Rabata CDN

Rabata CDN caches and delivers objects from a Rabata Storage bucket at edge locations close to your users. A CDN endpoint always uses a Rabata bucket as its origin; arbitrary external origins are not supported.

View markdown

Usage and billing

The dashboard shows delivered data, request count, and the current CDN cost for each endpoint. Usage is aggregated by calendar month and appears in billing.

Enable CDN delivery

  1. Open CDN in the dashboard.
  2. Select a Rabata Storage bucket.
  3. Choose Enable public CDN or Enable signed CDN.
  4. Copy the generated HTTPS endpoint.

Rabata creates a dedicated origin credential for the endpoint. The secret is not stored in the Rabata application database. The generated HTTPS endpoint appears after activation.

Connect a custom domain

  1. Add the hostname on the bucket's CDN settings page.
  2. At your DNS provider, create a CNAME from that hostname to the generated CDN hostname.
  3. Return to Rabata and select Verify DNS and SSL.

Keep the CNAME in place while the domain is active. Certificate issuance can take several minutes after DNS begins resolving.

Purge cached objects

Enter an absolute object path such as /images/logo.png in Purge cache. Leave the path blank to purge the whole endpoint. Purges are asynchronous and may take a short time to reach every edge location.

Signed URLs

Signed delivery rejects requests without a valid expiring token. Rabata displays the signing key once when signed delivery is enabled or the key is rotated. Store it as a server-side secret; never include it in browser or mobile application source code.

This Ruby example creates an advanced HMAC-SHA256 URL for one object:

require "base64"
require "openssl"
require "uri"

def sign_cdn_url(url, signing_key, expires_in: 3600)
  uri = URI(url)
  expires = Time.now.to_i + expires_in
  digest = OpenSSL::HMAC.digest("SHA256", signing_key, "#{uri.path}#{expires}")
  token = Base64.urlsafe_encode64(digest, padding: false)
  uri.query = URI.encode_www_form(token: "HS256-#{token}", expires: expires)
  uri.to_s
end

Rotate the key from the dashboard if it is exposed. Existing URLs signed with the previous key stop working immediately.

Disable an endpoint

Disabling first stops delivery, finalizes the endpoint's current month-to-date usage, removes the CDN configuration, and revokes the dedicated origin credential. Cached copies are not retained for later reactivation. You can enable a fresh endpoint for the same bucket afterward; prior usage remains attached to its original billing period.