubernetes.io/router.tls: 'true'
+    hosts:
+    - host: music.dc
+      paths:
+      - path: /
+        pathType: Prefix
+    tls:
+    - secretName: music-tls
+      hosts:
+      - music.dc
+
+
+podSecurityContext:
+  runAsUser: 568
+  runAsGroup: 568
+  fsGroup: 568
+  fsGroupChangePolicy: "OnRootMismatch"
+  supplementalGroups:
+    - 100
+
+persistence:
+  config:
+    enabled: true
+    
+  music:
+    enabled: true
+    type: hostPath
+    hostPath: /data/media/music
+    mountPath: /music
+    readOnly: true
+
+resources:
+  requests:
+    cpu: 10m
+    memory: 50Mi
+  limits:
+    memory: 750Mi