# Rabata CDN

Rabata CDN caches and delivers objects from a Rabata Storage bucket at edge locations close to your users. A CDN endpoint always uses a Rabata bucket as its origin; arbitrary external origins are not supported.

## Usage and billing

The dashboard shows delivered data, request count, and the current CDN cost for each endpoint. Usage is aggregated by calendar month and appears in billing.

## Enable CDN delivery

1. Open **CDN** in the dashboard.
2. Select a Rabata Storage bucket.
3. Choose **Enable public CDN** or **Enable signed CDN**.
4. Copy the generated HTTPS endpoint.

Rabata creates a dedicated origin credential for the endpoint. The secret is not stored in the Rabata application database. The generated HTTPS endpoint appears after activation.

## Connect a custom domain

1. Add the hostname on the bucket's CDN settings page.
2. At your DNS provider, create a CNAME from that hostname to the generated CDN hostname.
3. Return to Rabata and select **Verify DNS and SSL**.

Keep the CNAME in place while the domain is active. Certificate issuance can take several minutes after DNS begins resolving.

## Purge cached objects

Enter an absolute object path such as `/images/logo.png` in **Purge cache**. Leave the path blank to purge the whole endpoint. Purges are asynchronous and may take a short time to reach every edge location.

## Signed URLs

Signed delivery rejects requests without a valid expiring token. Rabata displays the signing key once when signed delivery is enabled or the key is rotated. Store it as a server-side secret; never include it in browser or mobile application source code.

This Ruby example creates an advanced HMAC-SHA256 URL for one object:

```ruby
require "base64"
require "openssl"
require "uri"

def sign_cdn_url(url, signing_key, expires_in: 3600)
  uri = URI(url)
  expires = Time.now.to_i + expires_in
  digest = OpenSSL::HMAC.digest("SHA256", signing_key, "#{uri.path}#{expires}")
  token = Base64.urlsafe_encode64(digest, padding: false)
  uri.query = URI.encode_www_form(token: "HS256-#{token}", expires: expires)
  uri.to_s
end
```

Rotate the key from the dashboard if it is exposed. Existing URLs signed with the previous key stop working immediately.

## Disable an endpoint

Disabling first stops delivery, finalizes the endpoint's current month-to-date usage, removes the CDN configuration, and revokes the dedicated origin credential. Cached copies are not retained for later reactivation. You can enable a fresh endpoint for the same bucket afterward; prior usage remains attached to its original billing period.