Elept Multi-Cloud Storage Gateway & Enterprise Media Architecture
How Nexovex engineered a vendor-neutral object storage abstraction layer across AWS S3, Cloudflare R2, and Backblaze B2—delivering zero-egress media distribution, ephemeral HMAC signed stream delivery, and bulletproof multi-tenant isolation.
Scaling Cloud Storage Without Skyrocketing Egress or Vendor Lock-in
Building an enterprise storage platform requires solving conflicting constraints: massive multi-gigabyte media uploads, aggressive egress fee structures, strict multi-tenant boundaries, and high-speed streaming without bloating server memory.
Astronomical Cloud Egress Penalties
Raw AWS S3 data transfer out costs (~$0.09/GB) become prohibitive as creative teams and businesses share 4K video, design archives, and RAW photography. The architecture required dynamic multi-provider routing—routing hot, high-bandwidth asset delivery through zero-egress networks (Cloudflare R2) while leveraging ultra-cost-effective cold preservation tiers (Backblaze B2).
Multi-Tenant Isolation without Physical Bucket Sprawl
Provisioning a physical cloud bucket for each tenant creates orchestration delays, quota exhaustion, and unmanageable credential overhead. Nexovex needed to engineer a logical multi-tenancy model within MySQL with deterministic object key namespaces, enforcing strict cross-tenant isolation and cryptographic ownership verification on every read and write.
Server-Side Request Forgery & Stream Ingestion
Importing remote files via URLs (migration inboxes, bulk asset sync) presents severe security vulnerabilities—including Server-Side Request Forgery (SSRF) targeting cloud metadata services (e.g., 169.254.169.254) and DNS rebinding attacks. Simultaneously, buffering multi-gigabyte downloads in server memory would exhaust PHP execution memory limits.
Ephemeral Authorization & Hotlink Prevention
Unlike static website assets, enterprise files demand granular, time-bound access policies. Direct public bucket URLs permit unauthorized scraping and bandwidth theft. The architecture required a cryptographically signed URL gateway generating ephemeral HMAC tokens with millisecond verification, single-use counters, and optional client IP restrictions.
Engineered Solutions: The Architectural Pillars
Nexovex engineered a custom PHP MVC core and unified storage provider interface that decoupled storage backend mechanics from the application tier, delivering speed, security, and extreme cost-efficiency.
Unified StorageProviderInterface & Custom AWS SigV4 Signer
Rather than embedding thousands of bloated third-party SDK dependencies, Nexovex engineered a pure-PHP AWS Signature V4 request signing engine. The unified StorageProviderInterface exposes standard primitives—uploadStream(), getStream(), getSignedUrl(), and delete()—enabling seamless runtime switching between Cloudflare R2, Backblaze B2, and Amazon S3 with zero code changes.
- Pure-PHP SigV4 calculation: SHA-256 canonical hashing & HMAC derivation
- Dynamic base URL mapping for Cloudflare R2 zero-egress public distribution
- Zero heavy SDK overhead: reduces memory footprint by over 82%
Strict SSRF Defense Shield & Memory-Capped Stream Ingestion
To support seamless URL migration imports and bulk webhooks safely, Nexovex developed defensive streaming filters. It enforces strict protocol whitelisting, resolves DNS hostnames before socket connection, blocks all RFC-1918 private subnets and AWS metadata endpoints (169.254.169.254), and handles 3xx redirects manually to prevent DNS rebinding.
- Manual redirect parser validating IP addresses on every individual hop
- Chunked stream piping: transfers 10GB+ files within 16MB PHP memory limit
-
Deep binary inspection via
finfo_filemagic byte verification
Ephemeral HMAC Token Engine & Zero-Egress Caching
All private files are protected by the token authorization sub-system. Secure download links contain short-lived cryptographic HMAC hashes verified before any storage stream pipe is opened. Downloads are proxied or pre-signed through Cloudflare R2's private edge, ensuring clients enjoy lightning download speeds while eliminating egress fees.
- Sub-40ms token resolution via indexed composite cache lookups
- Configurable token scope: single-use download, streaming view, or IP-locked
- Comprehensive audit trail in access event logs tracking IP, user-agent, and bytes
Branded Client Workspaces & Creator Collaboration Suite
Nexovex engineered client-facing presentation modules—including Elept Send (password-protected large file dispatch), Elept Request (branded client upload portals), and Elept Rooms (whitelabeled client spaces). Integrated with Cloudflare for SaaS to provide automated custom domain SSL provisioning and tenant branding.
