Every codec, every codec rung,
one Rust workspace.

ViewCasta is a 19-service streaming platform written in pure Rust (114,503 lines, AGPL-3.0) that operators can deploy as VOD, live TV, or CDN-as-a-Service. It ships the entire pipeline as one product: ingest, smart ABR transcoding, packaging, origin and ISP edge CDN, AES-128 protection, multi-tenant catalog, subscriber and profile management, server-side ad insertion, and an analytics tier built on ScyllaDB. ViewCasta is the publicly branded name for the codebase that has lived as PlexBD internally.

Yes. The streamer service serves HLS manifests today at /hls/{content_id}/master.m3u8 with per-rung playlists (4k, 1080p, 720p, 480p) and segment URLs proxied through the gateway media route. CMAF packaging for DASH parity rides through the same packager. The portal player uses hls.js with auth headers stripped for /api/media/ paths so segments cache cleanly through the edge.

Yes. ViewCasta ships as a Cargo workspace and a Docker Compose deployment (migrating to Kubernetes). Operators can run the full 19-service stack in their own data centre or as a managed SaaS tenant. The CDN edge specifically is designed to live inside an ISP POP, Pingora-backed re-streaming, GeoDNS routing, per-edge analytics, without ever phoning home to a central origin for cache hits.

The platform is horizontally scalable at every plane. The gateway is stateless behind a load balancer, the catalog and subscriber services scale per CPU, the streamer is bandwidth-bound and runs N replicas behind the edge tier, and the edge tier itself scales by adding cdn-edge nodes inside ISP POPs. The transcoder is the only intentionally rate-limited service: a tokio::Semaphore bounds concurrent FFmpeg jobs (default 2, production tuned to 1 on 4GB memory boxes) to avoid OOM under unbounded ingest bursts.

Yes. The portal at web/portal ships a Next.js 16 player with hls.js, hero ABR autoplay, hover preview clips, multi-bitrate switching, Netflix-style profile selector (5 per user, kids mode), continue-watching with red progress bar and per-card remove, watch history, and a Person/Filmography graph driven from TMDB enrichment. The same portal runs operator-branded for white-label tenants.

Postgres uses row-level isolation with a tenant_id column on every table, enforced inside the plexbd-db crate. ScyllaDB uses shared tables with tenant-prefixed partition keys (not per-tenant keyspaces) to keep operational complexity flat. The Tenant service owns tenant lifecycle; the gateway resolves the tenant from the Wenme JWT and pushes it into the request context for every downstream gRPC call.

The cdn-edge crate is a Pingora-based re-streamer that an ISP installs inside its POP. cdn-dns answers subscriber DNS queries with the nearest healthy edge IP. Hot segments are served from the LRU cache in cdn-core; cold segments are fetched from cdn-origin once and pinned. cdn-analytics emits per-edge cache hit ratio and bandwidth back to cdn-api. The model is three-entity (Edge Host, Platform Tenant, CDN Customer); an edge serves every CDN customer simultaneously, not just the tenant that hosts it.

AES-128 token-protected delivery ships today through the keyserver service: per-content keys, signed manifest tokens, and short-lived session tokens validated at the streamer. Multi-DRM (Widevine, FairPlay, PlayReady) is wired into the catalog model and the gateway routes; the DRM gateway adapters are on the post-launch roadmap. For most operators, token-protected AES-128 plus signed URLs and device limits is enough to start.