Video platform
Uploads, FFmpeg processing, renditions, Shorts, playlists, search, discovery, history, watch later, comments, reports, and Creator Studio.
Install, configure, operate, secure, and troubleshoot the complete PlayHub video, community, and multi-participant live streaming platform.
PlayHub is a self-hosted product for publishing on-demand video, running creator channels and communities, hosting real-time rooms, recording replays, monetizing engagement, and administering the complete service from one dashboard.
Uploads, FFmpeg processing, renditions, Shorts, playlists, search, discovery, history, watch later, comments, reports, and Creator Studio.
Browser and RTMP broadcasting, multi-participant rooms, screen sharing, control room, moderation, polls, goals, contributions, and replays.
Users, creators, roles, reports, ads, payments, storage, languages, backups, support, diagnostics, branding, and system configuration.
PlayHub is not a static PHP theme. Production operation requires CLI access, Redis, FFmpeg, a persistent queue worker, cron, Docker, open media ports, and valid HTTPS.
Version 0.9.9 adds an extension platform, transactional updates, new paid-content workflows, persistent playback, deeper discovery, and expanded administration. Use this section as the operating reference for capabilities introduced in this release.
Version 0.9.9 does not deprecate any public PlayHub API. Plugin API v1 is the supported extension contract for new integrations.
Install extensions only from a source you trust. Plugin packages and system updates execute server-side code, so review compatibility, dependencies, requested configuration, and the package source before enabling them.
| Capability | How it works |
|---|---|
| Plugin API v1 | Plugins register trusted PHP service providers, lifecycle hooks, dependency and compatibility rules, migrations, encrypted settings, server-side actions and filters, and namespaced website or Admin Panel pages. |
| Admin Plugins workspace | Use the workspace to install or update a ZIP package, review diagnostics, configure settings, enable or disable the plugin, and remove its package. |
| Package hardening | Installation rejects traversal paths, symlinks, unsafe file types, server-control files, and archives that exceed package size or file-count limits. Package replacement is rollback-safe. |
| Declared plugin assets | Plugins may declare CSS, JavaScript, modules, images, fonts, JSON, and WebAssembly. PlayHub serves declared files through its protected asset route and browser hook runtime. |
| Transactional system updater | The updater verifies signed manifests and checksums, runs preflight checks, protects runtime paths, creates backups, controls maintenance mode, applies database recovery, monitors interruptions, and can roll back a failed update. |
| Plugin Admin workspaces | Namespaced Admin pages receive authenticated requests, navigation, confirmation and alert dialogs, and deterministic mount cleanup through Plugin API v1. |
Resolve failed server, dependency, compatibility, disk, permission, and protected-path checks before changing production files.
Confirm the updater has a recoverable application and database backup before maintenance mode begins.
Allow checksum validation, file replacement, migrations, cache refresh, and health checks to finish without manually replacing files in parallel.
If monitoring reports an interruption or failed health check, use the updater recovery state and rollback instead of retrying partial file copies.
The packaged Update_v0.9.9 manual update upgrades a verified PlayHub 0.7.5 installation directly to 0.9.9; the 0.7.6 and 0.7.7 packages are not required. Do not use this package on an older release. Run the update as the operating-system user that owns PlayHub and stop uploads, streams, queue jobs, and other writes first.
.env, database, uploads/, storage/, media, branding, plugins, and service configuration.php artisan down --retry=60.Update_v0.9.9/ into the existing root. Preserve customer environment files, runtime data, uploads, media, plugins, SSL files, and active server configuration.npm install, npm run build, composer install, or composer update. The production build is included and the Composer lock is unchanged.VERSION, /api/health, core pages, existing data, Plugins, queues, and real-time notifications.php update_database.phpDo not run php artisan migrate --force for this manual package. If update_database.php fails, keep maintenance mode enabled, preserve its output, and restore the verified backup before attempting any manual schema change.
Only after the database updater reports success, remove it from the public root and finish deployment:
rm update_database.php
php artisan optimize:clear
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan queue:restart
php artisan reverb:restart
php artisan upIf the Artisan Reverb restart command is unavailable, restart Reverb with the installation's existing supervisor or service manager before leaving maintenance mode. LiveKit does not need a restart for this file and database update unless its service configuration also changed.
Every plugin ZIP must contain plugin.json at its package root. Use a lowercase unique ID, a semantic version, api: 1, explicit compatibility constraints, and safe relative paths. Providers and lifecycle classes require a PSR-4 autoload map that covers their namespaces.
{
"id": "vendor.example",
"name": "Example Plugin",
"version": "1.0.0",
"api": 1,
"requires": {
"playhub": ">=0.9.9",
"php": ">=8.3.0",
"extensions": ["json"]
},
"autoload": {
"psr-4": { "Vendor\\Example\\": "src/" }
},
"providers": ["Vendor\\Example\\PluginServiceProvider"],
"lifecycle": "Vendor\\Example\\Lifecycle",
"migrations": "database/migrations",
"assets": {
"styles": ["assets/example.css"],
"scripts": ["assets/example.js"]
},
"settings": [
{
"key": "api_token",
"label": "API token",
"type": "password",
"required": true,
"public": false
}
],
"capabilities": ["Example integration"]
}A provider extends App\Plugins\PluginServiceProvider, returns the exact manifest ID from pluginId(), and accesses its isolated PluginContext through $this->plugin(). The context exposes manifest data, decrypted settings, safe plugin-local paths, and action or filter registration. Hook names use lowercase letters, numbers, dots, colons, dashes, or underscores; lower priorities run first.
