# Slyber SFU Server - WebRTC Media Router for Calls, Webinars, and AI Bots > Source: > Published: 2026-11-15 05:44:40+00:00 Hey devs! 👋 In this overview, I will explain in simple terms what **Slyber SFU Server** is, why it is needed, how it works under the hood, and what problems it solves out of the box. High performance WebRTC Selective Forwarding Unit (SFU) built with Go and Pion WebRTC v4, featuring a single port ICE-Lite UDP/TCP multiplexer, Simulcast & VP9 SVC routing, WHIP/WHEP broadcasting, SFrame End to End Encryption (E2EE), inter-node HMAC cascading, and a full duplex AI voice WebSocket pipe. `sync.Pool` packet buffers (`SlyberPacket`), atomic reference counting, in place RFC 3550/8285 header parsing, and copy on write subscriber snapshots.`ICEUDPMux`), RFC 4571 ICE-TCP (` ICETCPMux`), DTLS-SRTP encryption, TWCC sender feedback, and NACK generation on a single media port (`4443` by default).`ClampSpatialLayer`), per layer NACK… **Slyber SFU Server** is a real time selective audio, video, and data routing server written in Go. It is distributed as a single static binary with zero external dependencies and handles group video conferences, 1 on 1 calls, live streaming (for example, from OBS Studio), and voice conversations with AI agents. It can also be deployed via Docker. When two people make a direct call in a browser, their devices exchange video and audio without intermediaries. However, as soon as 10 people join a room, peer to peer connections break down: each participant's browser is forced to compress and upload **9 separate copies** of their video and audio one for every other participant. Phones quickly overheat, and batteries drain rapidly. An **SFU (Selective Forwarding Unit)** acts like an automated mail sorting center: I designed the server so that it can be deployed on a clean Linux machine in one minute without manually editing configuration files. Here is what the system consists of: `:4443` for Both UDP and TCP In Slyber SFU Server, all media traffic across all rooms flows through a single port `4443`. At the ingress, it uses `ICEUDPMux` and `ICETCPMux` multiplexers (RFC 4571 standard): `8090/TCP` port handles WebSocket signaling (`/ws`), broadcast gateways, and telemetry metrics.` q`, `h`, `f` layers for example, 270p, 540p, and 1080p) and the scalable `SubscriberBWE` bandwidth controller continuously monitors reports from each viewer (`TWCC`, `REMB`, `RTCP Receiver Report`). As soon as a specific viewer's bandwidth drops or packet loss increases, the server smoothly switches In a 30 person group call, there is no point in transmitting video from all 28 silent participants. The server reads the audio volume level from the unencrypted **RFC 6464** (`ssrc-audio-level`) packet header without decrypting the voice payload itself. The `EnforceLastNVideo` mechanism automatically pauses cameras of silent participants and instantly resumes their video starting with a keyframe as soon as they begin speaking. In standard WebRTC, switching conversation partners requires re-exchanging SDP Offer/Answer messages, which leaves the viewer staring at a black screen for 1–2 seconds. For the `roulette_1v1` profile, Slyber SFU implements the `FastSwapRouletteTrack` method. Candidate streams are pre-warmed at ingress, and switching happens simply by flipping an internal pointer. The `SeqTimestampRewriter` module aligns packet sequence numbers (`SequenceNumber`) and timestamps of the new partner on the fly so the viewer's browser perceives the stream as continuous with zero gaps and zero SDP renegotiation. `/ai/ws` Gateway for AI Voice Agents To add a voice bot powered by Gemini Live or the OpenAI Realtime API to a call, you do not need to run a heavy WebRTC stack in Python or Node.js. Simply connect your AI backend to the built-in `/ai/ws` WebSocket gateway: `mode=mux`):` ai_vad_barge_in` event to your backend.`WHIP/WHEP`), `MoQ`, and Server Cascading `POST /whip/{room}/{track}` and distribute to viewers via `POST /whep/{room}/{track}` in a single HTTP request with `ETag`-based stream owner protection.