Slyber TURN Server - High Performance Single Binary WebRTC TURN/STUN Server

Slyber TURN Server is a high-performance, standalone media traffic relay server (STUN/TURN) for WebRTC applications, engineered in Go on top of pion/turn/v4 as a modern zero-config alternative to coturn. Delivered as a single statically compiled binary for linux/amd64 and linux/arm64 with zero external system dependencies, it eliminates manual configuration files and external credential backends.

Automatic Configuration: Automatic external IPv4 discovery via STUN on startup.
Built-in HTTP API: Ready-to-use /api/turn-credentials endpoint with CORS and Rate Limiting, plus local HMAC-SHA1 token generation in 0 ms.
Multi-Core Scaling: UDP listener scaling across CPU cores via SO_REUSEPORT and automatic socket buffer tuning up to 8 MB.
Out-of-the-Box Security: Built-in SSRF filter (blocking Cloud Metadata 169.254.169.254, loopback, and private subnets) with full TURN Hairpinning support.
Built-in Diagnostics and Load Testing: slyber_turn doctor and slyber_turn bench tools are embedded directly into the binary to verify network connectivity, latency (RTT), packet loss, and RFC 3550 jitter.

One-Command Installation

The installation script automatically detects the CPU architecture (amd64 / arm64), verifies the SHA256SUMS checksum, tunes Linux kernel network buffers (sysctl), opens ports in ufw or firewalld, generates the configuration in /opt/slyber_turn/.env, registers the systemd service, and runs self-diagnostics.

1. Standard installation with automatic server configuration

Bash

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/install.sh | sudo bash

2. Custom installation with user-defined parameters

You can pass your desired REALM, custom TURN_SECRET, ports, or per-session bandwidth limit directly into the installation command:

Bash

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/install.sh | \
  sudo REALM="turn.example.com" \
       PUBLIC_IP="auto" \
       HTTP_PORT=":8080" \
       MAX_KBPS_PER_SESSION="2000" \
       bash

Upon completion, the script outputs the service status, the generated TURN_SECRET, and the slyber_turn doctor verification results

Code

[INFO] Detected platform: linux/amd64
[INFO] Downloading slyber_turn-linux-amd64...
[INFO] Verifying SHA256 checksum...
[OK] Checksum verified
[OK] Installed binary to /opt/slyber_turn/slyber_turn (symlinked to /usr/local/bin/slyber_turn)
[OK] Created initial configuration in /opt/slyber_turn/.env
[INFO] Applying UFW firewall rules...
[INFO] Running self-diagnostics...
--------------------------------------------------
[OK] Configuration valid (realm: turn.example.com, relay port pool: 49152-65535, capacity: 16384 sessions)
[OK] HTTP API protection active (origins: 1, require_secret: false)
[OK] STUN check passed in 12ms: PUBLIC_IP (203.0.113.50) matches external IP
[INFO] UDP port 3478 is already in use - switching to running server verification (Live Probe)...
[OK] HTTP API (:8080/healthz) responded normally (200 OK)
[OK] TURN Allocate succeeded in 390µs (allocated relay address: 203.0.113.50:50124)
--------------------------------------------------
[OK] Slyber Turn Server is installed and running.
  Service     : systemctl status slyber_turn
  Config file : /opt/slyber_turn/.env
  TURN Secret : 8f9d2a7b4c1e6f3a9b0c8d7e6f5a4b3c
  Diagnostics : sudo slyber_turn doctor
  Benchmark   : sudo slyber_turn bench -clients 20 -duration 5s

Service Management and Uninstallation

After installation, the server is managed using standard systemd commands and the built-in CLI utility

Bash

# Check service status and logs
sudo systemctl status slyber_turn
sudo journalctl -u slyber_turn -f

# Run diagnostics or load benchmark
sudo slyber_turn doctor
sudo slyber_turn bench -clients 20 -duration 5s

Uninstallation while preserving configuration and telemetry

By default, the uninstallation script stops the service and removes the systemd unit and binary files, while preserving the /opt/slyber_turn directory (the .env file, stats.json statistics history, and events.jsonl event log):

Bash

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/uninstall.sh | sudo bash

Complete uninstallation (including configuration and data)

If you need to completely remove all server files along with the /opt/slyber_turn directory, pass the PURGE_DATA=true variable

Bash

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/uninstall.sh | sudo PURGE_DATA=true bash

Key Technical Specifications

Component	Slyber TURN Server Implementation
Network Stack (Linux)	Multiple UDP sockets with `SO_REUSEPORT` (`TURN_THREADS=NumCPU`), automatic tuning of `net.core.rmem_max` / `wmem_max` up to 8 MB to eliminate packet loss during traffic spikes.
WebRTC Credential Provisioning	Built-in HTTP API (`/api/turn-credentials`) with `Origin` validation (including subdomains), IP/CIDR allowlist, Rate Limiter, and strict mode (`REQUIRE_SECRET=true`).
TLS Handling	In-memory Self-Signed ECDSA P-256 certificate generation.
SSRF Protection	Blocks requests to Cloud Metadata (`169.254.0.0/16`, `fd00:ec2::254/128`), loopback, and private networks with full TURN Hairpinning support and browser LAN noise filtering.
Session and Mobile Network Tracking	Groups sessions by `user_id` with automatic pruning of stale sockets after 5 seconds when a client switches between Wi-Fi and 4G/LTE.
Traffic Shaping	Lock-free atomic Token Bucket limiter (`MAX_KBPS_PER_SESSION`) for per-session bandwidth throttling.
Monitoring and Telemetry	Prometheus-compatible `/metrics` endpoint, `/api/node-stats` (24-hour history, port pool usage, Top Offenders), and persistent `/events` log (`events.jsonl`).

Feature	Slyber TURN	Coturn	Cloud TURN
Deployment	1 command	Manual config	SaaS account
Credential API	Built-in HTTP	External backend	Proprietary SDK
Kernel Tuning	Auto 8 MB	Manual sysctl	Managed
Built-in CLI Bench	Included	None	None
SSRF Metadata Block	Default	Manual ACLs	Managed
Mobile Handover Prune	5 seconds	Timeout based	Managed

Connecting to a WebRTC Application

1. Fetching TURN credentials from the browser

JavaScript

const res = await fetch("http://YOUR_SERVER_IP:8080/api/turn-credentials?user_id=user_42");
const turn = await res.json();

const pc = new RTCPeerConnection({
  iceServers: [{
    urls: turn.uris,
    username: turn.username,
    credential: turn.password
  }]
});

Smart SNG

Slyber TURN Server - High Performance Single Binary WebRTC TURN/STUN Server

One-Command Installation

Service Management and Uninstallation

Uninstallation while preserving configuration and telemetry

Complete uninstallation (including configuration and data)

Key Technical Specifications

Connecting to a WebRTC Application