SubMusic (the app)

Applications
1

Submusic is a subsonic native client for Sailfish os. It currently supports these servers:

  • Navidrome ( tested on 0.57 and later )
  • Nextcloud
  • Bandcamp
  • Funkwhale ( tested on 2.0.11 ) - Thanks @pysen

And these features:

  • List basic elements like songs, albums, artists, genres and playlists
  • Play songs, shuffle them, create local ( in memory ) playlist
  • Search for songs, starred songs
  • Star songs, unstar songs, check song details
  • Support for mpris ( lockscreen and system wide ) playback
  • History of songs
  • Cover page
  • Scrobble ( ā€œNow listeningā€ )
  • Settings page with options to modify ui and logic
  • Support for multiple servers and multiple user accounts per servers
  • Support for official and unofficial downloading songs
  • Support for basic server controls like ā€œScan libraryā€ requests
  • Song lyrics
  • Shares
  • Bookmarks
  • Playlists
  • 5 star rating system
  • Transcodding

This application is written by a person, who does not utilize much of subsonic outside listening to random list of songs. Expect other features to come a little slower and if you want some feature or found a bug, please do report it here.

All version of this app at the time of writing ( 1.0 is the latest one ) are compiled for sailfish os 5.0.0.62 and should both support newer and older releases of sailfish os. This might change in the future.

Issues:
This app is not regularly updated and I do not keep any ā€œproperā€ list of issues. Feel free to post your issues in this tread.

  • Bandcamp does not support full api of subsonic. As far as I remember, they do not support /search2 queries = Subsonic , which at this point is an older api. If you want to use this app with bandcamp, keep /search3 ( Subsonic ) option enabled. There are also issues with images, but tip on the login page explains what is not working.
  • Ui is not polished and it might not be so intuitive.
  • Ux might be confusing.

Disclaimers:

  • I am not a cpp developer, so please keep in mind that this app will not be good quality, nor have the most optimized code
  • Since version 0.8.2 ( included ), Iā€™ve been using llm to help me write this application. I am not vibe coding it, but I am using it to help me write parts of code faster. If time allows, Iā€™ll make a proper rewrite in the future.
  • This application has support for saving buffered audio to the files. This option allows to bypass restrictions of your music server, when it prevents you from properly downloading songs. Please read TOS of your server. I am not responsible for your actions and any legal issues that might be related to You downloading songs. This options is OFF by default and has to be manually turned on.

This app is tested by me on:

  • Fairphone 5
  • Sony 10 2 ( tested up to 0.13. My phoneā€™s battery decided that it wantde to be a pillow around that time :frowning: )
    Since I do not have any armv7hl nor i486 devices, I cannot test them. Any feedback about those would be appreciated.

IMPORTANT!
If you were using this application before 30.08.2026, I had to rename its package in newer releases. This means that youā€™ll probably see 2 apps installed. Remove older one and use `harbour-submusic ā€“migrate` in terminal to migrate config from older version to newer one. I had to rename my app for harbour store.

Wanna help ?

  • I have weblate server for translations. If you want to help, feel free to translate this app :slight_smile: Making sure you're not a bot!
    Its my first time running email server. If registration email will not come, please ping me here.
  • It would be great to actually find some1 good with ui / ux to help me make this app less confusing. If you want to code it yourself, or generally have graphic design skills, which would allow you to create mockups of the ui, it would help a lot to contribute.
  • If you found a bug / missing feature / missing server support, please report it here. Testing this app is always nice

Links:

Licence: MIT

11 Likes
2

@JulienBlanc yes please, I am absolutely interested! Are you refering to this? Itā€™s GPLv2 so you have every right to fork & publish it.

@ScaleneVirus288 thanks Iā€™ll check it out.

Most subsonic clients have a feature to automatically download songs you listened to for later offline use (or manually); I find that extremely handy and imho all clients should implement it.