<?php
namespace Vendor\Example;
use App\Plugins\PluginServiceProvider as BaseProvider;
final class PluginServiceProvider extends BaseProvider
{
protected function pluginId(): string
{
return 'vendor.example';
}
public function boot(): void
{
$plugin = $this->plugin();
$plugin->addAction('example.ready', fn () => null);
$plugin->addFilter('example.title', fn (string $title) => trim($title));
}
}An optional lifecycle class extends App\Plugins\PluginLifecycle and may implement enable(), disable(), settingsUpdated(), and uninstall(). Declare Admin or website workspaces through the supported namespaced plugin APIs, keep migrations inside the declared directory, and declare every browser asset in the manifest. Settings support text, password, textarea, boolean, number, and select fields; password settings cannot be public.
| Capability | Viewer or creator behavior |
|---|---|
| Standalone embed player | Iframe embeds render only the requested video and player instead of the complete video-details page. |
| Automatic scroll miniplayer | An actively playing watch-page video floats after it falls below 50% visibility and returns inline when paused, ended, or visible again. |
| Persistent in-tab playback | Playback can continue across website navigation and reloads with previous/next queue controls, seek, mute, secure source refresh, full-player handoff, and browser Media Session integration. |
| Homepage and Shorts recommendations | Recommendations combine freshness, engagement quality, momentum, daily exploration, viewer affinity, completed-watch suppression, and creator/category diversity. |
| AirPlay and Google Cast | Supported browsers expose feature-detected casting for on-demand video and live replays, including Safari media permission and resumable default-receiver sessions. |
| Timestamped descriptions | Descriptions preserve formatting, Unicode, and emoji. Clickable m:ss and h:mm:ss timestamps seek the active player. |
| Automatic chapters | Valid timestamped descriptions create native Vidstack chapter tracks with segmented seek bars, active titles, chapter navigation, and cover previews. |
| Managed chapters | Import CUE files or timestamp lists, review duration-based unnamed segments, validate chapter storage, and opt each video into native timeline chapters. |
| YouTube chapter import | Imported videos can read native player markers or timestamped descriptions and present an editable Step 4 chapter review with explicit opt-out. |
| Rich description formatting | Descriptions safely render inline bold, italic, combined emphasis, external links, and the original text layout. |
| Automatic Up Next loading | The watch page loads another recommendation page near the end of Up Next while preserving the manual Show more control. |
| Imported Shorts detection | YouTube Shorts signals or verified portrait metadata from other providers classify imported short-form videos. |
| Contextual recommendations | Related and Up Next results combine channel, category, language, and tags with a signed-in viewer's private history, likes, saved videos, and subscriptions. |
| Draggable miniplayer | Desktop users can move the minimized player within viewport bounds. Position and size persist, with constrained resizing, compact or expanded size, keyboard movement, and recovery after viewport changes. |
| Desktop theater mode | The watch page remembers theater mode, exposes native player and keyboard controls, expands playback, and keeps Up Next responsive. |
| Capability | Configuration and access |
|---|---|
| Paid community photo sets | Protected originals are unlocked through wallet purchase with platform fees, configured tax, permanent buyer access, and seller notification. |
| Currency-aware account balance | The account menu shows the wallet in the selected currency and links directly to Earnings. |
| Creator tips and donations | Creators may accept wallet-backed support on channel and video pages, opt out, and rely on configured contribution limits, fees, idempotent transfers, and notifications. |
| Paid video sales | Administrators enable sales and creators set eligible prices. Wallet checkout applies the platform commission, notifies the purchase participants, and grants permanent Purchased-library access through protected playback links. |
| Purchase taxes | Configure VAT, GST, or Sales Tax for paid videos. Checkout shows the buyer total and stores an auditable tax record. |
| Withdrawal approvals | Administrators or permitted moderators receive pending-request alerts, review requests, approve or reject once, retain reviewer metadata, and notify the creator of the decision. |
| Video boost campaigns | Creators reserve wallet budgets and choose daily, per-click, or per-view billing. Home and Trending placement is paced and relevance-aware, qualified events are deduplicated, promoted labels remain visible, creator controls and reporting are provided, and administrators define limits. |
| Creator Studio earnings | The earnings cabinet filters creator-scoped VAST, tip, video sale, and live revenue and shows fees, balances, supporter/content details, pagination, and complete notifications for tips, purchases, and channel subscriptions. |
Video advertising now supports VAST pre-roll, timed mid-roll, and post-roll breaks. Creator video payouts use completed VAST impressions with the VAST CPM or administrator fallback CPM, a configurable creator percentage, fractional accrual, self-view exclusion, hourly deduplication, and idempotent wallet crediting. Shorts cannot be sold as paid videos and are excluded from the standard player's Up Next and autoplay sequence.
