add navidrome and music share

RUNBOOK.md

@@ -128,6 +128,12 @@ for u in yireh isaac; do
     chmod 2770 "/opt/argento/smb/$u"
 done
 
+# Shared music dir. Lives inside the media dataset (so it rides the media
+# snapshot policy) but is exported as its own writable [music] share.
+# setgid so files dropped in over SMB inherit sambagroup and stay readable
+# by the Navidrome container.
+install -d -o timothykim -g sambagroup -m 2775 /opt/argento/smb/media/Music
+
 # SELinux contexts for samba — fresh ZFS datasets get unlabeled_t and samba
 # refuses to serve them. Persistent rules (semanage) survive full relabels;
 # restorecon applies them now.
@@ -232,7 +238,8 @@ docker compose up -d
 # Issue certs (add any new domains that have been added since this was written)
 /opt/argento/scripts/issue-cert.sh \
     nextcloud.timothykim.net git.timothykim.net jellyfin.timothykim.net \
-    argento.timothykim.net garage.timothykim.net photos.thekims.family
+    argento.timothykim.net garage.timothykim.net photos.thekims.family \
+    music.thekims.family
 
 # Restore SSL confs now that certs exist
 mv conf.d/.hold/*.conf conf.d/
@@ -258,7 +265,7 @@ Deploy each app (nginx is already running and will return 502 until they start):
 
 ```bash
 # Add any new apps that have been added since this was written
-for app in nextcloud gitea jellyfin garage minecraft immich beszel-agent; do
+for app in nextcloud gitea jellyfin navidrome garage minecraft immich beszel-agent; do
     cd /opt/argento/docker/$app
     docker compose pull
     docker compose build
@@ -291,6 +298,7 @@ CNAME records pointing to the DDNS hostname. These don't need updating when the
 | `garage.timothykim.net` | CNAME | `argento.ddns.net` |
 | `minecraft.thekims.family` | CNAME | `argento.ddns.net` |
 | `photos.thekims.family` | CNAME | `argento.ddns.net` |
+| `music.thekims.family` | CNAME | `argento.ddns.net` |
 
 ## 14. Verify
 
@@ -301,6 +309,7 @@ curl -I https://jellyfin.timothykim.net
 curl -I https://argento.timothykim.net
 curl -I https://garage.timothykim.net
 curl -I https://photos.thekims.family
+curl -I https://music.thekims.family
 curl -I http://minecraft.thekims.family
 
 # Verify SMART, ZFS, and disk space are healthy