AudioMuse-AI: new service

[jackspiering]

Description

Adds AudioMuse-AI, which analyzes the audio of a music library and builds similar-song lists and playlists for Navidrome, Jellyfin, Emby, Lyrion, and Plex.

• Stack: tailscale sidecar, application (web interface), worker (analysis and clustering jobs), and db (PostgreSQL 15). All containers share the network of the sidecar.
• Why a sidecar: the image ships no tailscale or tailscaled (checked with which), and upstream documents no Tailscale mode.
• Upstream is maintained (not archived, release v3.6.3 on 2026-09-26, commits today). The image is the one upstream publishes, ghcr.io/neptunehub/audiomuse-ai.
• Based on upstream's deployment/docker-compose.yaml and docs. Deviations are listed in the service README: the localhost-only database (upstream publishes 5432), PostgreSQL 15 (upstream states other versions can cause errors), bind mounts instead of named volumes, /app/backup mapped, and an exact image tag (upstream recommends it).

Related Issues

• Closes 🏗️ New Service: AudioMuse-AI #316

Verification

• docker compose config --quiet from services/audiomuse-ai, with a dummy value for POSTGRES_PASSWORD
• The stack started, Tailscale is healthy, and the service is reachable through the Tailnet. Serve was tested from inside the namespace: the root redirects to /setup, and the setup, login (form post), an authenticated page, and the backup create call all worked through Serve.
• The main function works and its data survives a restart. A scratch Navidrome with six generated tracks was connected in the wizard. The analysis finished with 6 tracks analyzed, and after docker compose down and up -d the 6 rows were still in the database and login worked. A backup created in the web interface landed in ./audiomuse-ai-data/app/backup.
• rumdl check --config .markdownlint.yml . (rumdl 0.2.78, the pinned version, from the local binary) and git diff --check origin/main
• All four containers report healthy, with each health command run with docker exec (wget --spider on /api/health, pgrep -f on the queue worker, pg_isready -h 127.0.0.1). /api/health also answers without a login after authentication is enabled.
• Not tested: the Navidrome and Jellyfin plugins, other media servers than Navidrome, and AVX2-less or ARM hosts. The LAN ports block was not tested through the stack as shipped (it is commented out); the scratch copy published 127.0.0.1:8000 for part of the test, and a second run without it used only Serve.

Impact on existing users

• None.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I did not commit a working auth key, password, token, or other credential.
• The service README uses the headings of the template, in the same order, and is up to date.
• I added, removed, or renamed the service in the root README.md, in alphabetical order, or this PR does not change the list of services.

Additional Context

• The image is about 7 GB (amd64) and needs a CPU with AVX2 or an ARM CPU, and 8 GB of RAM, according to upstream.
• The worker has no HTTP endpoint and the image defines no HEALTHCHECK, so its check looks for the queue worker process with a fixed pgrep -f pattern.
• Flask and worker mount separate temp and plugins folders, as upstream does with separate volumes.