Media Optimization — OSS Self-Host Verdict Brief

Follow-up to Directus CMS stack adoption (2026-05-22). Original REPORT.md §05 picked Cloudflare Images (managed) for image transforms and Bunny Stream (managed) for video. Operator now wants OSS-self-host alternatives surveyed so the stack can keep media optimization in-VPS rather than outsourced. Audio + documents/PDF were gaps in the original stack — included here for completeness.

Posture: OSS-self-host, R2 origin, Caddy reverse-proxy, Bunny CDN edge, per-client Docker on shared VPS. On-the-fly transform proxy preferred.

Sibling files (verified candidate matrices, full per-axis scoring): - images.md · video.md · audio.md · docs-pdf.md

Recommended stack

Pattern observed: all 4 axes converge on stateless transform container behind Caddy, R2 source + target, content-addressed cache, Bunny CDN fronts cache. This is a real fleet-wide pattern, not coincidence. One Caddy block per axis, four images per client tenant. Stack composable.

Integration sketch with Directus stack

# docker-compose.yml (per-client tenant)
services:
  directus:
    image: directus/directus:latest
    environment:
      STORAGE_LOCATIONS: cloud
      STORAGE_CLOUD_DRIVER: s3
      STORAGE_CLOUD_ENDPOINT: ${R2_ENDPOINT}
      STORAGE_CLOUD_KEY: ${R2_KEY}
      STORAGE_CLOUD_SECRET: ${R2_SECRET}
      STORAGE_CLOUD_BUCKET: ${R2_BUCKET}

  imgproxy:
    image: ghcr.io/imgproxy/imgproxy:latest
    environment:
      IMGPROXY_S3_ENDPOINT: ${R2_ENDPOINT}
      IMGPROXY_USE_S3: "true"
      IMGPROXY_KEY: ${IMGPROXY_HMAC_KEY}
      IMGPROXY_SALT: ${IMGPROXY_HMAC_SALT}

  gotenberg:
    image: gotenberg/gotenberg:8
    command: ["gotenberg", "--api-port=3000", "--webhook-allow-list=.*"]

  shaka-packager-s3:
    image: ghcr.io/eyevinn/shaka-packager-s3:latest  # to be vendored — see Caveat
    environment:
      S3_ENDPOINT: ${R2_ENDPOINT}

  encore:
    image: eyevinnplatform/encore:latest
    environment:
      ENCORE_S3_ENDPOINT: ${R2_ENDPOINT}

  audio-shim:
    build: ./services/audio-shim  # Hermes-owned ~300 LOC
    environment:
      S3_ENDPOINT: ${R2_ENDPOINT}

# Caddyfile (per-client tenant subdomain)
img.{client}.boas.dev {
    reverse_proxy imgproxy:8080
    header Cache-Control "public, max-age=31536000, immutable"
}

vid.{client}.boas.dev {
    reverse_proxy shaka-packager-s3:8080
    header Cache-Control "public, max-age=2592000"
}

doc.{client}.boas.dev {
    reverse_proxy gotenberg:3000
}

aud.{client}.boas.dev {
    reverse_proxy audio-shim:8000
}

Bunny CDN pull-zone per subdomain. R2 lifecycle policies handle stale-cache eviction.

Rejected / disqualified

Architectural notes

1. Bunny CDN does not disappear. OSS sidecars replace transform, not edge delivery. Bunny pull-zone still fronts each subdomain. Transform sidecars are origin-shielded by CDN cache; absent Bunny, imgproxy/gotenberg eat thundering-herd risk on viral assets.

2. Storage cost shift. HLS variants typically 2-4× source size at 4-rung ABR ladder. Directus stack budget (originally framed around image-only R2 cost) needs revision if video lands in scope. Per-client cap recommended.

3. GPU optional, not required. All 4 axes run CPU-only acceptable for VPS posture. NVENC/QSV unlock 4-8× transcode throughput if a client's video catalog grows beyond hundreds of GB — defer until triggered.

4. On-the-fly transcode is a stretch goal not delivered. Universal pattern in OSS video is pre-transcode-at-upload; no top pick supports per-request transcode. Image, audio, doc axes DO support on-the-fly transform first-class. Accept asymmetry; align Directus upload-webhook to fire encore-job for video, no extra step for the other three.

5. License posture clean except for 3 flags: flyimg AGPL (image, secondary), Bento4 GPL+commercial (video, fallback only), Stirling-PDF v2 NOASSERTION (docs, fallback only). Top picks across all 4 axes are MIT / Apache-2 / BSD-3 / LGPL — no copyleft contamination on the recommended path.

6. Audio shim is the only build-vs-adopt deviation. Hermes owns ~300 LOC. Trade-off accepted — no off-the-shelf candidate fits the lightweight on-the-fly transform-proxy shape for audio. Liquidsoap (1.6k★, daily commits) reserved as scope-expansion fallback if scheduled-feed audio enters scope.

Open questions for operator

Downstream routing (no handoffs filed by Hermes)

This is a research arc, not an adoption arc (per 2026-05-22 lesson — Pantheon ceremony only when operator explicitly asks for adoption-execution layer). Operator owns:

• Ratification of top picks (or rejection / revision)
• Q1-Q6 rulings
• If adoption proceeds: cross-route to plutus (web-app infra owner — hostinger-vps + R2 already wired per 2026-05-07 contracts arc) for infra wiring, and atlas (skill-design owner per 2026-05-20) for any reusable-skill capture.

Hermes will not file these handoffs unsolicited. Watch-list only.

Provenance

• 4 parallel sub-agent tracks (images / video / audio + docs-pdf as twin axis)
• All star counts + licenses + last-push dates verified via gh api repos/{owner}/{name} calls within session
• Vendor benchmarks discounted per 2026-05-22 vendor-eval-skepticism lesson
• Prior art preflight: grep -rilE "imgproxy|thumbor|imageflow|libvips" research/ returned 1 hit (nda-and-contracts-self-host-2026-05-06/evidence/docuseal-agency-setup.md — unrelated context); no prior media-optimization arc on file
• Lines: images.md 164, video.md 128, audio.md 65, docs-pdf.md 81 (438 total backing this brief)