DroppedNeedle is a self-hosted music request and discovery app with a native library and download engine. This page covers what it does; the Native Engine page covers how the download and import pipeline works internally.

Search and requests

Search the full MusicBrainz catalogue by artist or album. Request a whole album or an individual track. Requests are queued and tracked on a dedicated page with retry and cancel support.

Role-based request handling:

Downloads the engine can’t confidently auto-accept land in a held-import review queue. An admin previews the audio, then accepts or rejects it and can supply a MusicBrainz ID before the file moves into the library. If a download finishes in your download client but DroppedNeedle can’t locate the file, you can trigger a manual reimport from the Downloads page to finish the job.

Native library and download engine

DroppedNeedle replaces Lidarr entirely with a built-in engine. No Lidarr installation, no coexistence, no toggle. The engine:

• Scans your music library and identifies files through a four-tier strategy (MBID tags, fuzzy text match, AcoustID fingerprint, manual review)
• Drives downloads through your own slskd, through Usenet via SABnzbd and Newznab indexers, or both. DroppedNeedle itself has no Soulseek protocol code and never joins the P2P network.
• Scores and ranks candidates before picking one to download
• Verifies downloaded files (tag readability, duration tolerance, optional fingerprint match)
• Imports good files atomically into the library; quarantines known-bad sources
• Writes MusicBrainz tags and applies a configurable naming template on import

When both download sources are enabled, a source-priority setting decides which one is tried first; either way, every download runs through the same scoring, verification, and import. See slskd Setup, Usenet Setup, and Native Engine for the full detail.

Wanted

Requests that fail or come back incomplete are re-searched by a background watcher on an age-based cadence. When it finds a verified match, the download imports on its own. The Wanted tab lists everything the watcher is tracking; you can stop or resume individual watches and mark new finds as seen.

Quality and storage

Set a quality floor per format (FLAC, MP3, AAC, and others) under Settings > Download Client, and anything below the cutoff is rejected. When a better copy of an album you already own turns up, the engine replaces the old files and moves the originals to a recycle bin.

A global storage cap and per-user quotas stop the library filling the disk. Album edition pinning locks a request to a particular release: the engine fills missing tracks from that edition and upgrades files as better copies surface. An optional background scan re-checks your library against available sources and imports improvements.

Built-in player

The player supports multiple playback sources per track and can mix them in a single queue.

Playback sources

Jellyfin: transcoded audio streaming. Codec (AAC, MP3, FLAC, Opus, Vorbis, ALAC, WAV, WMA) and bitrate (32 to 320 kbps) are configurable. Playback start, progress, and stop events are reported back to Jellyfin.

Navidrome: streaming via the Subsonic API.

Plex: direct-play audio streaming from Plex Media Server, proxied so your Plex token never reaches the browser. Supports multi-library setups. Native Plex scrobbling is included and can be toggled.

Local files: served directly from the mounted music directory inside the container, without transcoding.

YouTube: inline playback for albums you haven’t downloaded yet. Links can be auto-generated with a YouTube API key or added manually. Treat it as a preview source, not a primary one; reliability depends on the embedded player.

Player controls

Queue management, shuffle, seek, volume control, and a 10-band equalizer with presets. What you’re playing broadcasts live over SSE, so other signed-in users see your current track in real time.

Connect apps

Third-party music apps can play your library straight from DroppedNeedle, which speaks both the OpenSubsonic and Jellyfin APIs. This is the inbound counterpart to the Jellyfin, Navidrome, and Plex sources: those let DroppedNeedle play from another server, while Connect Apps lets other apps play from DroppedNeedle.

Turn on either protocol in Settings > Connect Apps, then create an app-password: a separate, revocable secret per app, so your account password stays private. In the client, enter your server URL with /subsonic or /jellyfin on the end (for example https://music.example.com/jellyfin), your username, and the app-password. Each user manages their own.

Tested with Symfonium, Feishin, and Amperfy over Subsonic, and with Finamp, Jellify, Manet, and Symfonium’s Jellyfin mode over Jellyfin. When a client requests a codec the file is not already in, DroppedNeedle transcodes on the fly if transcoding is enabled; otherwise it sends the original file.

Discovery and recommendations

The home page surfaces trending artists, popular albums, recently added, genre quick-links, weekly ListenBrainz exploration playlists, and “Because You Listened To” carousels personalised to your listening history.

