Slyber

Installing and Configuring Slyber SFU Server

Updated:
Author: Erkin Khidirov

Slyber SFU Server is distributed as a single static executable with zero external dependencies for Linux systems on amd64 (x86_64) and arm64 (aarch64) CPU architectures. The official installation script handles all routine system administrator tasks: it verifies the binary checksum, increases Linux kernel network buffers, creates an isolated system user, generates cryptographic secrets, opens firewall ports, and starts a background systemd service. If you deploy your infrastructure in containers, see Installing and Running in Docker with One Command.

Quick Installation on a Linux Server in One Command

Connect to your server via SSH and run the following command in the terminal with superuser privileges.

Bash 
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh | sudo bash

Installation takes less than 10 seconds. Upon completion, the script automatically runs the built-in slyber_sfu doctor diagnostic check and prints the generated secret keys for your new media server to the console.

Code 
[INFO] Detected platform: linux/amd64
[INFO] Downloading slyber_sfu-linux-amd64...
[INFO] Verifying SHA256 checksum...
[OK] Checksum verified
[OK] Created dedicated system user: slyber_sfu
[OK] Installed binary to /opt/slyber_sfu/slyber_sfu (symlinked to /usr/local/bin/slyber_sfu)
[OK] Created initial configuration in /opt/slyber_sfu/.env
[INFO] Running self-diagnostics...
================================================================
 SLYBER SFU DOCTOR | Version: v1.0.0 | Node: slyber-sfu-01
================================================================
 [OK] Environment        : production
 [OK] Public IP & Realm : 99.99.99.99 (slyber.com)
 [OK] Pion ICE Mux      : UDP :4443 | TCP :4443 (ICE-TCP=true) | HTTP :8090
 [OK] Auth & Security   : jwt (E2EE=false, External TURN=0)
 [OK] All Slyber SFU self-diagnostics passed.
================================================================

[OK] Slyber SFU Server is installed and running.
  Service     : systemctl status slyber_sfu (user: slyber_sfu)
  Config file : /opt/slyber_sfu/.env
  JWT Secret  : a8f9c2e71b340598d2c6e1a904f8b120
  TURN Secret : 7c4d9e1a2b8f3056c1e9d4a7b2f80314
  Node Secret : 3e8b1f6a9c2d4075e1a8b3c6d9f20481
  Diagnostics : sudo slyber_sfu doctor

What the install.sh Script Does Automatically

The script automates eight essential steps to prepare a production server:

  1. Architecture Detection and SHA256SUMS Verification. The script detects the CPU architecture (amd64 or arm64), downloads the matching binary from the official GitHub release, and verifies its checksum against SHA256SUMS using sha256sum.
  2. Time Synchronization and Linux Kernel Buffer Tuning. To ensure accurate token expiration checks, NTP time synchronization is enabled (timedatectl set-ntp true). The script then increases system socket read and write buffer limits to net.core.rmem_max=8388608 and net.core.wmem_max=8388608 (8 MB) and persists them in /etc/sysctl.d/99-slyber-sfu.conf so the Pion WebRTC stack can handle gigabit video streams without NIC packet drops.
  3. Unprivileged System User Creation. An isolated system user and group slyber_sfu are created with home directory /opt/slyber_sfu and interactive shell login disabled (/usr/sbin/nologin).
  4. Binary Installation. The executable is copied to /opt/slyber_sfu/slyber_sfu with permissions 0755, and a symbolic link is created at /usr/local/bin/slyber_sfu for convenient execution from any directory.
  5. Public IP Detection and Secret Generation in .env. If /opt/slyber_sfu/.env does not already exist, the script automatically detects the server's public IPv4 address, generates three unique 32-character cryptographic keys (JWT_SECRET, TURN_SECRET, and NODE_SECRET) from /dev/urandom, and locks down the file with chmod 600. Re-running the script preserves any existing .env file without overwriting it.
  6. Automatic Firewall Configuration. If UFW or firewalld is active on the server, the script automatically opens media ports 4443/udp and 4443/tcp along with the HTTP gateway port 8090/tcp.
  7. systemd Service Registration and Startup. A systemd unit /etc/systemd/system/slyber_sfu.service is created with a high open file descriptor limit (LimitNOFILE=1048576), privileged port binding capability (AmbientCapabilities=CAP_NET_BIND_SERVICE), privilege escalation protection (NoNewPrivileges=true), and automatic restart on failure (Restart=always).
  8. Final Self-Diagnostics. Once the service starts, the script executes slyber_sfu doctor to confirm the media server is ready to accept calls.

Installing with Custom Parameters and Authentication Modes

You can pass custom port settings, domain names, authentication modes, or a specific release version at installation time via environment variables (detailed descriptions of all authentication modes are available in Authentication and SFrame E2EE End-to-End Encryption).

