Rent the elastic tier. Own the expensive one.Rent the elastic tier. Own the expensive one.

Control hostnames and media hostnames are disjoint, and that separation is enforced in DNS rather than in application code. The catalogue and sign-in APIs resolve to the AWS tier. Playlist and segment hostnames resolve to edge nodes. No response from the control plane ever contains a URL that points back at AWS for a media object, including as a redirect.

The redirect case is the one worth stating outright, because it is the usual way a hybrid design quietly stops being hybrid. A 302 issued by AWS for every segment is not a rounding error at streaming volumes: it is one extra request on the critical path for each of the thousands of segments a session consumes, it makes the control plane a hard dependency of playback, and it puts a rented service in a path you moved specifically to stop renting. So the token, not a redirect, carries the routing decision.

Segment authorisation is verified offline. The control plane signs a short-lived playback token with a private key; each edge node holds only the corresponding public key and validates locally. There is no per-segment call to AWS, no shared session store to reach across the boundary, and no cache of authorisation decisions that can go stale in an interesting way. The token is the entitlement, it is checked where the bytes are, and it expires on its own.

The consequence is worth being explicit about rather than discovering later: a viewer holding a valid token keeps watching whether or not AWS is reachable. That is a property of where verification happens, not a failover feature bolted on afterwards.

Telemetry is the one payload that travels inward, and it does not travel the way it was produced. Player beacons are posted to a collector running on the same edge node that served the segments — same hostname family, same TLS termination, no cross-boundary hop at beacon time. The collector batches, drops obvious duplicates, and writes to the observability plane on the Proxmox side.

Per-session rows stay there. What crosses into the control plane is rolled up: series by channel, by zone, by device class and by time bucket, which is what an operator dashboard actually renders. The raw events are high-cardinality and enormous; the aggregates are small and boring, and small and boring is the correct shape for anything crossing a metered boundary.

There is a second reason beyond cost, and in an incident it is the more important one. If beacons were posted to the rented tier, then the moment that tier became unreachable you would lose the measurements describing the outage — precisely the window you will be asked about afterwards. Collecting locally means the record of a control-plane failure survives the control-plane failure.

Retention follows the same split. Full-resolution events are kept on owned storage for as long as the disk budget allows, because keeping them costs nothing per query. Aggregates are what get shipped, and they are what the admin interface reads.

Placement follows workload shape, not preference. Encoding is steady, saturating and predictable: it runs at close to full utilisation for as long as there is a catalogue to process, which is the exact profile that is expensive to rent by the minute and cheap to own outright. A GPU bought once and kept busy has no meter attached to it.

Origin storage is the other half of that argument, and it is worse than it first looks, because storage and egress are billed as a pair. A library grows monotonically and is read constantly by the edge tier. Rented, both halves grow together and neither one ever goes down. Owned, the read is free and the growth is a purchase decision made once a year.

The control tier has the opposite shape. Catalogue lookups and sign-ins are small, spiky, and far more sensitive to availability than to unit cost. That tier genuinely benefits from what a public cloud sells — managed Postgres, multiple availability zones, someone else's on-call rota for the database — and its bill stays small because none of the bytes that matter pass through it.

Proxmox is what makes the owned side operable rather than merely cheap: clustered hosts, live migration for maintenance without a viewer-visible window, and local storage sitting next to the encoders instead of across a network. It is the part of the estate that behaves like infrastructure rather than like a set of servers.

The cost of all this is two estates, and it is a real cost. It is only acceptable because both are declared in one Terraform root with two providers and shipped by one pipeline. If they were two workflows, the saving would go straight back out as operational overhead.