The Discover page adds a recommendation queue drawn from similar artists, library gaps, fresh releases, global charts, and your patterns across ListenBrainz and Last.fm. Each album expands to show the full tracklist and artwork before you request or skip it, and floating preview buttons stream a short Deezer or iTunes clip without leaving the page. You can also browse by genre and view trending and popular charts across different time ranges.

Discovery rows that require listening history stay hidden until you link ListenBrainz or Last.fm. Link one and your own recommendations fill in.

A per-user weekly mix is built from your listening history and refreshed in the background. With auto-request enabled (it needs a standing admin grant), up to five missing albums from the mix are queued for download automatically.

Following artists

Follow an artist to watch for new releases, with the option to auto-download them the moment they appear (standard users need a one-time admin grant per artist). Sidebar badges count the releases and gigs you haven’t seen yet, backed by per-user seen markers that clear when you open the page. The Following hub is a single digest: a 30-day release log with in-library ticks, your next gigs, and your artist roster, each a click from its full page.

Upcoming events

Connect Ticketmaster and Skiddle (both free API keys) and DroppedNeedle shows concerts near you. Each user picks as many cities as they like from a geocoded search, each with its own radius. A daily sweep pulls upcoming shows for the artists people follow, or optionally for every artist in the library, and a sidebar badge counts the gigs you haven’t seen yet.

Library management

Browse the native library by artist or album, with search, filtering, sorting, and pagination. View recently added albums and library statistics. From the UI you can resolve unmatched files in the manual-review queue, edit tags, rescan albums, and remove albums. Jellyfin, Navidrome, Plex, and local-file sources each get their own library view with play, shuffle, and queue actions.

Scrobbling

Per-user scrobbling to ListenBrainz and Last.fm. Each user links their own accounts from their profile and toggles each service independently. A “now playing” update goes out when a track starts; a scrobble is submitted when it finishes. Plays are also saved to a local listening history inside DroppedNeedle, which feeds the Recently Played row.

Setting up Last.fm requires one admin step (register an app at last.fm/api/account/create to get an API key and shared secret) and then each user authorises their own account. ListenBrainz needs only a user token from listenbrainz.org/profile.

Playlists

Create playlists from any mix of sources: Jellyfin, Navidrome, Plex, local files, YouTube, and imported Spotify tracks in the same list. Drag to reorder, set custom cover art, and play everything through the same player.

Import playlists straight from Spotify. Track metadata and album art come across on import, and the playlist stays live with periodic refreshes, so tracks you add on Spotify show up automatically.

Playlists are private by default. Toggle one to public and it appears read-only for every signed-in user under “Shared with you”. Admins can see that a private playlist exists (track count, owner) but not its name or tracks.

Multi-user authentication

DroppedNeedle is a multi-user application. Every account has one of three roles (Admin, Trusted, User) that controls request handling and admin access.

Login methods

• Username and password (case-insensitive usernames; email optional)
• Jellyfin login
• Plex login
• Any OIDC-compatible provider (Authelia, Keycloak, Authentik, and so on)

Every login method is toggled from the web UI; no environment variables needed. Users who sign in via OIDC for the first time get an account automatically, assigned the User role, and an admin can promote them.

User import

Instead of creating accounts by hand, an admin can import existing users from Jellyfin or Plex. Imported users start with the User role and sign in using their original Jellyfin or Plex credentials.

Sessions

Sessions last 30 days from login and are not extended by activity. Deleting a user ends all of that user’s sessions.

Security

HIBP password breach checking: new passwords are checked against the Have I Been Pwned database using the k-anonymity API (only the first 5 SHA-1 hash characters are transmitted). On by default. Can be disabled, or pointed at a local offline copy of the HIBP hash file for air-gapped installs.

HSTS: optional Strict-Transport-Security header for HTTPS deployments.

API keys: stored encrypted, masked on settings reads, never written to logs.

REST API

Swagger UI at /api/v1/docs. OpenAPI spec at /api/v1/openapi.json. Health check at /health. Auth via Bearer token or droppedneedle_session cookie. See API Reference for endpoint documentation.

Single Docker container

Everything above runs in one image: ghcr.io/habirabbu/droppedneedle:latest. No sidecar processes. fpcalc and AcoustID fingerprinting are bundled via libchromaprint-tools. Configuration lives in a mapped volume and is managed from the web UI.

License

AGPL-3.0. Author: Harvey Bragg.