` moqt-draft-22` objects (`/moq/{room}/{track}`).`/cascade/`):` HMAC-SHA256-128` cryptographic signature on every packet and built-in SSRF protection against attacks on local subnets.`HS256 JWT` tokens (with granular permissions like `can_publish`, `can_subscribe`, `max_spatial_layer`), a pooled `Redis` connection (instant access revocation upon deleting the `slyber:session:` key), or stateless `HMAC-SHA1` tokens.`REQUIRE_E2EE=true` is enabled, the server validates `TrafficPolice` shaper enforces bitrate limits per track and per session. | Subsystem | Slyber SFU Server Implementation | |---|---| | **Stack & Build** | Go + `pion/webrtc/v4` ; single static binary for Linux and macOS (`amd64` ,`arm64` ) | | **Network Transport** | `ICE-Lite` mode; single port`4443` for UDP (`ICEUDPMux` ) and TCP (`RFC 4571 ICETCPMux` ); HTTP/WS gateway on`8090` ; auto-tuning of OS socket buffers up to 8 MB | | **Codecs** | Video: `VP9` (including SVC),`AV1` ,`H264` ,`VP8` ; Audio:`Opus` 48 kHz stereo with Inband FEC | | **Room Profiles** | 5 ready-to-use modes: `conference` ,`roulette_1v1` ,`broadcast` ,`gaming` ,`ai_voice` (up to 5,000 active rooms per node) | | **Quality & QoS** | Simulcast (3 layers), VP9 SVC, `SubscriberBWE` (TWCC/REMB/RR), per-layer NACK ring buffers (512 packets), per-layer`PLICoalescer` (500 ms),`Last-N` via RFC 6464 | | **Gateways & Clustering** | `WHIP/WHEP` , full-duplex`/ai/ws` (`mode=mux` , 20 ms pacer, VAD Barge-In),`MoQ` (`moqt-draft-22` ), UDP`/cascade/` with`HMAC-SHA256-128` | | **Security** | `jwt` ,`redis` , and`secret` auth modes; dedicated`NODE_SECRET` key;`RFC 9605 SFrame` E2EE + MLS;`TrafficPolice` rate limiter | | **Monitoring** | JSON telemetry at `/inspector/stats` , Prometheus`/metrics` exporter, and built-in`slyber-sfu doctor` CLI diagnostics | Install the server on a clean Linux host in one command the script downloads the binary, verifies the `SHA256SUMS` checksum, tunes kernel network buffers, generates secret keys in `/opt/slyber_sfu/.env`, opens port `4443`, and starts the `systemd` service: ``` curl -fsSL [https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh](https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh) | sudo bash ``` Or run it in Docker from the official GitHub Container Registry: ``` docker pull ghcr.io/slyber-app/slyber-sfu-server:latest docker rm -f slyber-sfu-server 2>/dev/null || true PUBLIC_IP=$(curl -fsSL4 --max-time 2 api.ipify.org 2>/dev/null || echo 127.0.0.1) JWT_SECRET=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n') NODE_SECRET=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n') docker run -d \ --name slyber-sfu-server \ --restart unless-stopped \ --network host \ -e SFU_ENV="production" \ -e PUBLIC_IP="${PUBLIC_IP}" \ -e SFU_UDP_PORT="4443" \ -e SFU_TCP_PORT="4443" \ -e SFU_HTTP_PORT="8090" \ -e AUTH_MODE="jwt" \ -e JWT_SECRET="${JWT_SECRET}" \ -e NODE_SECRET="${NODE_SECRET}" \ ghcr.io/slyber-app/slyber-sfu-server:latest && \ sleep 1 && \ docker exec slyber-sfu-server slyber_sfu doctor && \ echo "Public IP : ${PUBLIC_IP}" && \ echo "JWT Secret : ${JWT_SECRET}" && \ echo "Node Secret: ${NODE_SECRET}" && \ echo "Test Token : $(curl -fsS -H "X-Slyber-Node-Secret: ${NODE_SECRET}" "http://127.0.0.1:8090/auth/token?room=test-room&user=user-1")" ``` Verify the health of a running node using the built in self diagnostics command: ``` bash $ slyber-sfu doctor ================================================================ SLYBER SFU DOCTOR | Version: v1.0.0 | Node: slyber-sfu-01 ================================================================ [OK] Environment : production [OK] Public IP & Realm : 89.111.175.67 (slyber.com) [OK] Pion ICE Mux : UDP :4443 | TCP :4443 (ICE-TCP=true) | HTTP :8090 [OK] Auth & Security : jwt (E2EE=true, External TURN=1) [OK] All Slyber SFU self-diagnostics passed. ================================================================ ``` [GitHub Repository](https://github.com/slyber-app/slyber-sfu-server) [Official Documentation](https://slyber.com/docs/slyber-sfu-server) [Technical Case Study](https://erkin-khidirov.com/cases/slyber-sfu-server)