| Capability | Workflow |
|---|---|
| Hashtags and linked mentions | Hashtags open search results and linked mentions open the referenced channel profile in video comments, community posts, and community comments. |
| Upload playlist selection | The upload workflow lets a creator add the new video to one of that creator's own playlists. |
| Responsive mobile navigation | The mobile header provides search and coordinates with a fixed bottom navigator, animated active state, guest login behavior, and role-aware Live/Profile availability. |
| Community post removal | Post authors, community owners, platform moderators, and administrators can remove posts according to their permissions. |
| Watch-page video deletion | Creators, moderators, and administrators receive a confirmed delete action when their role can remove the current video. |
| Mention autocomplete | Type @ in supported video or community composers to receive suggestions, use keyboard selection, render a linked mention, and send preference-aware notifications. |
| Community poll voters | Click a poll vote count to open paginated voter details with each public profile and selected option. |
| Publishing access controls | Administrators define upload and live role rules, a strict username allowlist, timed user restrictions, and profile-complete self-service creator upgrades for new User accounts. |
| Capability | Administration behavior |
|---|---|
| Default website language | Choose the default in Admin Languages. A returning visitor's saved language preference remains authoritative. |
| Language availability | Enable or disable public languages while default-language safeguards prevent an invalid catalog state. |
| Localized Admin Pages | Edit About, Contact, Developers, FAQ, Help, Refund, Privacy, Terms, and Cookie pages by language with repeatable sections, visibility, footer, search metadata, sitemap controls, and atomic update-safe override storage. |
| Localized email templates | Edit, preview, validate, or reset every system email for each installed language using the documented template placeholders and update-safe overrides. |
| Branded HTML email | System email uses the configured website name and accent colors with responsive HTML and plain-text alternatives through SMTP, SendGrid, or native mail. |
| Signup audit data | User management records immutable signup IP and registration source; full IP visibility remains admin-only. |
| Route loading mode | Website Configuration can show a top loading bar, loading text, or both until the destination's initial requests finish. |
| Social sharing previews | Videos, Shorts, live streams, channels, community posts, and playlists receive server-rendered Open Graph and X cards using original artwork or the branded 1200x630 fallback. |
| SEO and Sitemaps | Configure search metadata, canonical origin, verification, per-content indexing, dynamic robots rules, synchronized Open Graph/X/JSON-LD, and paginated content sitemaps. |
| Live-stream deletion | The Admin Live Streams row menu can delete an eligible stream after confirmation and clean the active session, replay, related records, and media. |
Version 0.9.9 removes the unlicensed LightGallery dependency in favor of PlayHub's native responsive image viewer. It also removes the mobile-header theme switcher, duplicate header Go Live action, sidebar user summary card, obsolete System Settings collapse control, and setup's Product license heading and instructional paragraph. License verification remains required.
Use a VPS or dedicated server where you control PHP-FPM, background services, firewall rules, Docker, and process supervision. Shared hosting is suitable only when it exposes every requirement below.
| Component | Minimum or purpose | Verify |
|---|---|---|
| Web and CLI PHP | PHP 8.3 or newer. Keep PHP-FPM and CLI versions compatible. | php -v |
| MySQL or MariaDB | Empty database with a dedicated UTF-8 capable account. | mysql --version |
| Redis | Queues, cache, sessions, streaming runtime, and real-time coordination. | redis-cli ping |
| Node.js | 20.19.0 or newer for the production frontend build. | node --version |
| npm | Version 9 or newer. The installer uses the locked dependency graph. | npm --version |
| FFmpeg and FFprobe | Video probing, thumbnails, renditions, processing, and media inspection. | ffmpeg -version |
| Docker Engine | Runs the LiveKit server, RTMP ingress, and replay egress services. | docker version |
| Docker Compose | Compose v2 is required by the bundled runtime installer. | docker compose version |
| Nginx or Apache | URL rewriting, protected application files, large uploads, and WebSocket proxying. | Server-specific |
| TLS certificate | Required for camera, microphone, secure WebSockets, OAuth, and payments. | Open the domain with HTTPS |
bcmath ctype curl dom fileinfo filter gd intl json mbstring openssl
pdo pdo_mysql session tokenizer xml zip zlibImagick is recommended for improved image processing. The PHP-FPM user also needs access to exec(), proc_open(), and nohup so the installer can stream process output and start its temporary installation worker.
storage/, bootstrap/cache/, uploads/, and lang/..env, node_modules/, and build/.Install at a domain root such as https://video.example.com, not at https://example.com/playhub. The document root points to the package root, not the Laravel public/ folder.
Upload the complete package and preserve hidden files. The web installer generates environment-specific dependencies and production assets on the destination server.
| Path | Purpose | Customer action |
|---|---|---|
install.php | Four-step installation wizard and live installation console. | Open once, then remove after installation if desired. |
app/, routes/, config/ | Laravel application, API, jobs, services, and configuration. | Do not expose or edit without a backup. |
resources/ | React/Vite source and Blade resources. | Rebuild after frontend customization. |
vendor/ | Bundled Composer dependencies. | Keep present for installer startup. |
package.json, package-lock.json | Tested frontend dependency graph. | Do not delete the lock file. |
branding/ | Default logo and favicon imported during installation. | Keep; replace later from Website Configuration. |
gifts/, stickers/ | Bundled local contribution catalogs. | Keep so native catalog import succeeds. |
livekit/ | Docker runtime installer, templates, status exporter, and generated runtime files. | Run its installer with sudo after the web install. |
server-configs/ | Nginx and Apache root-domain examples. | Apply the matching server configuration. |
docs/ | This standalone documentation. | Open docs/index.html directly or publish it. |
.envProduction URL, database, Redis, mail, media, and runtime variables.node_modules/Installed with npm ci from the tested lock file.build/Vite production assets loaded by the public application.storage/app/installed.lock prevents accidental reinstallation.storage/app/license.json stores the signed installation activation.Prepare the domain and services before opening the installer. The installation process verifies the same critical dependencies again before writing production state.