3

I could try to do something like that in a future as a settings toggle + add a option to simply download a song instead of playing it. My client is also missing proper filtering + v0.5.1 still has some audio issues. I should move logic related to filtering to c++ backend instead of doing it on the frontend side. Player is trying to play unbuffered songs sometimes. Too many issues to fix, so little timeā€¦

I start new job on April 1th and I wonā€™t be able to work on my app until around April 5th-6th. Fell free to ping me after that,

1 Like
4

ā€œDeleted by authorā€ = I assume that you fixed your issue :slight_smile: ? This app is working for at least 3 people ( me and 2 others that contacted me ). In any case, feel free to ping me if if you any issues.

5

I just tested your app and it works. Yay!

I have to say itā€™s very rudimentary, or maybe I donā€™t know how to add or search for albums etc.? Itā€™s just one long list of songs?

A (small) issue: I entered the URL as ā€¦/app and while that works on my other (Android) app, here it did not. There cannot even be a trailing slash (I checked my server logs, it reports a 405 on //rest/ping.view?u=ā€¦).

And if I can Iā€™d love to help with encrypted password storage. How (securely) is the password being sent over the web?

6

I can enter search terms, or filter the list. I can then add only filtered items to the playlist? Great and minimalistic concept!

It does not seem to work for ā€œadd all from current pageā€ - but it does work for ā€œadd allā€. However, that does not add but replaces the playlist. Hrmph.

And even so, I cannot add an album in its ā€œnaturalā€ order.

The play/pause/next icons are a bit too small, I have to hit them in a very specific way. Fat fingers.

One good thing that works as it should is that it conmtinues playing even when not in focus or when the screen goes to sleep.

I hope you can read this as friendly & constructive. I looked at the repo but I donā€™t think Iā€™ll be able to contribute any actual code.

7

You are right that this is rudimentary. I wanted something working, not perfect. All I do is search for song, play it and sometimes star it.
Pavel joined me ( pavelse here on the forum ) and he wants to make proper ui design. Sadly I donā€™t have time to learn how to do stuff in qml, so I rarely do anything with this. I gave him green light to do anything he wants.

Full list of features is on open-repos. In short: playing songs, creating playlists, starring songs and using scrobble ( mark that song has been listened to ). I have some roadmap, but its really basic: Making sure you're not a bot!.

About url. Code used for communication looks like this
QString urlStr = toQString(baseUrl) + "/rest/ping.view";
So there is no validation for additional slashes at the end etc. You have to provide full url and only url. I can try to add some additional validation in the future. I believe that navidrome uses /app as a internal web ui, where rest api ( /rest ) is used on domain itself.

And if I can Iā€™d love to help with encrypted password storage. How (securely) is the password being sent over the web?

Subsonic requires hashed password + username in url with salt. This app is not that secured. Pavel did some work on latest commits, which recreates salt and hash every req to make it more secured. I have no idea if subsonic supports JWT or something similar, but I have it in the roadmap task.

2 Likes
8
  • Add all to playlist = add all songs from /rest/search2 to playlist. If songs changed between you searched for a songs and pressing this, new songs returned by this api will be added to playlist.
  • Add all to playlist from current page = Create a playlist from pageSize found songs from above api. This is using ā€œpageā€ param to control what songs to add.
  • Add all to playlist in random order = this is using /rest/getRandomSongs. This is depended on how subsonic server returns songs.
  • Add all to playlist from current page in random order = this is 1:1 ā€œAdd all to playlist from current pageā€, but randomizes songs

I believe that all buttons keep first song in the playlist and replace everything else. This is done to not disturb current player. If this is a issue for you, I can create new issue on the roadmap and try to add a toggle in settings.

And even so, I cannot add an album in its ā€œnaturalā€ order.

I download all my songs from yt via yt-dl. This tool does not create albums, thus I have no way of testing those. Pavel is using navidrome and intended. If possible, could you expand this comment ? It will be easier to know what to work on.

The play/pause/next icons are a bit too small, I have to hit them in a very specific way. Fat fingers.

Iā€™ve added new entry in the roadmap to make ui resizable via settings. Not sure when some1 will take it.

I hope you can read this as friendly & constructive. I looked at the repo but I donā€™t think Iā€™ll be able to contribute any actual code.

