diff --git a/installations/applications/helmfile.yaml b/installations/applications/helmfile.yaml
index 917602c..0b2bd51 100644
--- a/installations/applications/helmfile.yaml
+++ b/installations/applications/helmfile.yaml
@@ -99,6 +99,7 @@ releases:
     version: 0.1.0
     inherit:
       - template: default-env-values
+      - template: ext-traefik-middleware
   - name: grafana
     chart: grafana/grafana
     namespace: applications
diff --git a/values/badhouseplants/values.navidrome.yaml b/values/badhouseplants/values.navidrome.yaml
index 01b1a12..4eb5439 100644
--- a/values/badhouseplants/values.navidrome.yaml
+++ b/values/badhouseplants/values.navidrome.yaml
@@ -1,16 +1,23 @@
----
+middleware:
+  enabled: true
+  middlewares:
+    - name: navidromeauth
+      spec:
+        headers:
+          customRequestHeaders:
+            Remote-User: "guest"
 shortcuts:
   hostname: music.badhouseplants.net
 ingress:
   main:
     annotations:
+      traefik.ingress.kubernetes.io/router.middlewares: applications-navidromeauth@kubernetescrd
       kubernetes.io/ingress.class: traefik
       kubernetes.io/tls-acme: "true"
       kubernetes.io/ingress.allow-http: "false"
       kubernetes.io/ingress.global-static-ip-name: ""
       cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
       traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-
 env:
   main:
     enabled: true
@@ -19,9 +26,16 @@ env:
     data:
       ND_MUSICFOLDER: /app/music
       ND_DATAFOLDER: /app/data
-      ND_LOGLEVEL: info      
+      ND_LOGLEVEL: info
       ND_BASEURL: 'https://{{ .Values.shortcuts.hostname }}'
-
+      ND_REVERSEPROXYUSERHEADER: "Remote-User"
+      ND_REVERSEPROXYWHITELIST: "0.0.0.0/0"
+      ND_LASTFM_ENABLED: false
+      ND_LISTENBRAINZ_ENABLED: false
+      ND_ENABLEUSEREDITING: false
+      ND_ENABLEFAVOURITES: false
+      ND_ENABLESTARRATING: false
+      ND_ENABLEEXTERNALSERVICES: false
 files:
   rclone-config:
     enabled: true