Point a clean root domain or subdomain to the extracted PlayHub package and issue a valid SSL certificate.
Create an empty MySQL or MariaDB database and a dedicated account with privileges on that database only.
Record the host, port, username, password, and database number. Do not expose Redis publicly.
Have the administrator name, username, email, secure password, website URL, timezone, and CodeCanyon OR KNL (Kontackt Direct License) purchase code ready.
sudo chown -R <web-user>:<web-group> /var/www/playhub
sudo find /var/www/playhub/storage /var/www/playhub/bootstrap/cache /var/www/playhub/uploads -type d -exec chmod 775 {} \;
sudo find /var/www/playhub/storage /var/www/playhub/bootstrap/cache /var/www/playhub/uploads -type f -exec chmod 664 {} \;Give the web user ownership of runtime paths, then use normal directory and file modes. Broad write access exposes source, credentials, and uploaded files.
Use server-configs/nginx-root-install.conf inside the domain's existing server {} block. Keep the root pointed at the package directory, update fastcgi_pass for the installed PHP 8.3 socket, then validate and reload Nginx.
sudo nginx -t
sudo systemctl reload nginxEnable mod_rewrite, allow .htaccess overrides for the domain, and use server-configs/apache-vhost-example.conf as the virtual host reference. Preserve the root .htaccess file.
Open https://your-domain.com/install.php.
| Step | What happens | Expected result |
|---|---|---|
| 1. Requirements | Checks PHP, extensions, binaries, Docker, Redis, HTTPS, writable paths, disk, package files, and process support. | Required checks pass; warnings are understood. |
| 2. Configuration | Collects license, website, database, Redis, timezone, and initial owner details. | Connections and purchase code validate. |
| 3. Installation | Creates .env, installs frontend modules, builds assets, migrates tables, imports catalogs, caches config, and creates the owner. | Every console step ends with [OK]. |
| 4. Complete | Confirms the installed app and provides website/admin links. | Website and /admin open correctly. |
Keep the installation page open during Step 3. The console intentionally hides passwords, tokens, and service secrets.
/admin and review Website Configuration and System Settings.install.php after installation if your deployment policy requires it.The web request process must remain short. Video processing, replay finalization, notifications, scheduled publishing, retention, and backups run through queues and the scheduler.
Use a private Redis service with authentication. The application and LiveKit runtime may share the server but should use the configured database number. The installer default is database 2 for LiveKit coordination.
redis-cli -h 127.0.0.1 -p 6379 -a 'your-password' -n 2 pingcd /var/www/playhub
php artisan queue:work --queue=videos,default --sleep=3 --tries=3 --timeout=7200Run this through Supervisor or systemd. Do not leave it in an SSH terminal.
[program:playhub-worker]
process_name=%(program_name)s_%(process_num)02d
command=/usr/bin/php /var/www/playhub/artisan queue:work --queue=videos,default --sleep=3 --tries=3 --timeout=7200
directory=/var/www/playhub
autostart=true
autorestart=true
stopasgroup=true
killasgroup=true
user=www-data
numprocs=1
redirect_stderr=true
stdout_logfile=/var/www/playhub/storage/logs/worker.log
stopwaitsecs=7300sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start playhub-worker:*Add exactly one cron entry for the web-server user. Laravel decides which internal tasks run each minute.
* * * * * cd /var/www/playhub && php artisan schedule:run >> /dev/null 2>&1The schedule handles future video publishing, replay finalization and retention, scheduled live polls, pruning, and configured automatic backups.
Both binaries must be executable by the queue-worker user. Set explicit paths in .env when they are not discoverable through that user's PATH.
PLAYHUB_FFMPEG_BINARY=/usr/bin/ffmpeg
PLAYHUB_FFPROBE_BINARY=/usr/bin/ffprobe
PLAYHUB_MAX_UPLOAD_MB=51200
PLAYHUB_CHUNK_SIZE_MB=8cd /var/www/playhub
php artisan optimize:clear
php artisan config:cache
php artisan queue:restartPlayHub uses a generated Docker runtime for WebRTC rooms, external-encoder ingress, and composite replay egress. The web installer prepares configuration, but the Docker installation must be run by a server administrator.
sudo /var/www/playhub/livekit/install.shIf automatic web-user detection is incorrect, pass the PHP-FPM account:
sudo /var/www/playhub/livekit/install.sh www-dataThe script creates livekit/runtime/, generates protected keys and service configuration, starts the Compose project, and registers a project-local manager through systemd when available. The generated project contains these services:
| Purpose | Default | Exposure |
|---|---|---|
| LiveKit signaling | TCP 7880 | Normally proxied through HTTPS/WSS; avoid direct public use. |
| WebRTC over TCP | TCP 7881 | Public inbound when used as ICE fallback. |
| WebRTC media | UDP 50000-60000 | Public inbound and outbound. |
| RTMP ingress | TCP 1936 | Public only when external encoders are enabled. |
| TURN UDP | UDP 3478 | Public for clients behind restrictive NAT. |
| TURN over TLS | TCP 5349 | Public when TURN TLS is enabled with valid certificates. |
Only media and signaling ports belong on the public firewall. LiveKit API credentials, Redis, generated YAML, and keys.yaml remain private.
