English Русский

Slyber SFU Server - WebRTC Media Router

Slyber SFU Server - WebRTC Media Router
View project

Slyber SFU Server is a high-performance, zero-dependency Selective Forwarding Unit (SFU) for real-time WebRTC audio, video, and data routing, engineered in Go on top of Pion WebRTC v4. Distributed as a single statically compiled binary for linux/amd64 and linux/arm64 (as well as a minimal Alpine Docker image), it powers group video conferencing, sub-millisecond 1-on-1 video roulettes, low-latency WHIP/WHEP broadcasting, and full-duplex AI voice agent pipelines-designed to pair seamlessly with Slyber TURN Server.

  • Single-Port Multiplexing: All ICE-Lite, DTLS-SRTP, and RFC 4571 ICE-TCP media sessions run over a single port 4443 (UDP & TCP) via ICEUDPMux and ICETCPMux, eliminating 10,000+ ephemeral firewall port ranges.
  • Adaptive Simulcast & VP9 SVC: Per-viewer bandwidth estimation (SubscriberBWE via TWCC, REMB, and RTCP Receiver Reports) with per-layer PacketRingBuffer NACK recovery and independent 500ms PLICoalescer filters.
  • Zero-Allocation Hot Path & <1ms Roulette Swap: Packet routing backed by atomic reference-counted sync.Pool buffers and SeqTimestampRewriter for instantaneous peer switching without SDP renegotiation.
  • Full-Duplex AI Voice Gateway (/ai/ws): Native WebSocket audio pipe with a built-in 20ms RTP pacer, 6-bot multiplexing (mode=mux), and RFC 6464 header-based VAD Barge-In interruption.
  • Zero-Trust Security & Gateways: Enforced RFC 9605 SFrame E2EE with MLS key rotation, RFC 9626 Frame Marking layer routing, 1-RTT WHIP/WHEP streaming, MoQ Draft-22 packaging, and HMAC-SHA256 inter-server cascading with SSRF filtering.

One-Command Production Installation

The installation script automatically detects the CPU architecture (amd64 / arm64), verifies the SHA256SUMS checksum, tunes Linux kernel socket buffers (net.core.rmem_max / wmem_max up to 8 MB), configures firewall rules, generates cryptographic secrets in /opt/slyber_sfu/.env, registers the systemd unit, and runs self-diagnostics.

1. Standard installation on Linux (systemd)

Bash 
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh | sudo bash

2. Containerized deployment via Docker CLI

Bash 
docker pull ghcr.io/slyber-app/slyber-sfu-server:latest
docker rm -f slyber-sfu-server 2>/dev/null || true

PUBLIC_IP=$(curl -fsSL4 --max-time 2 api.ipify.org 2>/dev/null || echo 127.0.0.1)
TURN_SECRET=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c 32)
JWT_SECRET=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c 32)
NODE_SECRET=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c 32)

docker run -d \
  --name slyber-sfu-server \
  --restart unless-stopped \
  -p 4443:4443/udp \
  -p 4443:4443/tcp \
  -p 8090:8090/tcp \
  -e SFU_ENV="production" \
  -e PUBLIC_IP="${PUBLIC_IP}" \
  -e REALM="slyber.com" \
  -e SFU_UDP_PORT="4443" \
  -e SFU_TCP_PORT="4443" \
  -e SFU_HTTP_PORT="8090" \
  -e AUTH_MODE="jwt" \
  -e TURN_SECRET="${TURN_SECRET}" \
  -e JWT_SECRET="${JWT_SECRET}" \
  -e NODE_SECRET="${NODE_SECRET}" \
  ghcr.io/slyber-app/slyber-sfu-server:latest \
  && sleep 1 && docker exec slyber-sfu-server slyber_sfu doctor

Upon startup, the built-in slyber_sfu doctor utility validates network sockets, public IP routing, authentication secrets, and Redis reachability:

