Video hosting for online courses: HLS ladder, bandwidth and protection

What HLS requires of a lesson file

HLS cuts a video into short segments listed in a playlist; the player fetches them over HTTP and switches between bitrate variants as the connection changes. Apple's authoring specification is the reference most players follow. The items that matter for recorded lessons:

Subtitles, if you add them, are WebVTT or IMSC1 in fMP4 (5.2). Captions on lectures are worth the effort: they are searchable and they help students watching without sound.

The bitrate ladder and what each rung costs in transfer

Apple publishes one possible H.264 ladder for 16:9 content and says the figures are initial targets to evaluate against your own material. A talking head over slides is far less complex than sport, and Apple names content complexity as one of the factors that set the bitrate. The last column is plain arithmetic: kbit/s x 3,600 s / 8.

For HD material Apple asks for at least two variants at the top resolution (9.10). Six rungs (360p, 540p, two at 720p and two at 1080p) cover most course libraries; for lessons recorded at 720p, stop at the two 720p rungs.

Sizing transfer and concurrency

Two sums decide the bill and the port. Monthly transfer = students x hours watched per student x GB per hour. Peak bandwidth = students watching at the same moment x the bitrate they settle on. Players climb the ladder when the line allows, so size on the rung most students reach, not the default.

• 400 students, 12 hours each a month, settling at 3,000 kbit/s: 4,800 viewing hours x 1.35 GB = about 6.5 TB a month.
• The same cohort with 150 students online during a deadline evening: 150 x 3 Mbit/s = 450 Mbit/s at peak.
• 2,000 students at 6,000 kbit/s, 10 hours each: 20,000 hours x 2.7 GB = 54 TB a month.

Those figures map directly onto the library plans on the video on demand hosting page: Starter carries 10 TB of transfer a month and 1,000 viewers at once, Pro 100 TB and 5,000, Platinum 500 TB and 25,000. On a dedicated machine the port is unmetered, so transfer stops being a line item and concurrency becomes the limit instead.

Route one: upload finished MP4 files to the library

The VOD library takes a finished MP4 and plays it as HLS from the nearest of five cities - New York, Miami, San Francisco, Amsterdam and Bucharest. It does not re-encode: what you export is what students see, and a file is ready as soon as its upload passes the format check. The format is strict: H.264 Baseline, Main or High, 8-bit 4:2:0, up to 1920x1080 at 60 frames a second; AAC-LC at 44.1 or 48 kHz, mono or stereo; up to 100 GB per file.

1. Export each lesson to that format. The command below does it with ffmpeg and puts a key frame every two seconds, matching Apple's rule.
2. Upload it in the Media tab of the dashboard. Starter holds 50 GB, Pro 200 GB, Platinum 2 TB.
3. Copy the embed code generated for that file and paste it into the lesson page of your LMS or course site, wherever the editor accepts embed HTML.
4. On Pro and Platinum the player is white-label, so the lesson carries your name rather than ours.

ffmpeg -i lesson-07-raw.mov \
  -vf scale=-2:720 \
  -c:v libx264 -profile:v high -pix_fmt yuv420p \
  -b:v 3000k -maxrate 4500k -bufsize 6000k \
  -force_key_frames "expr:gte(t,n_forced*2)" \
  -c:a aac -ar 48000 -ac 2 \
  -movflags +faststart \
  lesson-07.mp4

Because nothing is re-encoded, each file plays at the one bitrate you exported. Pick it for your audience: about 3,000 kbit/s at 720p suits slides and a speaker; screen recordings of code need 1080p for legible text.

Route two: package the full ladder on your own machine

If you want every rung, your own key server and your own access rules, run the packaging yourself on a dedicated streaming server: one physical machine with root, an out-of-band console and an unshared, unmetered port - 1 Gbps on 10 of the 18 lines, up to 100 Gbps on the order form. With a fifth of the port held back, a 1 Gbps port carries about 177 viewers at 4.5 Mbit/s each; at Apple's 6 Mbit/s rung, about 1,330 fit on 10 Gbps. The ffmpeg HLS muxer builds the ladder, the multivariant playlist and AES-128 encrypted segments in one pass. First the key, following the ffmpeg documentation:

openssl rand 16 > lesson-07.key
echo https://learn.example.com/keys/lesson-07.key > lesson-07.keyinfo
echo lesson-07.key >> lesson-07.keyinfo
echo $(openssl rand -hex 16) >> lesson-07.keyinfo

Then three rungs from Apple's table, the 2,000 kbit/s default first, with 6-second segments, a VOD playlist and a master playlist:

ffmpeg -i lesson-07.mp4 \
  -filter_complex "[0:v]split=3[a][b][c];[a]scale=960:540[sd];[b]scale=1280:720[md];[c]scale=1920:1080[hd]" \
  -map "[sd]" -map "[md]" -map "[hd]" -map 0:a -map 0:a -map 0:a \
  -c:v libx264 -pix_fmt yuv420p -force_key_frames "expr:gte(t,n_forced*2)" \
  -b:v:0 2000k -maxrate:v:0 4000k -bufsize:v:0 4000k \
  -b:v:1 3000k -maxrate:v:1 6000k -bufsize:v:1 6000k \
  -b:v:2 6000k -maxrate:v:2 12000k -bufsize:v:2 12000k \
  -c:a aac -b:a 128k \
  -f hls -hls_time 6 -hls_playlist_type vod \
  -hls_key_info_file lesson-07.keyinfo \
  -master_pl_name master.m3u8 \
  -var_stream_map "v:0,a:0 v:1,a:1 v:2,a:2" \
  -hls_segment_filename "v%v/seg_%03d.ts" "v%v/index.m3u8"

Serve the output over HTTPS with any web server, and serve the key from an endpoint that checks the student's session before returning 16 bytes. Create the key and .keyinfo outside the web root and never copy them next to the segments: the only way to the key should be the session-checked endpoint. If you would rather not assemble this, Cue, our own streaming engine, is an order-form option on our x86 dedicated lines and outputs HLS with signed links.

Keeping lessons from being saved and shared

No streaming method makes a video impossible to copy: anything a student can watch, a determined student can record. What you can stop is the casual route - a right-click save, a pasted playlist URL, a lesson embedded on someone else's site. Layer it:

• Expiring URLs. Apple says segment URLs should not be completely static, but issued per device or changed over time (12.4). Sign playlist and segment URLs with a token that lapses after the session.
• AES-128 segments. RFC 8216 defines METHOD=AES-128: each segment fully encrypted, the key fetched from the URI in the playlist. Gate that URI behind your LMS login and a copied playlist is useless elsewhere.
• Origin checks. Refuse key and playlist requests whose Referer or Origin is not your course domain. It is easy to spoof, so treat it as a filter, not a lock.
• DRM for paid premium content. Apple's spec points content protection at FairPlay Streaming with SAMPLE-AES (13.1-13.2). It adds licence servers and cost; most course libraries stop at the layers above.

On the library route, each file gets its own player and embed code and you decide where they go. Need restrictions beyond that? Ask in the live chat before you order, as the service page says.

Where each route stops

• The library takes H.264 up to 1080p and does not build a ladder from your file. Lessons in 4K or HEVC, or a multi-rung ladder, mean route two.
• Library transfer counts against the plan's monthly allowance, shared with any live channels on the same account; the video CDN page lists every plan row.
• A dedicated machine serves from the one city you put it in. Students on the far side of the world are better served by the library's five cities, or by machines in more than one of our data centers.
• Route two makes you the operator: certificates, key server, LMS integration and backups of your masters are yours.