How Configuration Is Loaded
On startup, slyber_turn searches for and loads the .env environment variables file in the following order:
- The path explicitly specified in the
ENV_FILEenvironment variable. - The
.envfile in the current working directory (./.env). - The
.envfile located in the same directory as theslyber_turnexecutable binary (resolving symlinks). - The default system path
/opt/slyber_turn/.env.
On top of environment variables, you can pass command-line flags (CLI) - they take the highest precedence and override values from .env.
Environment Variables (.env) and CLI Flags Reference
1. Network and Relay Settings (TURN/STUN)
| .env Variable | CLI Flag | Default | Description |
PUBLIC_IP | -public-ip | auto (or empty) | External public IPv4 address of the server. If set to auto or left empty, the server automatically detects its external IP on startup via STUN servers (stun.l.google.com:19302, stun.cloudflare.com:3478, stun1.l.google.com:19302) with a 2-second timeout. |
UDP_PORT | -udp-port | 3478 | Listening port for STUN and TURN over UDP. |
TCP_PORT | -tcp-port | 3478 | Listening port for STUN and TURN over TCP. |
RELAY_MIN_PORT | — | 49152 | Lower bound of the UDP port pool allocated for relaying client media streams. |
RELAY_MAX_PORT | — | 65535 | Upper bound of the UDP relay port pool. Total concurrent session capacity equals RELAY_MAX_PORT - RELAY_MIN_PORT + 1. |
TURN_THREADS | — | Number of CPU cores (runtime.NumCPU()) | Number of parallel UDP listeners (threads). On Linux, a value > 1 enables SO_REUSEPORT to distribute load across CPU cores. |
2. Authentication and Traffic Shaping
| .env Variable | CLI Flag | Default | Description |
TURN_SECRET | -secret | (required) | Secret key for HMAC-SHA1 password generation and HTTP API authentication. Minimum length is 16 characters. |
REALM | -realm | turn.local | TURN authentication realm domain (for example, example.com or rtc.example.com). |
CREDENTIAL_TTL_SEC | — | 7200 (2 hours) | Time-to-live (TTL) of issued temporary credentials in seconds. |
MAX_KBPS_PER_SESSION | -max-kbps | 0 (unlimited) | Maximum bandwidth per TURN session (allocation) in kilobits per second (1 Kbps = 1000 bps). |
MAX_BPS_PER_ALLOCATION | — | 0 (unlimited) | Alternative way to set the per-session bandwidth limit in bits per second (used if MAX_KBPS_PER_SESSION is not set). |
3. TLS Settings (turns: and HTTPS)
| .env Variable | CLI Flag | Default | Description |
TLS_PORT | -tls-port | 5349 | TCP port for encrypted TURN over TLS (turns:) connections. Enabled automatically if certificates are specified or TLS_SELF_SIGNED=true. |
TLS_CERT_FILE | — | "" | Path to the TLS certificate file (for example, fullchain.pem from Let's Encrypt). |
TLS_KEY_FILE | — | "" | Path to the TLS certificate private key (for example, privkey.pem). |
TLS_SELF_SIGNED | — | false | If true (and no certificate files are specified), the server automatically generates an in-memory self-signed ECDSA P-256 certificate valid for 1 year for the REALM domain, localhost, and PUBLIC_IP. |
Certificate Hot Reload: WhenTLS_CERT_FILEandTLS_KEY_FILEare specified, the server checks the certificate file's modification time once a minute and automatically reloads the updated certificate (for example, after renewal via Certbot) without restarting the server or dropping active calls.
4. HTTP API and Access Filtering Settings
| .env Variable | CLI Flag | Default | Description |
HTTP_ENABLED | -http-enabled | true | Enables or completely disables the built-in HTTP API server. |
HTTP_PORT | -http-port | :8080 | Address and port for the HTTP API (for example, :8080 or 127.0.0.1:8080). If the colon is omitted (for example, 8080), it is added automatically. |
HTTP_TLS | -http-tls | false | Enables HTTPS for the built-in HTTP API (uses the same TLS_CERT_FILE/TLS_KEY_FILE or TLS_SELF_SIGNED certificates). |
REQUIRE_SECRET | -require-secret | false | Strict HTTP API mode: if true, every request to /api/turn-credentials must include the X-Turn-Secret or Authorization: Bearer <secret> header. |
ALLOWED_ORIGINS | — | * | Comma-separated list of allowed CORS origins (for example, [https://shomla.com](https://shomla.com), http://localhost:3000). Automatically allows all subdomains of the specified domain as well. |
ALLOWED_IPS | — | "" (all allowed) | Comma-separated list of IP addresses or CIDR subnets (for example, 198.51.100.25, 10.20.0.0/16) allowed to access the HTTP API without a secret key. |
TURN_ALLOWED_PEER_IPS | — | "" (all allowed) | Allowlist of client IP addresses or CIDR subnets permitted to authenticate on the TURN server itself. |
5. Data Storage and Logging
| .env Variable | CLI Flag | Default | Description |
DATA_DIR | — | . | Directory for storing telemetry and event log files (stats.json and events.jsonl). In the systemd service, this defaults to /opt/slyber_turn. |
LOG_FORMAT | — | text | System log format in stdout: json (for log aggregation systems like Loki/ELK) or default text format. |
Startup Configuration Validation
Before starting, the server performs strict parameter validation (cfg.Validate()) and exits with a descriptive error if:
TURN_SECRETis shorter than 16 characters.PUBLIC_IPcould not be determined (invalid IP format or unreachable external STUN servers inautomode).UDP_PORT,TCP_PORT,TLS_PORT, orHTTP_PORTis outside the1–65535range.TLS_PORTis identical toTCP_PORT.UDP_PORTfalls within the relay port rangeRELAY_MIN_PORT–RELAY_MAX_PORT.HTTP_PORTconflicts withTCP_PORTorTLS_PORT.HTTP_TLS=trueis enabled, but neither certificates norTLS_SELF_SIGNED=trueare configured.