Installing with a Custom Domain and Secret Mode

Bash 
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh | \
  sudo env \
  REALM="video.example.com" \
  AUTH_MODE="secret" \
  SFU_UDP_PORT="4443" \
  SFU_TCP_PORT="4443" \
  SFU_HTTP_PORT="8090" \
  bash

Installing with Redis Backend Integration

Bash 
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh | \
  sudo env \
  AUTH_MODE="redis" \
  REDIS_ADDR="127.0.0.1:6379" \
  REDIS_PASSWORD="your_redis_password" \
  REDIS_DB="0" \
  bash

Installing a Specific Release Version

Bash 
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh | \
  sudo env VERSION="v1.0.0" bash

File Locations and Managing the systemd Service

All runtime files for the media server are placed in the following system paths:

  • /opt/slyber_sfu/slyber_sfu and symlink /usr/local/bin/slyber_sfu contain the main server binary.
  • /opt/slyber_sfu/.env stores all environment variables and node secret keys (readable only by the slyber_sfu user and root).
  • /etc/systemd/system/slyber_sfu.service contains the background service unit configuration.
  • /etc/sysctl.d/99-slyber-sfu.conf stores Linux kernel network buffer settings.

If you modify parameters in /opt/slyber_sfu/.env (for instance, adding external relay servers to EXTERNAL_TURN_URLS or enabling end-to-end encryption with REQUIRE_E2EE=true), restart the service and verify the configuration using the commands below.

Bash 
# 1. Open the configuration file for editing
sudo nano /opt/slyber_sfu/.env

# 2. Restart the service to apply the new settings
sudo systemctl restart slyber_sfu

# 3. Check the service status
sudo systemctl status slyber_sfu

# 4. View real-time event logs and statistics
sudo journalctl -u slyber_sfu -f

# 5. Run self-diagnostics with the active .env settings
sudo bash -c 'set -a && source /opt/slyber_sfu/.env && set +a && slyber_sfu doctor'

Command-Line Flags for Manual Startup

In addition to environment variables in the .env file, the slyber_sfu binary supports passing parameters via CLI flags (for the full list of environment variables, see Docker Launch and Environment Variables Reference).

  • -env sets the runtime environment (development or production).
  • -node-id sets the unique node identifier in a cluster (default: slyber-sfu-01).
  • -public-ip specifies the server's external IPv4 address for ICE candidates (or auto for automatic detection).
  • -realm sets the authentication domain (default: slyber.com).
  • -udp-port and -tcp-port set the unified Pion ICE port for UDP and TCP (default: 4443).
  • -http-port sets the HTTP and WebSocket gateway port (default: 8090).
  • -enable-ice-tcp enables the RFC 4571 multiplexer for WebRTC over TCP (default: true).
  • -allow-port-fallback allows automatically picking the next available port if the configured port is busy.
  • -socket-buffer sets the UDP socket buffer size in bytes (default: 8388608).
  • -auth-mode selects the participant token verification mode (jwt, redis, or secret).
  • -jwt-secret, -turn-secret, and -node-secret set the secret keys (minimum 24 characters in production).
  • -external-turn-urls accepts a comma-separated list of external TURN server URLs.
  • -allowed-origins sets a list of allowed domains for WebSocket and CORS requests.
  • -require-e2ee enforces mandatory SFrame end-to-end encryption validation across all rooms.
  • -max-kbps-track and -max-kbps-session limit incoming bitrate per track and per participant session.
  • -nack-buffer sets the NACK ring buffer size per spatial layer (default: 512).
  • -last-n limits the maximum number of simultaneously active video streams in a room (default: 16).
  • -dynacast enables automatic pausing of unused spatial video layers.

Updating and Uninstalling the Server

To upgrade an installed server to the latest release without losing your settings and secret keys in /opt/slyber_sfu/.env, simply re-run the install.sh command. The script replaces the binary with the new version, preserves your existing .env file, and smoothly restarts the service.

To remove the service and executable binary, use the official uninstall.sh script.

Bash 
# Standard uninstall (stops the service and removes the binary, preserving /opt/slyber_sfu/.env)
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/uninstall.sh | sudo bash

# Complete uninstall including the /opt/slyber_sfu config directory and slyber_sfu system user
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/uninstall.sh | sudo env PURGE_DATA=true bash

Once the server is running, you can proceed to connecting client applications using Signaling Protocol, Simulcast, SVC, and Quality Control or test broadcast gateways in WHIP and WHEP Gateways, AI Voice Pipeline, and Telemetry.

← Previous Overview and Architecture of Slyber SFU Server Next → WebSocket Signaling, Simulcast and SVC Routing, QoS, and Fast Swap