To be honest with you I was really shocked that this app got +150 downloads in 2-3 weeks of existing. I also got additional person, who cared enough to contribute in places that I lack knowledge ( I learned qml and c++ just to make this app with really limited time ). Sfos community for me is super nice and I am helpful for any contributions that I receive. Doesnā€™t matter if those are new commits, things reported on the forum or messages on PM.

Edit: Typos

1 Like
9

Thanks for explaining. Itā€™s fine; I mostly included this complaint to explain why I deleted my previous post. But it would be good to add some text that explains this, above the entry field.
And Iā€™ve never seen a double slash (//rest/...) causing trouble before, but thatā€™s on Navidromeā€™s side.

I donā€™t really understand but Iā€™ll take your word for it. IMHO itā€™s important to improve this.

Thanks for the detailed explanation. I get it now. I also just discovered that tap-holding, I can add single songs to the playlist. Good.

all buttons keep first song in the playlist and replace everything else

That makes sense but Iā€™m pretty sure I found some inconsistency there. Iā€™ll report back if I can reproduce it.

Well first of all yt-dlp can download albums (or playlists), even create them through splitting tracks by chapters. I also use it extensively.

What I mean is order albums by track number. Right now, the search returns tracks sorted alphabetically by track name. To explain:

Hereā€™s a ls of an album I have downloaded:

01 Like An Animal - The Glove (Blue Sunshine) 20260120.mp3
02 Looking Glass Girl - The Glove (Blue Sunshine) 20260120.mp3
03 Sex-Eye-Make-Up - The Glove (Blue Sunshine) 20260120.mp3
04 Mr. Alphabet Says - The Glove (Blue Sunshine) 20260120.mp3
05 A Blues In Drag - The Glove (Blue Sunshine) 20260120.mp3
06 Punish Me With Kisses - The Glove (Blue Sunshine) 20260120.mp3
07 This Green City - The Glove (Blue Sunshine) 20260120.mp3
08 Orgy - The Glove (Blue Sunshine) 20260120.mp3
09 Perfect Murder - The Glove (Blue Sunshine) 20260120.mp3
10 Relax - The Glove (Blue Sunshine) 20260120.mp3
11 The Man From Nowhere (Original Instrumental Mix) - The Glove (Blue Sunshine) 20260120.mp3
12 Mouth To Mouth (Landray Vocal Mix) - The Glove (Blue Sunshine) 20260120.mp3
13 Punish Me With Kisses (Mike Hedges Mix) - The Glove (Blue Sunshine) 20260120.mp3
14 The Tightrope (Original Instrumental Mix) - The Glove (Blue Sunshine) 20260120.mp3
15 Like An Animal (12ļ¼‚ Club What Clubļ¼Ÿ Mix) - The Glove (Blue Sunshine) 20260120.mp3
16 Like An Animal (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
17 Looking Glass Girl (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
18 Sex-Eye-Make-Up (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
19 Mr. Alphabet Says (Alt RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
20 A Blues In Drag (Alt RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
21 Punish Me With Kisses (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
22 This Green City (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
23 Orgy (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
24 Perfect Murder (Alt RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
25 Relax (Alt RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
26 The Man From Nowhere (Alt Instrumental Mix) - The Glove (Blue Sunshine) 20260120.mp3
27 Mouth To Mouth (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
28 Opened The Box (A Waltz) (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
29 The Tightrope (Almost Time) (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
30 And All Around Us The Mermaids Sang (AKA Torment) (RS Vocal Demo) - The Glove (Blue Sunshine) 20260120.mp3
31 Holiday 80 (Original Instrumental Mix) - The Glove (Blue Sunshine) 20260120.mp3

