Skip to main content

Rule examples: HLS

HLS (HTTP Live Streaming) splits a stream into a text manifest (.m3u8) that lists short media segments (.ts or .m4s). The CDN has to cache these two file types very differently: the manifest changes every few seconds as the live edge advances, while each segment is immutable once published. This page gives you a ready-to-use template of cache rules and a CORS header rule for serving HLS from your own packaged streams.

Why manifests and segments need different TTLs​

A live HLS manifest is rewritten on every segment boundary — it always points at the newest few segments. If the CDN over-caches the manifest, players keep replaying a stale window and playback stalls. Segments, by contrast, never change once written: a given segment_042.ts is the same bytes forever (within the rolling DVR window), so a slightly longer TTL is safe and reduces origin load.

File typePattern (case-insensitive regex)TTLWhy
Manifest / playlist~* \.(m3u8)$2 secondsMust stay fresh; the live edge advances every segment.
Media segment~* \.(ts|m4s)$10 secondsImmutable within the rolling window; caching longer adds no benefit.
tip

Keep the manifest TTL low (1–2 seconds) and the segment TTL modest (5–10 seconds). Caching manifests too long is the single most common cause of stalled or "stuck" live playback.

Manifest cache rule​

In the property's Rules tab, click Add cache rule and set:

  • Pattern: \.(m3u8)$ — Regex match type (case-insensitive)
  • TTL: 2 seconds
  • Order: 1

Segment cache rule​

Add a second cache rule for the media segments (.ts for MPEG-TS, .m4s for fragmented MP4), with a higher order so the manifest rule is evaluated first:

  • Pattern: \.(ts|m4s)$ — Regex match type
  • TTL: 10 seconds
  • Order: 2
note

The pattern is a regular expression. The leading ~* you may see in nginx-style configs just means the case-insensitive Regex match type — pick that type in the panel and enter the pattern without the ~*.

CORS header rule for browser players​

Browser players such as hls.js fetch the manifest and segments with XHR/fetch, so the responses need an Access-Control-Allow-Origin header or the browser blocks them. Add a response header rule:

  • Action: Set
  • Header name: Access-Control-Allow-Origin
  • Header value: *
  • Apply to: Response
  • Pattern: empty (all requests)
tip

Set the value to a specific origin instead of * if you want to restrict which sites may embed your player.

Request flow​

A note on Paradarum Live properties​

If you publish through Paradarum Live, you do not create these rules yourself. When a live stream is provisioned, the backing CDN property is created with equivalent system rules already in place — a manifest rule, a segment rule, and a CORS rule — and they are read-only on that managed property. The system manifest rule actually combines HLS and DASH with the pattern ~* \.(m3u8|mpd)$, and the segment rule covers ~* \.(ts|m4s)$. See live playback and caching for details.

warning

On a managed live property the HLS/DASH/CORS rules are flagged as system rules and shown read-only — do not try to hand-edit them. Use the template on this page only for custom HLS delivery on a standard property where you package the stream yourself.

See also​