A self-hosted video + CDN + storage + edge platform you run yourself.
It ingests video, transcodes to an adaptive HLS ladder, extracts thumbnails & storyboards, generates word-level transcripts, and serves signed playback — all behind a project-scoped REST API.
// Mux / Cloudflare Stream / Bunny.net-class — on your own hardware.
$ curl -X POST https://api.ollanode.com/v1/videos \ -H "Authorization: Bearer $OLLA_KEY" \ -d '{"title":"launch.mp4"}' // 201 Created { "id": "vid_8Kd2Qa7Rn0", "status": "created", "master_url": "…/hls/master.m3u8?token=…" }
One REST API for the whole stack — no per-minute billing, no vendor origin.
One upload. A full pipeline.
All long-running work is async and runs in workers, never in request handlers.
// NATS JetStream by default; Temporal optional via TEMPORAL_ENABLED=true — both engines share the same activity implementation.
Everything, behind one project-scoped REST API.
Twelve product surfaces — video, delivery, storage, DNS, edge, and governance — from a single self-hosted control plane.
Video
Adaptive HLS ladder (360p→4K, no upscaling), H.264 plus optional H.265/NVENC, progressive MP4 + audio-only MP3, sub-clips, and optional AES-128 HLS encryption.
Playback
Signed, expiring tokens over a private origin (bytes never served direct), cookie-scoped CDN-cacheable segments, and an embeddable Vidstack player.
Thumbnails & transcripts
Poster + sampled frames + storyboard sprite/WebVTT; word-level WhisperX transcripts (VTT/SRT), optional diarization, manual chapters, and AI title/description/tags/chapters.
CDN
Multi-tenant pull zones on an OpenResty edge: per-zone TTL/CORS/edge rules, hotlink token signing, full + path-granular purge, live traffic analytics.
Storage
S3-style storage zones with presigned upload + a signed on-the-fly image optimizer (resize / format / quality via imgproxy).
DNS
Authoritative DNS server (Hickory) serving zones/records (A/AAAA/CNAME/TXT/MX/NS) from Postgres on :53.
Edge functions
Deploy JS/TS functions, executed at the edge in V8 isolates.
Webhooks
HMAC-signed delivery with exponential-backoff retries + dead-letter.
Accounts & access
Self-serve signup, roles (owner/admin/member/viewer), true per-project tenant isolation, fine-grained resource:action scopes.
AI-agent model
Agents work API-first with approval-gated destructive/code actions, a /v1/whoami capability map, tamper-evident hash-chain audit, and a kill-switch.
Security
Coraza + OWASP CRS WAF in front of the API, origin guard, idempotency keys, rate limiting, request-id correlation.
Orchestration
Clean architecture + DDD: the domain core has no IO, adapters implement ports. NATS JetStream, or Temporal when TEMPORAL_ENABLED=true.
Playback the origin never leaks.
Bytes are never served direct — the playback-service proxies and rewrites every HLS URI through itself, so your origin stays private.
A CDN, object store, DNS and edge runtime — yours.
The same control plane that ingests video also runs the network that delivers it.
CDN pull zones
Multi-tenant pull zones on OpenResty, routed by Host. Full purge bumps a cache version; the next request is a MISS again, then HIT.
Storage + image optimizer
S3-style zones with presigned upload and a signed on-the-fly optimizer via imgproxy — resize, format, quality.
Authoritative DNS
Hickory serves your zones and records (A/AAAA/CNAME/TXT/MX/NS) straight from Postgres.
Edge functions
Deploy JS/TS and run it at the edge in a V8 isolate — no cold container, no server to manage.
Agent-native — with guardrails.
Agents are API-first citizens. Destructive and code actions don't just run — they route through a human, once.
Clean architecture. Your hardware.
A Cargo workspace built in Rust (Axum): 11 library crates and 9 independently-deployable services. The domain core has no IO; adapters implement ports.
Permissive OSS only — no AGPL. Licensed Apache-2.0. Provision ≥ 8 vCPU / 16–32 GB RAM (GPU recommended for WhisperX / NVENC), then make deploy-up.
What it is — and what it isn't.
The honest edges, from our capability source-of-truth.
Is there live streaming?
No — it's a VOD pipeline only. There's no live / RTMP ingest.
HLS or DASH?
HLS today. Segments are already CMAF/fMP4 (DASH-ready packaging); a DASH manifest is the remaining piece.
How does pricing work?
It's self-hosted software you run on your own hardware. There's no billing system and no metered plans — the cost is your infrastructure.
What's off by default?
AI metadata, speaker diarization, H.265/NVENC, loudness normalization and the SVT-AV1 tier are all real but config/hardware-gated and off by default.
How is it licensed?
Apache-2.0, with permissive-OSS-only dependencies (no AGPL) — SeaweedFS, imgproxy, tusd, Coraza, Hickory, Vidstack.
Where's the API described?
Machine-readable at GET /openapi.json (OpenAPI 3.1), with MCP for agents.
Run your own video stack.
Bring up the infra, migrate, and run the gateway — then create a project and upload a video.