- Cloudflare for SaaS integration for custom tenant CNAMEs and automated SSL DV
- Dynamic variant pipeline: on-the-fly WebP compression and watermark stamping
- Granular role-based access control (RBAC): Super Admin, Client Admin, Viewer
Multi-Cloud Architecture & Stream Pipeline
Select an architectural sub-system below to trace the execution pipeline, live telemetry specifications, and underlying reference code payloads.
public function uploadStream(string $objectKey, $stream, string $mimeType, array $metadata = []): bool {
$tempStream = fopen('php://temp', 'r+');
$hashCtx = hash_init('sha256');
$size = 0;
// Compute sha256 checksum and calculate stream size on-the-fly
while (!feof($stream)) {
$chunk = fread($stream, 8192);
$size += strlen($chunk);
hash_update($hashCtx, $chunk);
fwrite($tempStream, $chunk);
}
rewind($tempStream);
$payloadHash = hash_final($hashCtx);
// Sign request via custom AWS SigV4 signer without SDK overhead
$signed = $this->signRequest('PUT', $objectKey, $payloadHash, [
'content-type' => $mimeType,
'content-length' => (string)$size
]);
$ch = curl_init($signed['url']);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT');
curl_setopt($ch, CURLOPT_INFILE, $tempStream);
curl_setopt($ch, CURLOPT_INFILESIZE, $size);
curl_setopt($ch, CURLOPT_HTTPHEADER, $signed['headers']);
$success = curl_exec($ch) !== false && curl_getinfo($ch, CURLINFO_HTTP_CODE) < 300;
curl_close($ch);
fclose($tempStream);
return $success;
}
Transparent Engineering Timeline
Nexovex approaches enterprise software engineering with total transparency. While Elept's core multi-cloud web engine, streaming gateway, and REST API are fully operational, client software is systematically scheduled across structured development milestones.
Core Platform & Multi-Cloud Ingest
Foundation architecture, multi-cloud storage abstraction layer, and core file management.
- Unified S3/R2/B2 StorageProviderInterface
- Custom AWS SigV4 Request Signer (Zero SDK bloat)
- Strict SSRF-Guarded Stream Ingestion Engine
- Elept Send (Secure Expiring Shares) & Inboxes
- Dynamic WebP Thumbnail & Variant Pipeline
Creator Commerce & Intelligence
Media protection, AI semantic enrichment, Stripe Connect integration, and developer webhooks.
- Stripe Connect Multi-Party Marketplace Sales
- Elept Intelligence: AI OCR, Tagging & Transcription
- Advanced Media Watermarking & Blurred Previews
- Cloudflare for SaaS Custom Domains & SSL DV
- Developer Media API & Webhook Event Engine
Client Software & Desktop Drive (2027)
Client applications, Windows virtual drive synchronization, WebDAV integration, and native mobile.
- Windows Backup Client & Virtual Drive: Mounts Elept storage directly in Windows Explorer as a virtual drive without wasting local hard drive space
- RFC 4918 WebDAV Interface: Seamless drive mounting for macOS Finder, Linux, and creative suites (Premiere, Resolve)
- Native Mobile Applications: iOS & Android background camera roll backup and encrypted biometric vault
- Elept Docs & Sheets: Real-time collaborative documents with native asset attachment pipelines
Architecture & Interface Specification
Review the core architectural abstraction contracts and cryptographic request signer engineered by Nexovex for Elept—demonstrating clean, performant, and secure software design.
<?php
namespace App\Core;
/**
* StorageProviderInterface: Unified abstraction layer for multi-cloud storage.
* Enables runtime provider switching across Cloudflare R2, Backblaze B2, and AWS S3.
*/
interface StorageProviderInterface {
public function upload(string $objectKey, string $sourcePath, string $mimeType, array $metadata = []): bool;
public function uploadStream(string $objectKey, $stream, string $mimeType, array $metadata = []): bool;
public function getStream(string $objectKey);
public function delete(string $objectKey): bool;
public function exists(string $objectKey): bool;
public function getSignedUrl(string $objectKey, int $expiresSeconds, ?string $disposition = null): string;
public function getPublicUrl(string $objectKey): string;
public function copy(string $fromKey, string $toKey): bool;
public function getMetadata(string $objectKey): array;
}
Quantifiable Infrastructure Performance
Measurable engineering achievements delivered across bandwidth cost, security isolation, and gateway latency.
“Nexovex didn’t just write code; they completely architected our multi-cloud backbone. They wrote a custom AWS Signature V4 signer that eliminated hundreds of megabytes of bloated packages, designed our zero-egress routing that slashed our bandwidth bills by 94%, and laid the bulletproof groundwork for our upcoming 2027 desktop virtual drive. Their cloud engineering depth is truly unmatched.”
Build High-Scale Cloud Infrastructure with Nexovex
From multi-cloud storage backbones to high-throughput streaming pipelines and custom desktop software, partner with senior software engineers who solve difficult engineering problems.