Installation and Quick Start

1. System Requirements

Supported Platforms

• Operating System: Linux (Ubuntu, Debian, CentOS, RHEL, Rocky Linux, AlmaLinux, Fedora, etc.) with the systemd init system.
• CPU Architecture:
• amd64 (x86_64) - standard cloud and dedicated servers (Intel / AMD).
• arm64 (aarch64) - ARM-based servers.
• Utilities: curl installed for downloading the installation script and binary.

Security Model and Permissions

• During installation (| sudo bash): Superuser privileges (root / sudo) are required only once when running the installation script to tune Linux kernel network buffers (sysctl), open ports in the system firewall (UFW / firewalld), and register the systemd service.
• At runtime: The slyber_turn binary itself does not run as root. The installer automatically creates an isolated, unprivileged system user slyber_turn without a home directory (--no-create-home) and without interactive shell login access (/usr/sbin/nologin).
• Process hardening in systemd:
• The service starts with the NoNewPrivileges=true directive, blocking any privilege escalation by the process.
• The process is granted only a single targeted Linux kernel capability - AmbientCapabilities=CAP_NET_BIND_SERVICE. This allows slyber_turn, while remaining an unprivileged user, to bind to ports below 1024 if needed (for example, port 443 for TLS_PORT to bypass strict corporate firewalls).

2. Required Network Ports

3. Automated One-Command Installation

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/install.sh | sudo bash

What the Installer Does Step by Step:

• Platform Detection: Checks the OS and CPU architecture (amd64 or arm64), selecting the corresponding slyber_turn-linux-<arch> binary.
• Download and SHA256 Cryptographic Verification: Downloads the binary from the slyber-app/slyber-turn-server repository releases (or from the fallback main/bin branch) into a temporary directory and verifies its checksum against the SHA256SUMS file.
• System Time Synchronization (NTP): Enables the network time service (timedatectl set-ntp true). Because temporary TURN passwords embed an expiration Unix timestamp (timestamp:user_id), synchronized server clocks are mandatory.
• Linux Kernel Network Stack Tuning (sysctl): Sets the maximum kernel socket read and write buffer sizes to 8 MB (net.core.rmem_max=8388608 and net.core.wmem_max=8388608) and saves them to /etc/sysctl.d/99-slyber-turn.conf. This prevents UDP packet drops under heavy load.
• Creating the slyber_turn System User: Creates an isolated slyber_turn user account under which the service will run.
• Installing Files and Generating .env:
• Installs the binary to /opt/slyber_turn/slyber_turn and creates a global symlink at /usr/local/bin/slyber_turn.
• Creates the /opt/slyber_turn/certs directory for storing SSL/TLS certificates.
• If /opt/slyber_turn/.env does not exist yet, generates a random 32-character cryptographically secure TURN_SECRET key via /dev/urandom and creates the initial configuration file.
• Sets chmod 750 permissions on the /opt/slyber_turn directory, chmod 600 on .env, and assigns ownership to slyber_turn:slyber_turn.
• Automatic Firewall Configuration (UFW / firewalld): If UFW or firewalld is active on the system, the script automatically opens ports 3478/udp, 3478/tcp, 5349/tcp, and the range 49152:65535/udp.
• Starting the systemd Service and Self-Diagnostics: Registers and starts the slyber_turn.service unit with an open file descriptor limit of LimitNOFILE=1048576, then automatically runs the slyber_turn doctor check and prints the generated TURN_SECRET to the console.

4. Installation with Custom Parameters

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/install.sh | sudo \
  REALM="turn.yourdomain.com" \
  PUBLIC_IP="auto" \
  TURN_SECRET="my-custom-production-secret-key-2026" \
  UDP_PORT=3478 \
  TCP_PORT=3478 \
  TLS_PORT=5349 \
  HTTP_PORT="127.0.0.1:8080" \
  MAX_KBPS_PER_SESSION=3000 \
  VERSION="latest" \
  bash

Supported Installer Variables:

• VERSION - release version to download (defaults to latest).
• TURN_SECRET - custom secret key (minimum 16 characters; auto-generated if omitted).
• REALM - server domain realm (defaults to turn.local).
• PUBLIC_IP - external IPv4 address of the server or auto for automatic STUN detection (defaults to auto).
• UDP_PORT, TCP_PORT, TLS_PORT - STUN/TURN ports (default to 3478, 3478, 5349).
• HTTP_PORT - HTTP API address and port (defaults to :8080; specify 127.0.0.1:8080 if the API should only be accessible locally).
• MAX_KBPS_PER_SESSION - per-session bandwidth limit in Kbps (defaults to 0 - unlimited).

5. File System Layout

Important when configuring custom TLS certificates:

If you copy Let's Encrypt certificates from /etc/letsencrypt/live/... into /opt/slyber_turn/certs/, make sure the slyber_turn user has read permissions for them:

sudo chown -R slyber_turn:slyber_turn /opt/slyber_turn/certs
sudo chmod 600 /opt/slyber_turn/certs/*

6. Server Management, Verification, and Updates

Managing the systemd Service:

# Check server status
sudo systemctl status slyber_turn

# Restart the server after editing /opt/slyber_turn/.env
sudo systemctl restart slyber_turn

# Stop the server
sudo systemctl stop slyber_turn

# View server logs in real time
sudo journalctl -u slyber_turn -f

Quick Post-Installation Check:

sudo slyber_turn doctor

sudo slyber_turn bench -clients 20 -duration 5s

Updating to a New Version:

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/install.sh | sudo bash

7. Uninstalling the Server

1. Standard Uninstall (preserving .env and statistics)

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/uninstall.sh | sudo bash

2. Complete Purge

curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/uninstall.sh | sudo PURGE_DATA=true bash