In Admin Dashboard > System Settings > Live Streaming > LiveKit, set the public URL to a secure endpoint such as wss://video.example.com/livekit. The reverse proxy must preserve WebSocket upgrades and use a timeout appropriate for long-lived connections.
location /livekit/ {
proxy_pass http://127.0.0.1:7880/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 86400;
}If you use a dedicated signaling subdomain, set the admin public URL and proxy host consistently. A mismatch between the browser URL, certificate, proxy path, and admin value causes connection loops.
| Setting | Use | Default |
|---|---|---|
| Enabled | Enables the real-time engine for public live workflows. | On |
| Public URL | Secure browser signaling endpoint. | APP_URL/livekit |
| API key / secret | Signs room and participant tokens. Treat both as secrets. | Generated |
| RTMP URL / port | Encoder endpoint displayed with the stream key. | Port 1936 |
| Redis | Host, port, username, password, and database used by the media services. | 127.0.0.1:6379, DB 2 |
| Signal / RTC TCP | LiveKit signaling and WebRTC TCP transport. | 7880 / 7881 |
| RTC UDP range | WebRTC media ports. | 50000-60000 |
| External IP / node IP | Advertises the reachable media address to clients. | External IP on |
| Room timeouts | Empty-room and departure cleanup behavior. | 300s / 20s |
| Max participants | Optional room-wide participant ceiling; zero means engine default. | 0 |
| TURN | UDP or TLS relay for restrictive networks. | 3478 / 5349 |
| SSL/TURN certificates | Certificate directory, domain, certificate, and key paths. | Disabled until configured |
| Advanced JSON | Validated advanced server options and ICE server overrides. | Generated defaults |
docker compose -f /var/www/playhub/livekit/runtime/docker-compose.yml ps
docker logs playhub-livekit --tail 100
docker logs playhub-livekit-ingress --tail 100
docker logs playhub-livekit-egress --tail 100docker compose -f /var/www/playhub/livekit/runtime/docker-compose.yml restartWhen settings are changed from the admin dashboard, use its save/apply action so generated configuration and service status remain synchronized.
rtmp://video.example.com:1936/live.A stream key authorizes publishing to that live session. Do not show it on screen, include it in support screenshots, or reuse it outside the generated stream.
The egress service loads the configured layout and records published participant tracks.
Participant names and designed audio-only tiles are part of the composite template, not browser overlays burned accidentally into the source.
The application records egress status and queues replay finalization when the stream ends.
The queue validates media, creates thumbnails and chapters, associates chat/events, and moves the replay to ready state.
When cloud storage is enabled, completed replay media is uploaded to the configured provider and retains its delivery metadata.
The control room diagnostics show actual connection state, source tracks, bitrate, frame rate, latency, network quality, room status, and runtime reachability. Check diagnostics before restarting services. A camera permission issue and a failed egress container require different fixes.
Most settings are available under Admin Dashboard > Website Configuration or Admin Dashboard > System Settings. Save each block independently and use its connection test where provided.
| Area | Settings | Operational note |
|---|---|---|
| Identity | Platform name, website title, logo text, logo file/URL, and favicon. | The configured website name is used in email, SMS, public copy, sharing metadata, and visible interface text. |
| Homepage panel | Presentation title, description, feature bullets, and brand mark fallback. | The uploaded logo replaces the fallback mark when available. |
| Theme | Light by default with optional dark mode; public and admin accent palettes. | Obsidian Gold is the package default. |
| Typography | Font family/import URL, sizes, weights, and navigation scale. | Only use trusted HTTPS font sources. |
| Layout | Content widths, sidebar dimensions, radii, controls, and design tokens. | Review mobile after changing dimensions. |
| Localization | Default timezone, items per page, default language, and enabled public languages. | Saved visitor language preferences override the default while their language remains enabled. |
| Block | Available settings | Default |
|---|---|---|
| Registration | Public signup, phone collection, required username, blocked IPs, and email/SMS/no verification. | Public on, no verification |
| Verification codes | Digits, expiry minutes, resend limit, invalid attempts, and IP block time. | 4 digits, 5 minutes, 3 attempts |
| Password policy | Strength meter and required strength from 0 to 10. | Enabled |
| Captcha | Simple PHP captcha or Google reCAPTCHA with site/secret keys. | Off |
| Login identifiers | Email, username, and phone number. | All three on fresh installations |
| Login protection | Two-factor authentication, max attempts, captcha threshold, and temporary ban. | 2FA on, 5 attempts, 15-minute ban |
| Social login | Google, Facebook, and Apple credentials plus callback URLs. | Off |
For OAuth, copy the exact callback URL displayed in the admin UI into the provider console. Scheme, domain, path, and trailing slash must match.
A fresh installation uses the log mailer until SMTP or SendGrid is configured. Password reset, verification, moderator, ban, and notification email will not reach users while delivery is unconfigured.
videos,default worker supervised for probing, thumbnails, and encoding.Enable only providers you intend to offer. Direct URL, YouTube, Vimeo, Dailymotion, and Twitch settings support provider-specific keys or tokens where required. The mass-import tool uses the enabled provider list and can apply category, visibility, tags, kids status, monetization, duplicate handling, and stop-on-error behavior.
