Best way to host attachments remotely?

[Viper007Bond]

[edit] Nevermind, I think I'll just use the vB Image Hosting mod instead. [/edit]

I'm running vBulletin on a tri-server setup -- one webserver and one database server in one colo and a hosted box elsewhere for static stuff like images and such. I need to conserve as much bandwidth as possible on the webserver and instead use the low power, but huge bandwidth static box.

I'm currently using phpBB and hosting the avatars remotely. I do this by running a cron that syncs the avatars folder on the static box with the one on the webserver and then redirecting to the static box via a .htaccess file. Works quite well (except for the couple minutes after a user uploads an avatar and before the cron has had a chance to sync their image over, but that's handled by a pretty "coming soon" image). See it in action here.

Anyway, now that we're switching to vB, I'd like to do something like that for the attachment system. I've told vB to store the attachments as files on the webserver rather than in the database, but of course attachment.php still reads the file and then outputs the file contents in order to mask the URL/path of the attachment file.

I have come up with two ideas for serving the attachments off of the static box. Both start with creating a sync of the attachments folder on the static box (very easy to do). Then...

• Modify attachment.php to do redirect to the file on the static box after recording the download.
  
  The drawback of this is that it requires core file editing and the user can see the actual URL to the file. Not a big deal though as we can enable hotlinking protection.
  
  The advantage of this is that it's fairly easy.
  
  
• Make a copy of vB (as we need the includes and such) and move it all over to the static box, but delete all the main files but attachment.php so people can't actually use the forum there. This allows attachment.php to run on the static box and serve files from there. Redirecting to that attachment.php would be easy.
  
  The advantages of this is that permissions still apply and more importantly, no one will know the real URL of the attachments.
  
  The drawbacks are that it requires the static box to talk to the database server over the Internet (slow, probably somewhat insecure) to get the permissions and other stuff from the database.

Anyone have any thoughts or better ideas about this? I literally bought vB the day before yesterday, so I'm still learning what it can do and such.