Case 05Enterprise media · Mobile
Streaming and a verified Islamic library, for one organisation.بوصلة
- Year
- 2026
- Status
- Internal platform
- Discipline
- Enterprise media · Mobile
- 15
- modules
- HLS
- multi-bitrate
- 0
- third-party trackers
01 — The problem
An organisation needed its own streaming service — no public sign-ups, no ads, no tracking — and religious texts that must be provably identical to their canonical sources.
A closed, Arabic-first media platform for an organisation’s employees: programmes, multi-bitrate streaming, reels and audio, alongside a byte-exact digital library of Qur’an, Hadith and Adhkar, prayer times and a Qibla compass.
02 — What I built
- 01
A Laravel 13 modular monolith of 15 modules — Identity, Access Control, Catalog, DRM Authorization, Media Ingest, Media Processing, Audit and more — talking only through typed contracts.
- 02
Resumable direct-to-storage uploads, quarantine, and a sandboxed FFmpeg cluster that packages HLS renditions.
- 03
A Flutter client with clean layered design, Riverpod state, native bridges for Keychain/KeyStore, sensors and home-screen widgets.
- 04
Department activation codes and hardware-scoped device binding instead of public accounts.
03 — Architecture
How the pieces fit.
- L1Clients
- Flutter 3 · iOS & Android
- Riverpod + GoRouter
- Native widgets & sensors
- L2Edge
- Caddy reverse proxy
- Presigned playback
- TLS everywhere
- L3Control plane
- Laravel 13 · PHP 8.5
- 15 modules, typed DTOs
- Outbox + queue workers
- L4Data & media
- PostgreSQL 18 via PgBouncer
- Redis 8
- MinIO / S3 · FFmpeg 8.1
Requests flow top to bottom · each layer depends only on the one beneath
04 — Decisions that matter
Decisions
Canon is immutable
Religious texts are archived byte-identical to pinned sources and are never normalised or generated by AI.
Laravel authorises, storage delivers
The API decides who may watch; media streams straight from object storage over short-lived signed tokens.
Boundaries in a monolith
One deployable, fifteen modules, explicit allow-list DTOs — the operational simplicity of a monolith without the coupling.
05 — Security & trust
- Zero-trust media delivery with scoped, short-lived tokens.
- `__Host-` session cookies and hardware-bound devices.
- Tamper-evident, append-only audit trail.
- No public sign-up, no third-party tracking, no ads.
06 — Stack
- Laravel 13
- PHP 8.5
- PostgreSQL 18
- PgBouncer
- Redis 8
- MinIO
- FFmpeg
- Flutter
- Riverpod
- Caddy
Next case · 06
SPU Website
A university’s front door, rebuilt in two languages.