Code 
================================================================
 SLYBER SFU DOCTOR | Version: v1.0.0 | Node: slyber-sfu-01
================================================================
 [OK] Environment       : production
 [OK] Public IP & Realm : 89.111.175.67 (slyber.com)
 [OK] Pion ICE Mux      : UDP :4443 | TCP :4443 (ICE-TCP=true) | HTTP :8090
 [OK] Auth & Security   : jwt (E2EE=true, External TURN=1)
 [OK] All Slyber SFU self-diagnostics passed.
================================================================

Architectural Deep Dives

For a detailed engineering breakdown of the internal subsystems behind Slyber SFU Server, read the companion architectural articles:

Key Technical Specifications

SubsystemSlyber SFU Server Implementation
WebRTC Transport MuxPion WebRTC v4 in ICE-Lite mode; single port 4443/UDP (ICEUDPMux) and 4443/TCP (RFC 4571 ICETCPMux) with public IP candidate rewriting and 8 MB OS socket buffers.
Packet Memory EngineLock-free sync.Pool packet recycling with atomic reference counting (Retain / Release) and in-place RTP header/padding parsing.
Simulcast, SVC & QoS3 spatial layers (q/h/f) and VP9 SVC filtering; per-layer 512-packet NACK ring buffers; independent 500ms PLICoalescer filters; SubscriberBWE controller (TWCC, REMB, RTCP RR).
Conference & RouletteRFC 6464 audio-level active speaker detection, EnforceLastNVideo camera pausing, and FastSwapRouletteTrack (<1ms swap) with monotonic sequence/timestamp rewriting.
Authentication & Rate LimitsConstant-time verification for HS256 JWT (with capability claims), pooled Redis sessions (instant revocation), and HMAC-SHA1 tokens, plus atomic token-bucket rate limiting (TrafficPolice).
End-to-End EncryptionRFC 9605 SFrame validation with up to 16 MLS keys per SSRC, 512-packet anti-replay bitmap window, and unencrypted RFC 9626 Frame Marking layer inspection.
Gateways & TelemetryWHIP/WHEP (1-RTT OBS ingest), full-duplex /ai/ws voice pipe, MoQ Draft-22 relay, HMAC-SHA256 UDP node cascade with SSRF protection, and Prometheus /metrics.
CapabilitySlyber SFUTraditional C++ SFUsManaged Cloud SFUs
Deployment Artifact1 static Go binaryMulti-library native buildsProprietary SaaS
Media Firewall Ports1 port (4443 UDP/TCP)10,000+ UDP portsManaged
AI Voice Bot GatewayBuilt-in /ai/ws + 20ms pacerCustom WebRTC/GStreamer glueExtra add-on / high latency
1v1 Roulette Track Swap<1ms pointer swap (0 SDP)Full SDP renegotiationRe-subscribe delay
SFrame E2EE ValidationNative RFC 9605 + MLSManual insertable streamsEnterprise tier only

Connecting a Client via WebSocket Signaling

Clients connect to /ws, authenticate with a signed JWT, exchange SDP Offer/Answer, and subscribe to remote tracks (full signaling protocol reference):

JavaScript 
const ws = new WebSocket("wss://sfu.example.com/ws");
const pc = new RTCPeerConnection({ bundlePolicy: "max-bundle" });

ws.onopen = async () => {
  const offer = await pc.createOffer();
  await pc.setLocalDescription(offer);
  ws.send(JSON.stringify({
    type: "join",
    room_id: "conference-alpha",
    token: "YOUR_HS256_JWT_TOKEN",
    sdp: offer.sdp
  }));
};

ws.onmessage = async ({ data }) => {
  const msg = JSON.parse(data);
  if (msg.type === "joined" && msg.sdp) {
    await pc.setRemoteDescription({ type: "answer", sdp: msg.sdp });
  } else if (msg.type === "publish_track") {
    ws.send(JSON.stringify({ type: "subscribe_track", track_id: msg.track_id, spatial_layer: 2 }));
  } else if (msg.type === "offer") {
    await pc.setRemoteDescription({ type: "offer", sdp: msg.sdp });
    const answer = await pc.createAnswer();
    await pc.setLocalDescription(answer);
    ws.send(JSON.stringify({ type: "answer", sdp: answer.sdp }));
  }
};