Be your own signal, STUN & TURN layer.

What "server mode" actually is

There's no separate server build. A MyOwnMesh device is any combination of a mesh member and the infrastructure roles it hosts for everyone else. You turn roles on; the daemon starts the listeners and advertises them to the fleet. Hosting is configured device-wide (not per network) — a role serves every network this device is on, plus any outside client you point at it.

Everything except node is off until you opt in. When a role is enabled the daemon advertises a capability tag (service:signaling, service:stun, service:turn, service:relay) in the hello handshake every peer already exchanges — which is how the fleet self-discovers your box.

Stand one up, step by step

We'll take a fresh box to a public, TLS-terminated signaling relay with STUN + TURN, running as a service that survives reboot. Skip the steps you don't need — STUN/TURN and signaling are independent.

# headless server — daemon only, no desktop GUI
curl -fsSL https://myownmesh.net/install.sh | sh -s -- --no-gui

# Windows (PowerShell) — daemon only
iex "& { $(irm https://myownmesh.net/install.ps1) } -NoGui"

# From source — needs cargo (https://rustup.rs)
git clone https://github.com/mrjeeves/MyOwnMesh
cd MyOwnMesh
cargo install --path crates/myownmesh

# run it in the foreground (Ctrl-C to stop)
myownmesh serve

# pure-infrastructure box: host services, join nothing
myownmesh ctl services disable node

myownmesh ctl services enable signaling
myownmesh ctl services enable turn        # gives you STUN for free, same port
myownmesh ctl services status

{
  // ~/.myownmesh/config.json
  "version": 1,
  "services": {
    "signaling": { "enabled": true, "bind": "0.0.0.0", "port": 4848 },
    "turn": {
      "enabled": true,
      "bind": "0.0.0.0",
      "port": 3478,
      "public_ip": "203.0.113.7",          // this box's routable IP
      "realm": "myownmesh",
      "credentials": [
        { "username": "alice", "password": "use-a-real-secret" }
      ],
      "max_bps_per_connection": 0          // 0 = unlimited
    }
  }
}

myownmesh install caddy relay.example.com

# per-user service: no root, starts at login (Linux enables lingering)
myownmesh service install

# or system-wide: root, starts at boot, state under /var/lib/myownmesh
sudo myownmesh service --system install

Point your peers at it

Hosting is only half of it — peers have to use your box. Each peer edits its network's transport config (GUI: a network's gear → Settings; or config.json). You can also let auto-discovery do it: with TURN's public_ip set, your host advertises concrete endpoint URLs that a peer can adopt straight into its config.

{
  // one network entry on a peer's config.json
  "id": "home",
  "network_id": "my-cool-mesh",
  "signaling": {
    "servers": ["wss://relay.example.com"],   // non-empty = ignore the public pool
    "public_fallback": true                    // false = strictly your relays
  },
  "stun_servers": [{ "urls": ["stun:relay.example.com:3478"] }],
  "turn_servers": [
    { "urls": ["turn:relay.example.com:3478"],
      "username": "alice", "credential": "use-a-real-secret" }
  ]
}

A fully internet-isolated network

Put it together and you get a network that touches no infrastructure you don't own — no Google STUN, no Cloudflare TURN, no public Nostr relay. One always-on box (or a few) supplies every piece of plumbing a closed fleet needs.

Verify it & troubleshoot

ctl services status tells you what's bound and — for signaling — whether peers are actually reaching you. That last bit separates "nobody's connecting" from "I'm broken."

A running: false on an enabled service means the start failed — usually a port already in use, or TURN missing its credentials / public IP. STUN shows running: false while turn is on because TURN already answers STUN on :3478 — that's expected, not a fault.

Reference

CLI cheat-sheet

myownmesh serve                          # run the daemon (foreground, headless)
myownmesh service install                # register as a background OS service
myownmesh ctl services status            # what's hosted + where it's listening
myownmesh ctl services enable  <svc>     # node | relay | signaling | stun | turn
myownmesh ctl services disable <svc>
myownmesh ctl services disable node      # → pure-infrastructure box
myownmesh install caddy <domain>         # TLS reverse proxy for wss://
myownmesh caddy path                     # print the Caddyfile location
myownmesh config edit                    # open ~/.myownmesh/config.json
myownmesh identity show                  # this device's id

Defaults & knobs

signaling.port

4848 · plain ws://. Front it with TLS for public wss://.

stun.port / turn.port

3478 — the IANA STUN/TURN port. Don't run standalone STUN and TURN on the same port; TURN covers both.

turn.public_ip

Required on a wildcard bind. The routable address handed out in relay allocations.

turn.credentials

At least one { username, password }. Mirror a pair into each peer's turn_servers.

turn.max_bps_per_connection

Per-allocation byte/sec cap, each direction. 0 = unlimited.

turn.relay_port_min / max

0 = OS ephemeral range (open it all). Pin a window to shrink the firewall surface.

signaling.limits

Per-connection flood guards. Defaults: 50 events/s, 20 REQ/s, 64 subscriptions, 16 filters/REQ, 65536 bytes/frame, 64 conns/IP. 0 = no limit.

relay.max_fanout

Broadcast fan-out ceiling. 0 = unlimited.

config + state

~/.myownmesh/config.json. Move the whole tree with MYOWNMESH_HOME.