Letā€™s look at internal tags:

mediainfo 01\ Like\ An\ Animal\ -\ The\ Glove\ \(Blue\ Sunshine\)\ 20260120.mp3
General
Complete name                            : 01 Like An Animal - The Glove (Blue Sunshine) 20260120.mp3
Format                                   : MPEG Audio
File size                                : 4.51 MiB
Duration                                 : 4 min 44 s
Overall bit rate                         : 128 kb/s
Album                                    : Blue Sunshine
Album/Performer                          : The Glove
Track name                               : Like An Animal
Track name/Position                      : 1
Performer                                : The Glove
Genre                                    : rock, dreampop, ethereal, new wave, post-punk, psychedelic, United Kingdom
Recorded date                            : 2026
Writing library                          : LAME3.99r
Cover                                    : Yes
Cover description                        : Album cover
Cover type                               : Cover (front)
Cover MIME                               : image/jpeg
Comment                                  : https://thegloveband.bandcam
purl                                     : https://thegloveband.bandcamp.com/track/like-an-animal
comment                                  : https://thegloveband.bandcamp.com/track/like-an-animal

Note the field ā€œTrack name/Positionā€.* This increases by 1 with every track.

If, in your app, I filter for ā€œthe glove blue sunshineā€ I get this:

Screenshot_20260411_103501_001
Screenshot_20260411_103501_0011080Ɨ2520 441 KB

ā€œAdd current page to playlistā€ adds the tracks in exactly that order.

I think you can see that this is not desirable.

* the naming of any media tags is not very consistent unfortunately. Another song might have used a slightly different tag for the track number.

mediainfo --info-parameters|grep -i track
Track
Track_More
Track/Url
Track/Sort
Track/Position
Track/Position_Total
SubTrack
Original/Track

Once again, thanks to you and @pavelse! The app feels stable, snappy and useful.

10

My 5 cents here.

Speaking about

And if I can Iā€™d love to help with encrypted password storage. How (securely) is the password being sent over the web?

I was thinking about doing something more securely, but the SubSonic API, which is also used by Navidrome, got stuck somewhere in the late 2010s and probably will not be developed anymore, so it is required to deliver an auth token from the plain text password. There is a salt added (since v0.6 ā€“ new one for every request), and the resulting token is MD5 hashed, so even if the request is intercepted, the bad guy will need to use brute force to deliver the password from it.

Additional improvements here are possible, e.g.

- It is also possible to hash the password on the device side with some device-specific salt and store it on a FS in a reversible hashed form. If this hash is stolen, yes, the bad guy will need to spend some time to find the salt and reverse the hash. Voila, we can remove the scary message about plain text from the app, but.

ā€“ All these manipulations make sense assuming that the attackerā€™s goal is to see the password, while for Navidrome, it is not needed ā€“ there is no check on the server side (at least in the current version) that the token has expired or was used before. The bad guy could use the intercepted or stolen token ā€˜as-isā€™ without knowing the password.

ā€“ If the whole device is available for a bad guy, he will be able to restore the plain password using the same means that the application would use

ā€“ I need to check if there is something TPM-like (or rather crypto storage) available, but even if so, because the app needs plain text, having the device in hand, one can also see the plain text.

- Navidrome (and probably SubSonic) can use a better auth mechanism, which means one still uses the same SubSonic auth mechanism (or even no auth) but puts the whole server behind the proxy, which performs authorization with any modern means. Although this would be a significant step forward, in real life, I mostly see people putting everything in the private VPN and calling it a day.

Actually, that part about hashing on the device side is in my to-do list, but not as a security feature (because it is not), but as a part of refactoring, which is, you know, always somewhere around but not the first priority :slight_smile:

Edit: some clarification about on-device hash

Edit2: maybe it makes more sense to store obvuscated password only until reboot. Looks more feasible than inventing TPM where there is no one, and secure enough

1 Like
11

all buttons keep first song in the playlist and replace everything else

That makes sense but Iā€™m pretty sure I found some inconsistency there. Iā€™ll report back if I can reproduce it.

Are you talking about the situation when a single song sticks in the playlist even though there should be more songs there? I faced it once, but it was on a crossroad (like literally), so I had no chance to reproduce it. If you can find the exact steps here, it would be helpful.

