Every codec, every rung,
never upscaled.

ViewCasta is a 20-service streaming platform written in pure Rust (66,326 lines, AGPL-3.0) that operators deploy white-label for VOD and CDN-as-a-Service, with live TV groundwork (EPG, XMLTV parsing) on the roadmap. It ships the pipeline as one product: tus resumable ingest, smart ABR transcoding that never upscales, AES-128 encrypted HLS delivery, origin and ISP edge CDN, multi-tenant catalog, subscriber and profile management, an ad server, subscriber-count operator billing, and a ScyllaDB-backed analytics tier. The live demo runs at plexbd.com.

Yes. ViewCasta is HLS-first: the streamer generates HLS manifests with signed key URLs injected from the key server and renditions filtered by subscription tier, so a basic-plan subscriber never sees the 4K rung. Segments are encrypted with AES-128 through FFmpeg's HLS key pipeline, and the web portal plays back through hls.js. Delivery is HLS-only.

Yes. ViewCasta ships as a single Cargo workspace with a production Docker Compose deployment and a Docker Swarm stack. Operators can run the full 20-service stack in their own data centre or as a managed tenant in a shared deployment. The CDN edge specifically is designed to live inside an ISP POP: an axum-based re-streamer with GeoDNS routing and NATS heartbeats, never phoning home to a central origin for cache hits.

The platform is horizontally scalable at every plane. The gateway is stateless behind a load balancer, the catalog and subscriber services scale per CPU, the streamer is bandwidth-bound and runs N replicas behind the edge tier, and the edge tier itself scales by adding cdn-edge nodes inside ISP POPs. The transcoder is the only intentionally rate-limited service: a tokio::Semaphore bounds concurrent FFmpeg jobs (default 2, production tuned to 1 on 4GB memory boxes) to avoid OOM under unbounded ingest bursts.

Yes. The transcoder detects available hardware encoder backends (NVENC, QSV, VAAPI, and VideoToolbox) and orchestrates FFmpeg as a bounded child process for H.264 and H.265 output. The ABR ladder it builds never upscales: smart_abr_ladder(codec, width, height) keeps only the rungs at or below the source resolution, and sources below 720p get a single rung at source resolution. Audio is 128 kbps on every rung.

Yes. The portal at web/portal ships a Next.js 16 player built on hls.js, with profiles (including kids mode with maturity ratings and per-profile language), continue watching, watch history, favorites, genre browse, and person and filmography pages driven from TMDB enrichment. The same portal runs operator-branded for white-label tenants, and native app codebases exist for Android, Android TV, iOS, and Apple TV with platform players (ExoPlayer/media3 and AVPlayer).

Postgres uses row-level isolation with a tenant_id column on every table, enforced inside the plexbd-db crate. ScyllaDB uses shared tables with tenant-prefixed partition keys (not per-tenant keyspaces) to keep operational complexity flat. The Tenant service owns tenant lifecycle; the gateway resolves the tenant from the Wenme JWT and pushes it into the request context for every downstream gRPC call.

The cdn-edge crate is an axum-based re-streamer that an ISP installs inside its POP. cdn-dns answers subscriber DNS queries with the nearest healthy edge. Hot segments are served from the edge cache; cold segments are fetched from cdn-origin with request coalescing, so a thundering herd collapses into a single origin pull. Edges report health back over NATS heartbeats. The model is three-entity (Edge Host, Platform Tenant, CDN Customer); an edge serves every CDN customer simultaneously, not just the tenant that hosts it.

AES-128 token-protected delivery ships today through the key server: per-content keys, signed key URLs injected into every manifest, and entitlement and session checks before a key is released. Content protection is a pluggable trait, with AES-128 as the default implementation and multi-DRM (Widevine, FairPlay, PlayReady) on the roadmap. For most operators, token-protected AES-128 plus tier-filtered manifests is enough to start.