Signed links and multiple CDNs

Castreon can give viewers viewing links that expire and can deliver the same channel through several CDNs at once: the player switches to another CDN by itself if one fails. This is also where you purge the CDNs' cache — by hand, through the API or automatically.

Available from Castreon 1.7.0, in the Enterprise edition. The settings are in Settings → CDN and signed links.

Profiles

Each profile says who checks the link:

• Castreon (the server) — viewers come straight to the server, and Castreon checks the signature. Empty address = the public domain from Settings → Instance.
• Bunny, Gcore, CDN77 — viewers come through the CDN, and the CDN checks the signature, in its official format. Fill in the CDN address (domain only), the Channel path on the CDN (default /live/{slug}/, the CDN pulls from Castreon) and the Signing key given by the CDN. Next to each kind, the panel shows what has to be switched on at the CDN.

Options per profile: Link duration (5 minutes – 7 days) and Bind the link to the viewer's IP (safer, but a phone that moves from Wi-Fi to mobile data loses playback until it gets a new link). Keys are no longer shown after saving; an empty field keeps the current key.

Test requests the playlist of a running channel through the profile, once with a valid link and once with an expired one: the valid link must get the playlist, the expired one must be refused. If the CDN serves the expired link too, the panel tells you that verification is not switched on at the CDN.

How much is verified: the Castreon profile is tested end to end. For Bunny, Gcore and CDN77, the signature is identical to the one produced by each provider's official code (verified in tests), but it has not been tried on a real account — use Test before production. The panel shows this next to each profile.

The link for a viewer

• On the channel page, Signed link: choose the profile (and, optionally, the viewer's IP) → Create link.
• From your own apps: POST /api/v1/channels/{id}/playback-url, one link per viewer (API key with the playback:sign scope).

Require a signed link on /live stops unsigned links to the server. Requests without a signature then pass only from the addresses in Stream access — put the CDNs and load balancers that pull from the server there first. HTTP-TS, LL-HLS and WebRTC do not have signed links yet.

The server clock must be correct (NTP): the link expiry is calculated from it.

Several CDNs: Content Steering

With at least two profiles switched on, Signed link has the All (Content Steering) option: a single link for all CDNs, following the HLS Content Steering standard. Castreon checks each CDN every 30 seconds, on a running channel: it answers, it gets the playlist, it does not fall behind with the segments. After 3 failed checks, the CDN is marked down and moved to the end of the list; after 3 successful ones it comes back. Players that understand Content Steering switch to the next CDN by themselves, without stopping playback (tried with hls.js 1.6); other players use the first CDN in the list.

• The order of the profiles (the arrows) is the priority. The cdn: "auto" link from the API picks the first CDN that works.
• Each CDN's status, with its success rate over 24 hours, appears next to the profile. Under Notifications, the CDNs family announces a CDN that is down.
• /metrics has castreon_cdn_up and castreon_cdn_latency_seconds.

The check runs from the server, not from the viewers' networks: a CDN that works from the server can still have a problem in a particular country.

Purging the cache

For purging, the profile needs the Zone / resource ID and an API key for purging from the CDN (optional).

• Purge everything on the profile — the zone's whole cache, with confirmation.
• Purge the CDN cache on the channel page (administrators) — only the channel's directory.
• API: POST /api/v1/cdn/purge with channel, paths (at most 10) or all. Every purge goes into Audit, without keys.
• Own purge webhook — for any other CDN or a script: Castreon sends a JSON POST (event: "cdn.purge", the paths, the channel, the reason) signed with X-Castreon-Signature: sha256=HMAC-SHA256(secret, body).

Automatic purge (on by default): every time a channel starts and when it is deleted, Castreon purges the channel's directory on every CDN with purging configured and notifies the webhook. The reason: on every start, the new segments have the same names as the earlier ones, and a CDN that still holds them would give viewers old pieces. At most one purge per channel every 30 seconds; if the CDN asks for a pause (rate limit), Castreon waits and retries. The last automatic purge and its result appear in the settings.

Purging uses each CDN's official APIs (following their documentation); it has not been tried on real accounts.

Common problems

• The test says the CDN serves the expired link: signature verification is not switched on at the CDN (see the text next to the profile's kind).
• Segments get 403, the playlist does not: on Gcore, the setting that forwards the parameters from the playlist to the segments is missing.
• The CDN is “down” with “old playlist”: the CDN keeps the playlist in cache too long — playlists must follow the server's header (no-cache).
• The purge says the API key is wrong: the key is not valid or has no right to purge. The zone / resource does not exist at the CDN: the zone / resource ID is wrong.
• The CDN purge limit was reached: the CDN accepts only a few purges per minute — the panel says in how many seconds you can try again.