| Area | Options | Package default |
|---|---|---|
| Creator tools | Webcam preview, scheduling, thumbnails, appearance, DVR, chat, replay, and advanced settings. | Feature-dependent |
| Monetization tools | Ads, Super Chat, super stickers, gifts, tips, goal bar, and alerts. | Configurable |
| Engagement | Polls, pinned messages, labels, moderation, and slow mode. | Standard moderation, 10s slow mode |
| Resolution | Auto, 480p, 720p, 1080p, 1440p, and 2160p. | Auto |
| Frame rate | 30 or 60 fps. | 30 fps |
| Latency | Normal, low, or ultra-low. | Low |
| Audience | Everyone, signed-in, subscribers, invited, or private. | Everyone |
| Replay retention | Off, 24 hours, 7, 30, or 90 days, or forever. | Forever |
| Limits | Schedule horizon, thumbnails, poll options/duration, labels, diagnostics sample, tips, and ads. | Review before launch |
Current validation supports up to 365 days for scheduling, 5 MB thumbnails, 6 poll options, 1440 poll minutes, 8 stream labels, and a 512 KB diagnostic probe. Tip defaults are USD 1 minimum and USD 500 maximum unless changed.
The website ad manager supports media or trusted HTML, placement, status, schedule, targeting, display rules, and performance data. Placements include after header, left sidebar, before footer, home feed, video grid, comments, below player, watch sidebar, Shorts, search, channel, live, community, and floating bottom.
Player ads are configured separately for VAST pre-roll, timed mid-roll, and post-roll delivery. Configure tag URLs, break timing, skip timing, wrapper depth, MP4 preference, and tracking. Test the VAST response and media CORS from a browser before enabling it globally.
Monetization can be enabled globally with platform fees, paid-video commission, contribution limits, boost limits, purchase taxes, withdrawal review, and a creator share of completed VAST impressions. VAST revenue uses provider CPM metadata or the administrator fallback CPM with fractional earnings, self-view exclusion, hourly impression deduplication, and idempotent credits. Memberships, wallets, tips, paid videos, paid photo sets, boosts, creator earnings, and payouts depend on real transaction data and configured payment providers.
The Languages page manages the bundled 128 language packs. Select a default language, enable or disable public languages, review metadata and plural rules, edit translated PHP entries, and save. The default language cannot be disabled, and a visitor's saved preference is preserved while available. Back up customized lang/ files before applying an update.
Enable maintenance mode with a customer-facing message and optional allowed IP addresses or prefixes. Always include your administration IP before saving, then verify the public state in a private browser window.
PlayHub supports local uploads and S3-compatible cloud workflows, including Amazon S3, Google Cloud Storage interoperability, Backblaze B2, and Azure Blob configuration exposed by the admin storage page.
| Provider | Required values | Verify |
|---|---|---|
| Local | Writable uploads path and sufficient server disk. | Upload, play, delete, and check range requests. |
| Amazon S3 / compatible | Endpoint, key, secret, bucket, region, and optional public base URL. | Use Test Connection, then upload and remove a sample. |
| Backblaze B2 | S3 endpoint, key ID, application key, bucket ID/name, and region. | Confirm bucket permissions and public URL. |
| Azure Blob | Account name, account key, and container. | Test write/read/delete from admin. |
| Google Cloud | Interoperability access key, secret, and bucket. | Enable compatible access and test. |
Use the records prefix to separate PlayHub objects and set a public base URL when a CDN or custom delivery domain fronts the bucket. Configure reported cloud capacity so dashboard usage percentages are meaningful.
Starter, Plus, Premium, Pro, and VIP memberships can have independent storage quotas and monthly prices. VIP can be unlimited. A user-specific quota overrides the membership default when set by an administrator.
File type, size, storage quota, ownership, and chunk state are checked.
FFprobe reads duration, dimensions, streams, orientation, and codec metadata.
Configured renditions and thumbnails are generated without blocking the browser request.
Files remain local or are moved to the active cloud disk with their public URL metadata.
Visibility and moderation state determine when viewers can discover it.
A valid cloud configuration must support write, read, public delivery, and delete. Catalog gift and sticker files intentionally remain local.
This section explains where each major PlayHub feature appears and what must be configured for it to operate.
Authenticated creators can publish community posts with text and media. Users can react, comment, report, and use categorized stickers. Suggested communities and subscription actions use real channel data. Profile Message opens the existing private conversation or creates the correct conversation destination.
| Role | Publishing | Primary capabilities |
|---|---|---|
| Host | Camera, microphone, screen, or RTMP | Full control room, invites, layouts, settings, moderators, polls, goals, and end stream. |
| Participant / guest | Audio-only or audio/video after approval | Publishes assigned tracks and appears in stage plus replay composite. |
| Moderator | Only when separately accepted as participant | Delete chat, ban viewers, restrict comments, accept requests, and remove participants. |
| Viewer | No | Watch, chat, react, vote, contribute, and request participation when enabled. |
Completed streams become responsive replay pages with adaptive portrait/landscape presentation, chat replay, chapters, top moments, stream events, likes, comments, clips, analytics, contribution history, creator information, and related replays. Multi-participant composites include participant labels; audio-only participants use an intentional identity tile instead of an empty black block.
