baton-server

baton-server

Docker app from Crazyteddy00's Repository

Overview

Baton is a self-hosted music server with its own apps. This is the server, and the container most people install: it scans your music folder, streams it to the Baton apps, and keeps users, favourites, play counts and playlists in its own database. Live sync between your devices is built in. The other two Baton containers are optional. baton-worker downloads the music people ask for with Want in the app; install it only if you want that, and it connects to this server's Worker port (4534, under Show more settings). baton-sync is only for people who keep Navidrome as their music server instead; never install it next to this one. Before the first start, fill in the Secret key and the first admin name and password. The Android app needs HTTPS (the desktop apps accept http:// on your LAN, but unencrypted), so put a reverse proxy or tunnel with HTTPS in front of the Web port, at an address of its own such as https://music.example.com/. It must pass WebSocket upgrades through for live sync. The WebUI link opens the /download page, where your devices can get the apps. You don't need to create or chown any folders. On start the container creates App data, hands it (and the Download inbox) to PUID:PGID, 99:100 by default, and then runs as that user. It never changes the owner of your music.

Categories

Media App > Music

Related apps

Explore more like this

Explore all
Music apps

Links

Projectgitlab.comSupportgitlab.comRegistrygitlab.comTemplateraw.githubusercontent.com

Details

Repository
registry.gitlab.com/crazyteddy00/baton/baton-server:latest
Registry
https://gitlab.com/Crazyteddy00/baton/container_registry
Last Updated2026-11-06
First Seen2026-11-06

Runtime arguments

Web UI
http://[IP]:[PORT:8080]/download
Network
bridge
Privileged
false

Template configuration

Web portPorttcp

The port on this server that the Baton apps and your reverse proxy connect to. Default 8080. Change it if another app already uses 8080, and point your proxy at the new port.

Target
8080
Default
8080
Value
8080
Worker portPorttcp

The port the optional baton-worker container uses to reach this server. Default 4534. It is only needed if you run baton-worker; otherwise leave it as it is. Change it only if another app already uses 4534. If you change the host side, change the worker's Server address to match. It carries download jobs and files, protected by the Download worker token. Keep it on your LAN: never forward it to the internet and never put it behind your reverse proxy.

Target
4534
Default
4534
Value
4534
MusicPathrw

Your music folder. Read-write (the default) lets Library health fix tags and move removed duplicates into a .baton-trash folder, where they can be restored for 30 days, and lets Want add downloaded music. Set it to read-only if Baton must never change your files. Baton never changes who owns them.

Target
/music
Default
/mnt/user/data/media/music
Value
/mnt/user/data/media/music
App dataPathrw

Baton's own data: the database with users, favourites, play counts and playlists, plus artwork and the transcode cache. Back this folder up together with your Secret key. The container creates it if it is missing.

Target
/data
Default
/mnt/user/appdata/baton-server
Value
/mnt/user/appdata/baton-server
Secret keyVariable

Required, no default. Encrypts the passwords Baton stores. Make one in the Unraid terminal with: openssl rand -base64 32. Keep a copy somewhere safe. Set it once and never change it: with a different key the server will not start, and a lost key means resetting every password.

Target
BATON_SECRET_KEY
First admin nameVariable

One-time setting: the name of the admin account created on the very first start. A new install will not start without it. After that it is ignored, so it can stay or be cleared.

Target
BATON_ADMIN_USER
First admin passwordVariable

One-time setting: the password for that first admin account, used only on the very first start. A new install will not start without it, together with the name. Clear it once the server has started; it is not read again.

Target
BATON_ADMIN_PASSWORD
Download inboxPathrw

Only used with baton-worker: the folder where the worker leaves finished downloads for this server to check and file into your music. Use the same folder in baton-worker, and keep it outside your music folder. Without the worker it stays empty and can be left as it is.

Target
/inbox
Default
/mnt/user/data/media/inbox
Value
/mnt/user/data/media/inbox
Download worker tokenVariable

Turns on Want: downloading music with the baton-worker container. Empty (the default) leaves it off. To use it, make a token with: openssl rand -base64 32. Set the same value in baton-worker, which reaches this server on the Worker port. Keep Music read-write and keep the Download inbox.

Target
BATON_WORKER_TOKEN
AcoustID keyVariable

Optional, empty by default. A free application key from acoustid.org. With it, Library health can match your files to MusicBrainz by how they sound, and Want can check that a download is the right song. Without it, downloads are checked by length and search match only.

Target
BATON_ACOUSTID_KEY
First scan scheduleVariable

One-time setting, read only on the first start. After that, change the schedule in the app under Settings → Server → Jobs. Empty (the default) means a daily scan at 04:00 while Watch for new music is on, and an hourly scan while it is off. Set an interval such as 60m (every 60 minutes; 5m to 168h) for a fixed schedule, or 0 for no scheduled scans.

Target
BATON_SCAN_INTERVAL
Watch for new musicVariable

on or off. Default on: Baton notices new or changed files in your music folder and scans them about 45 seconds after they stop changing. Set it to off if your music is on a network share that doesn't report changes; scheduled scans then pick them up.

Target
BATON_WATCH
Default
on
Value
on
Skip during scanVariable

Folders or files the library scan skips, as patterns relative to your music folder, separated by commas. Example: incoming,*.tmp. Empty (the default) scans everything.

Target
BATON_SCAN_IGNORE
Transcode cache size (MB)Variable

How much space, in MB, converted streams may take up in App data. Default 2048; when it is full, the oldest go first. Raise it if many people stream converted audio. 0 means no limit.

Target
BATON_TRANSCODE_CACHE_MB
Default
2048
Value
2048
App updates sourceVariable

Where the server gets new versions of the Baton apps, to offer them to your devices and on the /download page (the WebUI link). Default Crazyteddy00/baton, the official project on GitLab. Leave it as it is, or clear it to turn app updates and the download page off.

Target
BATON_RELEASES_PROJECT
Default
Crazyteddy00/baton
Value
Crazyteddy00/baton
Music folder inside the containerVariable

Where Music is mounted inside the container. It also makes this image run as the full Baton server. Leave it as /music.

Target
BATON_LIBRARY_PATH
Default
/music
Value
/music
Inbox inside the containerVariable

Where the Download inbox is mounted inside the container. Leave it as /inbox.

Target
BATON_INBOX_PATH
Default
/inbox
Value
/inbox
User ID (PUID)Variable

The user Baton runs as and that owns the files it writes. Default 99, Unraid's nobody. Must match the other Baton container (baton-worker), if you run it, so both can use the Download inbox. Change it only if your shares belong to a different user.

Target
PUID
Default
99
Value
99
Group ID (PGID)Variable

The group Baton runs as and that owns the files it writes. Default 100, Unraid's users. Must match the other Baton container (baton-worker), if you run it, so both can use the Download inbox. Change it only if your shares belong to a different group.

Target
PGID
Default
100
Value
100
Permission mask (UMASK)Variable

Optional. Removes permissions from new files, as an octal number such as 002. Empty (the default) leaves Docker's usual 022. It only affects files created without fixed permissions, and it never makes the folders Baton creates group-writable. Leave it empty unless you know you need it.

Target
UMASK