@devultur/self-host
The Devultur media Worker: a Hono app for Cloudflare Workers that handles uploads (single and multipart, straight to R2), public and private delivery with an edge cache, image transforms, single-use download links, encryption at rest, HLS transcode (Cloudflare Containers, Fly Machines or your own HTTP runner) and captions.
Install
pnpm add @devultur/self-host
Example
// src/index.ts
import { createWorker } from "@devultur/self-host";
export { DownloadGrants, DownloadLink } from "@devultur/self-host";
export default createWorker();
# wrangler.toml
name = "media"
main = "src/index.ts"
compatibility_date = "2026-10-01"
[[r2_buckets]]
binding = "MEDIA_BUCKET"
bucket_name = "my-media"
[[r2_buckets]]
binding = "KEYS_BUCKET" # per-object encryption keys: required when security.encrypt is on
bucket_name = "my-media-keys"
[[kv_namespaces]]
binding = "MEDIA_KV" # pending uploads and transcode job state
id = "<your KV namespace id>"
[[durable_objects.bindings]]
name = "DOWNLOAD_LINKS"
class_name = "DownloadLink"
[[durable_objects.bindings]]
name = "DOWNLOAD_GRANTS"
class_name = "DownloadGrants"
[[migrations]]
tag = "v1"
new_sqlite_classes = ["DownloadLink"]
[[migrations]]
tag = "v2"
new_sqlite_classes = ["DownloadGrants"]
wrangler r2 bucket create my-media
wrangler r2 bucket create my-media-keys # keep it private and backed up
wrangler secret put DELIVERY_SIGN_SECRET # signs viewer tokens and links
wrangler secret put WORKER_AUTH_SECRET # your backend's bearer on control routes
wrangler secret put TRANSCODE_WEBHOOK_SECRET # signs transcode callbacks
wrangler deploy
Without its secrets the Worker fails closed: control routes answer 503. With encryption at rest on and no
KEYS_BUCKET, private writes answer 503 keys_bucket_missing instead of storing plaintext. Call it from your backend with
@devultur/server. The Worker is built from plugins:
createWorker({ plugins }) takes your rules, your own auth, hooks before a credential is issued, and routes and
middleware of your own.
Documentation
- Self-host guide (routes, rules, transcode runners, image transforms): github.com/devultur/devultur/blob/main/docs/guides/self-host.md.
- Plugins (auth, request state, hooks, example plugins): github.com/devultur/devultur/blob/main/docs/guides/plugins.md.
- Retention and holds (compliance and governance locks, holds, audit, caveats): github.com/devultur/devultur/blob/main/docs/guides/object-lock.md.
The three guides ship with the package, for the installed version, in node_modules/@devultur/self-host/docs/guides/.