The dashboard reads production data and applies real actions. Role and permission scopes determine which pages a team member can access.
| Page | What it manages | Important actions |
|---|---|---|
| Dashboard | Platform metrics, moderation queue, top creators, health, and quick actions. | Review reports, open analytics, inspect system health. |
| Users | Accounts, state, role, verification, storage quota, signup source/IP, activity, and deletion. | Edit, reset password, change role, ban, email, inspect admin-only signup data, permanently delete with optional videos. |
| Creators | Channels, category, subscribers, 28-day views, revenue, applications, and verification. | Verify, suspend, review, filter, and export. |
| Content | Videos, Shorts, posts, categories, imports, chapters, publishing access, and moderation. | Approve, reject, feature, edit, delete, import/review chapters, control publishing, bulk category, mass import, export. |
| Live Streams | Live, scheduled, and ended sessions with actual health and viewers. | Inspect, moderate, stop, open replay, delete with related media cleanup, and filter by category/health. |
| Gifts | Local gift image, name, price, status, and pagination. | Add, update, delete file plus record. |
| Stickers | Local sticker image, unique name, category, status, and pagination. | Add, categorize, update, and delete. |
| Ads | HTML/media creative, placement, schedule, targeting, display, and reporting. | Create, preview, enable, pause, edit, duplicate, and delete. |
| Reports | Profile, video, comment, and community reports with real previews. | Assign, prioritize, change status, resolve, bulk update, export. |
| Monetization | VAST revenue, paid videos, taxes, boosts, memberships, commission, contributions, withdrawals, and creator earnings. | Filter, inspect, export, configure limits/fees/shares, and approve or reject withdrawals. |
| Analytics | Growth, engagement, viewers, content, creators, and date-based performance. | Change range, inspect data, export. |
| Support | Customer tickets, system incidents, priority, agent, SLA, and replies. | Assign, respond, escalate, resolve, search, and filter. |
| Roles & Permissions | Admin roles, permission matrix, groups, invitations, scopes, and members. | Create/edit roles, invite member, change status, audit access. |
| Plugins | Plugin ZIP packages, compatibility, configuration, diagnostics, lifecycle state, and removal. | Install/update, configure, diagnose, enable/disable, and remove trusted packages. |
| Pages | Localized policy, support, company, and developer pages with repeatable sections and metadata. | Edit by language, control visibility/footer/search/sitemap state, and save update-safe overrides. |
| Email Templates | Localized templates, placeholders, responsive HTML, and plain-text alternatives. | Edit, preview, validate, reset, and test delivery. |
| SEO & Sitemaps | Search metadata, canonical origin, verification, indexing, robots, social cards, structured data, and content sitemaps. | Configure policy, verify public metadata, and inspect generated sitemap pages. |
| Website Configuration | Brand, homepage content, theme, colors, typography, navigation, and layout. | Preview, save, reset selected design values. |
| Languages | Installed language metadata, default/availability state, and PHP translation entries. | Set default, enable/disable, edit, validate, save, and restore with backup. |
| System Settings | Registration, login, live, storage, uploads, imports, ads, mail, SMS, integrations, moderation, and maintenance. | Navigate by section, use explicit Save/test actions, clear cache, inspect logs, backups, and cron jobs. |
Use the permission matrix to grant the smallest necessary scope. When a user is appointed as a platform or live moderator, PlayHub can send an in-app notification and configured email. Ban events can also send email; delivery requires SMTP or SendGrid.
Production reliability depends on repeatable backups, service supervision, log review, and tested updates.
The admin backup dialog inventories selectable folders and their sizes, includes the database, supports large-file behavior, compression level, retention count, and automatic frequency. Large media libraries may be better protected by storage-provider versioning plus database/application backups.
.env, the signed license receipt, and install lock privately.livekit/runtime/, especially keys, generated configuration, and certificates.Confirm the upgrade path, release notes, compatibility, server requirements, protected paths, and package signature.
Resolve disk, permissions, service, dependency, and database checks before the updater changes production state.
Keep database, environment, media, plugin settings, custom language, page/email overrides, catalogs, and runtime configuration.
The updater manages maintenance mode, checksummed downloads, protected files, replacement, migrations, cache refresh, and interruption monitoring.
Verify login, upload, playback, comments, live, replay, plugins, paid content, mail, SEO output, and administrator actions before reopening.
Use database recovery and the updater rollback when validation fails; do not leave a partially applied package in service.
storage/logs/laravel.logstorage/logs/worker.log when using the example.livekit/runtime/status/ and livekit/runtime/logs/.APP_ENV=production and APP_DEBUG=false..env, license files, Redis, database, LiveKit keys, and payment secrets.Start with the exact error, the service that owns the failing step, and the corresponding log. Avoid changing multiple systems at once.
Confirm DNS and outbound HTTPS access to registry.npmjs.org, then verify the PHP-FPM user can execute Node and npm and write storage/app/npm-cache plus the application root. Check proxy, hosting-panel, certificate, and firewall restrictions. Keep the original package-lock.json.
The locked npm install did not complete or node_modules/.bin is incomplete. Restore the original package.json and package-lock.json, remove the partial node_modules, verify write permissions and network access, then rerun installation.
Enable proc_open(), exec(), and nohup for PHP-FPM. Confirm the web user can write the application root and storage/app. Some shared hosts prohibit detached processes; use a server plan that permits them.
The installer can detect but cannot change PHP-FPM or hosting-panel policy. Allow the PlayHub root, /tmp, and required binary locations, then restart PHP-FPM. Keep web and CLI PHP versions/extensions aligned.
Inspect storage/logs/laravel.log, the PHP-FPM log, and web-server error log. Verify .env, APP_KEY, database access, writable runtime paths, and PHP extensions. Run php artisan optimize:clear. Never enable debug on a public production site.
PlayHub serves the generated build/ assets. Run npm ci when dependencies are missing, then npm run build. Clear application and reverse-proxy/CDN caches and confirm the generated asset filenames changed.
