Scale
From one box to a fleet.
A one-person instance on a box that costs about $63 a month and a replica fleet behind a load balancer run the same Vidra — the same image, one variable apart.
Validated at two api replicas and three workers; designed for more; not yet exercised by production traffic. This page says which is which.
How an instance grows
One box or a fleet. Same image.
Start on one box
The default role runs everything in one core process: it serves viewers and runs all 24 background workers, video encoding included. The published profiles start at about $63 a month.
The library grows
Flip canonical storage to S3-compatible object storage with a zero-downtime migration, hash-verified end to end. Uploads already stream straight to the backend — they never touch the server's local disk.
The audience grows
Split roles: api replicas behind a load balancer, worker hosts for encoding. Work rides durable Postgres queues, so adding workers adds throughput without double-processing — a two-replica soak delivered 406 of 406 events with zero duplicates, then re-ran with the lease removed to prove the harness catches the failure it checks for. Put a CDN, with purge wired in, in front of public media. Encoding scales by adding hosts, not by stacking containers on one box — ffmpeg already uses the cores.
Past that, the roadmap
Multi-CDN steering, studio DRM and multi-region replication are planned, written down with decision records, and not built. The roadmap is public, so you can judge the distance yourself.
The ledger
Shipped, and planned.
The floor below is soak-tested; the modules above it are written down, decision-recorded, and honestly unbuilt.
- Roles and replicas Shipped
- One boot variable splits the same image into api and worker processes. Replicas take leases, elect a leader for sweeps, and drain behind /readyz — soak-tested at two replicas with a deliberate counterfactual.
- Zero-downtime storage migration Shipped
- Local to S3 with hash verification at every step; rollback is one settings change.
- CDN with purge Shipped
- Public media behind a CDN, with cache purge wired into the pipeline rather than left as an exercise.
- One-release rollback, enforced by CI Shipped
- A schema-compat gate proves the previous release runs on the new schema before anything ships, and vidra update arms the rollback.
- Multi-CDN steering Planned
- Content steering across CDNs — a decision record exists; nothing is built.
- Studio DRM Planned
- Production DRM is not built. A test lane proves the seam, and nothing more.
- Multi-region replication Planned
- A single region is the shipped shape; multi-region is on paper.
- Live beyond one host Planned
- Live streaming runs on one host today, and no sentence on this site says otherwise.
The ceiling
The wall, named.
The honest ceiling today: a single-region deployment — several api replicas and a worker fleet on one PostgreSQL, object storage as the canonical store, one CDN for public media, live streaming on one host. Validated at two replicas and three workers; designed for more; not yet exercised by production traffic.
And the first thing that needs rework past it: playback authorisation checks the database per request, which puts PostgreSQL on the byte path. It is in the plan; it is not done. You should know where the wall is before you pay to find it.