Technical Architecture

Technical architecture

Audience: developers and advanced administrators. Baseline reviewed: 2026-10-29. Technical index.

Deployment boundaries

Component	Responsibility	Important boundary
Streamer	Web pages, accounts, videos, settings, plugin coordination, API and publication metadata	Own database/configuration and enabled plugin set
Web Encoder	Downloading/converting queued input, transfer to the originating site and media utility endpoints	Separate application/database; one Encoder can serve multiple independent Streamers
Live server	RTMP ingest, HLS generation, statistics and recording/control endpoints	External Nginx/RTMP configuration and filesystem
Local Encoder	Desktop preparation/conversion and upload of completed media	Does not replace Web Encoder services used by the Streamer/plugins
Storage/CDN	Optional remote object storage or distribution	URLs, real objects and local placeholders can differ
Socket/WebRTC services	Real-time events and browser-to-RTMP transport	Separate listeners/processes and potentially separate certificates

flowchart LR
    Browser --> Streamer
    Streamer --> Database
    Streamer --> Plugins
    Streamer --> Encoder
    Encoder -->|files and callbacks| Streamer
    OBS --> LiveServer
    LiveServer -->|publish and recording callbacks| Streamer
    LiveServer -->|HLS| Browser
    Streamer --> Storage
    Storage -->|media delivery| Browser

Loading

The diagram describes component communication, not a required single-host topology. Discover actual domains, document roots, listeners, mounts and service managers on the installation under investigation.

Normal PHP request processing

Deployment configuration is loaded through videos/configuration.php and objects/include_config.php. The bootstrap loads shared helpers, database/configuration classes, request filtering, session behavior and plugin initialization. objects/security.php normalizes named fields and _id-suffixed inputs. Endpoint code can therefore receive transformed input rather than the original wire value.

AVideoPlugin::getStart() runs during bootstrap for relevant requests; it can affect login and page behavior before the endpoint's main code executes. Requests ending in .json.php receive the automatic cross-origin/request and rate-limit guards subject to their explicit bypass rules. Endpoint-specific authentication, ownership and business rules remain separate.

The exact order and exceptions matter. A PHP file that exists on disk is not automatically a supported API route, and a helper's name alone does not establish its authorization contract.

Code map

Area	Source
Bootstrap	objects/include_config.php, objects/autoload.php, objects/security.php
Domain objects and persistence	objects/user.php, objects/video.php, objects/Object.php, objects/mysql_dal.php
Plugin contract/dispatch	plugin/Plugin.abstract.php, plugin/AVideoPlugin.php, objects/plugin.php
Pages and administration	view/, admin/, objects/Page.php
Utility families	objects/functions*.php
Initial schema and released upgrades	install/database.sql, updatedb/
Deployment samples	docker-compose.yml, Dockerfile*, deploy/

Read the source reference index for exact declarations and source links. The implementation baseline is recorded in coverage.

Diagnostic consequences

A successful browser login does not establish Encoder authentication. A running RTMP service does not establish HLS playback. A stored video record does not establish file transfer or remote-object availability. Track the relevant identity and artifact through each participating component rather than treating the platform as a single process.