Open Admin Plugins diagnostics and verify the plugin's PlayHub/PHP compatibility, declared dependencies, package limits, and required settings. Rebuild the ZIP without traversal paths, symlinks, server-control files, unsupported file types, or unnecessary archive nesting. Install only the original package from a trusted source.
Do not copy another package over the interrupted transaction. Review the updater interruption state, preflight/checksum error, backup record, maintenance state, and application log. Use database recovery or rollback to return to the verified backup, resolve the root cause, and rerun preflight before retrying.
Compare the PlayHub upload limit with PHP upload_max_filesize/post_max_size, Nginx client_max_body_size, disk space, user quota, and write permissions. Large uploads also need compatible server timeouts.
Confirm the videos,default queue worker is running and FFmpeg/FFprobe are executable by that user. Inspect Laravel and worker logs, then run php artisan queue:failed. Fix the root cause before php artisan queue:retry all.
Check the active media disk, local/cloud write permission, bucket credentials, records prefix, image extension support, FFmpeg output, and available space. Use the admin storage connection test and verify write/read/delete, not only authentication.
The default log mailer does not send. Configure SMTP or SendGrid, save, test, clear/cache configuration, and inspect the provider activity/suppression list. Ensure the from address is authorized and the queue worker is running for queued mail.
Enable one supported provider, enter every required credential and sender, use international phone format, and run the admin test. Check provider balance, geographic permissions, sender approval, and delivery logs.
Confirm host, port, username, password, database number, bind address, and firewall. Test from the application host as the same network context. Do not use a public Redis endpoint without TLS/private networking and authentication.
Complete the web installation, then run sudo /var/www/playhub/livekit/install.sh. Confirm Docker daemon and Compose v2, inspect Compose status, and verify the admin LiveKit status snapshot updates.
Verify HTTPS, the public WSS URL, certificate, proxy WebSocket headers, API key/secret, LiveKit container health, and browser console. A public URL pointing to an unproxied internal port will not work from viewers' browsers.
Open control-room diagnostics and confirm a video track is published/subscribed, camera permission is granted, and the selected device is active. After reconnect, verify local tracks were republished. For replay only, inspect egress logs and the composite template.
This usually indicates NAT/firewall/TURN behavior. Open the RTC TCP and UDP range, advertise the correct external/node IP, and configure TURN or TURN TLS with a reachable domain and valid certificate.
Confirm ingress is healthy, TCP 1936 is open, the public RTMP host resolves to the server, and the stream key is current. Verify OBS uses the exact server URL and key generated for that stream. Inspect ingress logs while starting the encoder.
Inspect the egress container first, then Laravel and queue logs. Confirm recording started before the room ended, the egress output path is writable, the queue worker runs, FFmpeg can inspect the result, and cloud storage accepts the finalized file.
Confirm Stripe/PayPal live or sandbox mode matches the credentials, the checkout return URL uses the correct domain, webhooks can reach the server over HTTPS, and webhook secrets/events are configured as required. Check transaction and provider logs before crediting manually.
Copy the exact callback URL shown in System Settings to the provider console. Confirm APP_URL, HTTPS, proxy forwarded headers, and domain. Clear/cache config after correcting environment values.
Install the one-minute Laravel scheduler cron under the correct user. Run php artisan schedule:list and php artisan schedule:run -v, then inspect cron mail/system logs and Laravel logs.
Confirm the complete purchase code, correct installation domain/URL, outbound HTTPS to the license service, certificate validation, and accurate server clock. Contact support before moving an activated installation to another domain.
| Task | Command |
|---|---|
| Application status | php artisan about |
| Clear all application caches | php artisan optimize:clear |
| Build production config cache | php artisan config:cache |
| Run ordinary Laravel migrations (not the 0.9.9 manual update) | php artisan migrate --force |
| List scheduled tasks | php artisan schedule:list |
| Run scheduler now | php artisan schedule:run -v |
| List failed jobs | php artisan queue:failed |
| Retry failed jobs | php artisan queue:retry all |
| Restart workers | php artisan queue:restart |
| Install locked frontend modules | npm ci |
| Build frontend | npm run build |
| LiveKit status | docker compose -f livekit/runtime/docker-compose.yml ps |
| Path | Purpose |
|---|---|
.env | Environment-specific production configuration and secrets. |
storage/logs/laravel.log | Application exceptions and operational messages. |
storage/app/installed.lock | Prevents installer reuse. |
storage/app/license.json | Signed domain license receipt. |
storage/app/playhub-*.json | Admin-managed settings persisted by each settings module. |
uploads/ | Local media and live replay outputs when local storage is active. |
gifts/, stickers/ | Local contribution catalog images. |
lang/ | Bundled and customized PHP language packs. |
livekit/runtime/ | Generated Compose, YAML, keys, certificates, status, and logs. |
build/ | Vite production frontend assets served to browsers. |
Use the support channel on the CodeCanyon item page Or the Direct Support portal. A reproducible report with sanitized logs can be diagnosed much faster than a screenshot without server context.
Never send passwords, database credentials, Redis passwords, full .env, LiveKit secrets, stream keys, payment keys, private certificates, purchase codes, or the signed license receipt in a public ticket.
PlayHub requires a valid CodeCanyon or KNL (Kontackt Direct License) purchase code during installation. Activation is tied to the installation domain and must follow the applicable Envato license. Do not redistribute the source package or share a purchase code.