Groups, not a subscriber list
Entitlement follows your directory — departments, cohorts, roles — instead of a payment record, and it is enforced at the edge on every segment.
Private video, behind your own perimeter
Training material, internal briefings, lecture capture and recorded assessments. The volume is modest and the access rules are not — which is the opposite of a consumer service, and the reason consumer platforms fit this badly.
Who this is for
Organisations where the question is not how many people watch, but which people are allowed to, and where the recording is not permitted to leave the perimeter.
- Enterprise network operators
- Internal video behind an existing identity provider, with access decided by group membership rather than by subscription.
- Education institutions
- Lecture capture and course material with retention and deletion governed by policy rather than by a vendor's defaults.
- Regulated organisations
- Bodies whose data policy requires recordings and access logs to stay on infrastructure they control.
Here, access control is the product
A consumer streaming platform assumes almost everyone may watch almost everything, and spends its engineering on delivering at scale. An internal platform inverts that: the audience is small, the catalogue is sensitive, and the interesting question is who may see which item, for how long, and who is able to prove it afterwards.
Running it on your own infrastructure is not primarily a cost decision here. It is that the recordings never leave your perimeter, the viewing data never reaches a third party, and retention is something you enforce rather than something you request.
What a private deployment has to get right
The recording never leaves
Origin, encoding and delivery inside your perimeter. No copy on a vendor's storage, no viewing telemetry leaving to a third-party analytics account.
Deletion that actually happens
Lifecycle rules declared in code, so a retention policy is enforced by the system rather than depending on somebody remembering.
Right-sized, not consumer-sized
A few thousand viewers does not need a consumer-scale estate. The same platform deploys small, and grows the same way if it needs to.
Everything inside the perimeter
The full on-premises pattern, deployed at a smaller size.
Untrusted — the public internet
- Web player
- Mobile apps
- TV apps
- Contribution
TLS terminates here and nowhere else
- traefik-edge
- CrowdSec
- Live path
- VOD path
Reachable only through the edge, or through the bastion for operators
- app-core
- content-api
- search-api
- session-authz
- billing
- key-delivery
- recommendation
- bastion
A match-night surge cannot evict the back catalogue
- live-transcode
- live-origin
- vod-transcode + GPU
- vod-origin-cache
- upload-api
- job-scheduler
- RabbitMQ
- MinIO
State lives inside the perimeter
- MariaDB
- Redis
- Elasticsearch
- ClickHouse
- Redpanda
- OpenBao
Declared entirely in code — the estate rebuilds from the repository
- Proxmox VE
- Terraform
- Ansible
- Pipeline → registry
- Prometheus
- SigNoz
- Grafana
- Loki
The things internal teams ask first
Can it authenticate against our existing directory?
Yes. Your directory stays authoritative for identity and group membership; the platform consumes it rather than maintaining a parallel user list.
Is this overkill for a few hundred viewers?
The estate is sized to you. What does not shrink is the access control and the containment, and those are usually the reason an internal platform exists at all.
Can we prove who watched what?
Per-session telemetry and access logs stay in your own estate, which is what makes an audit answerable rather than a support ticket to a vendor.
What does the access policy have to say?
Group structure, retention obligations and where the data is allowed to live. Those three answers determine the architecture more than the viewer count does.