Cloudflare R2 for Video Storage

Hi Andrei! Absolutely, happy to answer any questions you have!

Costs

To preface, I haven't yet transitioned our older Bunny Stream videos to Cloudflare R2 (still going to, just need to find the time). Additionally, Cloudflare R2 offers 10GB/mo of free R2 storage and I've only been running R2 for about 10 months now. So, I was under the free tier for a few months there. Also worth noting, Cloudflare won't bill you until your accrued charges are high enough to be worth a bill.

So, I think I went over the free tier for R2 storage around March. Since then, I've only been billed twice for a total of $0.45. I'm still under their A & B operation free tier as well as the worker free tier and I'm not sure I'll ever go over those monthly amounts, so that 45 cents is purely from R2 storage.

Bunny Stream on the other hand I was seeing a bit of a compounding effect on our charges. The more videos released meant more views. They also, at least at the time, have/had a $1/mo minimum charge. I exclusively used Bunny Stream for about 14 months starting under that $1/mo minimum charge and by the end of the 14 months it creeped up to around $5/mo… which is still super affordable compared to most other options. As I believe I mentioned in that blog post though, my fear was the compounding effect I was seeing due to egress.

Worker Configuration, Video Authorization, & Caching

First, the R2 bucket is private and can only be accessed via token. The worker serves as an access point to request files from the R2 bucket.

The authorization on whether the user has permission to watch the video is done directly on the Adocasts site. When authorized, it bundles up an HMAC hashed message and passes it along via a header with the requests to the worker. The worker will then also bundle up an HMAC message for the requested video. If the messages match, then the user can watch. It essentially just ensures the request hasn't been tampered with and originated from the Adocasts site. I chose this approach because I didn't want to have to relay back to the Adocasts site from the worker to check for authorization.

Here's how I'm building that message on the Adocasts side:

const version = 'v1'
const userId = user?.id ?? 'NA'
const videoId = post.videoR2Id
const expiration = DateTime.now().plus({ hours: 48 }).toISO()
const payload = [version, userId, videoId, expiration].join('|')
const signature = createHmac('sha256', env.get('R2_SIGNING_KEY'))
  .update(payload)
  .setEncoding('base64')
  .digest('hex')

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

Due to the authorization being needed in the worker, requests between Adocasts and the worker aren't cached. However, requests between our worker and R2 bucket are. I don't track cache-hits so I'm not sure exactly how much its helping. That's one down side to using R2 instead of Bunny Stream, Bunny Stream does come with a bunch of out-of-the-box statistics.

There's probably room for improvement, but here's specifically what I'm doing to cache… nothing special:

const cacheKey = new Request(url.toString(), request)
const cache = caches.default

let response = await cache.match(cacheKey)

// if cached, return directly
if (response) {
  return response
}

// ... [fetching file]

// add to cache
ctx.waitUntil(cache.put(cacheKey, response.clone()))

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

Hope this helps!!