Speaking about albums ā€“ I personally like the approach of adding songs from a raw search result, instead of making a client on-phone database for the server database, but I also caught myself some times on ā€œit would be useful to have spotify-like ā€˜go to albumā€™ button hereā€ ā€“ will it cover your use case? This thing is on my personal to-do list and quite high, and for a single album, it would be easier to preserve the track order

1 Like
12

Thanks for the deep explanation. I meant helping with local storage but tbh even that is beyond me. I know practically nothing about Qt/QML.

13

Interesting approach to avoid re-creating the server database. A ā€œthinā€ frontend to the API, I guess.

Anything that allows me to find & add an album to the queue, in its intended order, would be great. I donā€™t use Spotify so Iā€™m not 100% sure what you are refering to but itā€™s a common procedure.

14

Thanks for nothing :smiley:

In a professional setting, I do not face consumer-side devices often, so in my answer, I missed an obvious attack vector, which is ā€˜malicious 3rd party app installed by user.ā€™ This indeed requires better secret handling. Iā€™ll try to come up with the solution in the next version.

About albums: the flow here will be like:

  1. Search for something (artist, album, song name)
  2. From the search result, select a song that belongs to the album you are interested in
  3. From the song line, select ā€˜Go to albumā€™ and be redirected to the album page, where songs are sorted by the track number
  4. From there, add the album fully in the aforementioned order
1 Like
15

Tried to access my nextcloud music, but I got ā€˜Token authentication not supported for LDAP usersā€™ error. Other subsonic players (on android) works on the same credentials.
Edit: reading thread I found that server canā€™t have any path but nextcloud uses https://IP/apps/music/subsonic scheme. Could you please add such url support?

16

The initial issue about URL was caused by the trailing slash, I believe the issue here is different. Honestly, I had no chance to test with Nextcloud, do I understand correctly that this is a ā€˜Musicā€™ plugin? If so, can you please share a version (both plugin and nextcloud) so I can set it up and test?

UPD: internet says, that

the Music app doesnā€™t support the ā€œtoken authenticationā€. The real Subsonic server supports it starting from the API version 1.13.0 unless the LDAP authentication is used. If the client tries to use the token authentication with the Music app, the Music app responds with the same error code as is used by the real Subsonic server + LDAP combo.

Theoretically it is possible to blindly add ā€˜plaintext modeā€™ here (pretending I personally doesnā€™t have an opinion about such a behavior from Nextcloud side :). Iā€™ll play a bit with this during the weekend

17

Yes, Music plugin. My NC version is 33.0.2 and Music - v3.0 (latest greatest).

18

@ohnonot in the version 0.7 I hope there are fixes for some issues discussed previously:

encrypted password storage

now is done using SFOS secrets storage (it is OS-encrypted, so I assume this is the best one can get without being device-specific). The application will ask for permission to use it after installation/update, and the OS will recheck its access rights after device reboot. Any feedback is appreciated, as the set of testing devices is quite limited at the moment

Iā€™m pretty sure I found some inconsistency there. Iā€™ll report back if I can reproduce it.

Work with the playlist was reworked, although it is not finished yet, now it contains only 3 options:

  1. Create a playlist from found (which will create a playlist of the first 500 alphabetically sorted songs if no search term is provided)
  2. Add currently displayed songs to the playlist (w/o clearing existing playlist)
  3. Create a playlist of 500 random songs

Going forward, we expect to return the option ā€˜Add found in random orderā€™ and work with batch sizes, although 500 should be enough for a day of listening, I can fully imagine someone wanting to play all 100500 songs. Iā€™d also expect that the inconsistency issue is fixed, however feedback here would also be appreciated.

(and yes, now it has a clickable cover page)

19

I asked the thread to be split but nobody reacted yet.

I see that playing albums in order isnā€™t a priority for you & @ScaleneVirus288 - thatā€™s OK, I respect that.

20

Additional features in the playlist need more work on the internals, which is on my priority list (to add the mentioned ability to jump to an album, among others), but for now, only existing bugs have been fixed.

I also played with different options to add different sort options here and there, but all of them look somewhat monstrous, so I personally will try that spotify approach first

1 Like