A rule is a conditional override on a resource: when a request matches its condition, the rule’s settings replace the resource defaults for that request. Rules are how one resource can cache a video segment for a week, a live manifest for three seconds, and an API response not at all, without splitting into three separate resources.
This page covers how rules match, how to shape per-workload policy, and how to keep a rule set from becoming unmaintainable. It assumes the resource and caching model from the CDN overview and Cache control and cache keys.
How a rule matches
A rule condition is a predicate over the request. The usual building blocks are:
- Path prefix — everything under
/hls/or/media/. - Exact path — one known endpoint such as
/healthz. - Extension —
.ts,.m4s,.mp4,.m3u8,.jpg. - Query presence or value — for example a
formatparameter that genuinely changes the object. - Method, header, or cookie — rarely, and usually only for access decisions rather than caching.
Conditions compose with AND, and a rule may carry several independent actions at once: cache lifetime, cache-key behaviour, response headers, redirect, access check, or origin selection. Treat each action as its own axis rather than thinking of “the rule” as one monolithic thing.
Per-workload policy
The same hostname often serves several workloads, so policy is best expressed per object class rather than per title.
| Workload | Cache key | Typical TTL | Range handling | Notes |
|---|---|---|---|---|
VOD manifests (.m3u8, .mpd) | Path only | Minutes to hours | n/a | Rewritten on repackage; short TTL |
| Live manifests | Path only | 1–5 seconds | n/a | Must track the live edge |
Media segments (.ts, .m4s, .mp4) | Path only | Days to weeks | Honour ranges | Immutable; long TTL is free offload |
| Thumbnails and posters | Path, plus transform params | Hours to days | n/a | Version filenames where possible |
| API and personalized JSON | Path, plus explicit params | Seconds or uncacheable | n/a | Correctness over offload |
Keep authentication out of every cache key and validate entitlement separately — see the secure-token guidance in Cache control and cache keys. Extension-based rules are convenient but must never be the only thing deciding cacheability, because a dynamic URL can be dressed up to look static.
Rule ordering and precedence
Rules are evaluated in order and the first matching rule wins; once a request matches, later rules do not apply unless the engine explicitly supports additive actions. That single fact drives the whole layout:
- Most specific first. Exact paths and security overrides go above broad prefixes.
- Catch-alls last. A final low-priority rule should set the safe default for anything unmatched.
- Resource defaults underneath. Anything no rule touches falls back to the resource-level settings.
When two rules could match, precedence is decided by position, not by specificity. Reordering rules therefore changes behaviour for live traffic, so treat rule order as part of the review surface in change control.
Avoiding rule sprawl
Rule sets rot when every new title, campaign, or client gets its own rule. Symptoms: hundreds of near-duplicate entries, unknown owners, and edits that break an unrelated path.
- Match classes, not instances. One rule for all
.m4sunder a prefix beats a rule per series. - Name and describe every rule. An unnamed rule is unownable.
- Generate rules from templates. Path policy is a good fit for infrastructure-as-code — see Terraform and control-plane automation.
- Delete on expiry. Campaign and one-off rules should carry an owner and an end date.
- Review order after any insert. A new broad rule placed too high can shadow everything below it.
Where AdultInfra fits
Adult catalogues are long-tailed and volatile, so the goal is a small, ordered, class-based rule set that survives rapid publishing. AdultInfra reviews and tunes path policy against your real request mix — manifests, segments, images, and API — rather than a generic template. If you have a hostname and a workload that keeps misbehaving, start with Adult video CDN or contact us.