SimNest

Open source · GPL-3.0 · For the hands-on

Self-hosted relay

When the gateway and your iPhone can't reach each other directly, a relay passes the call along. SimNest's relay is the default; you can also run one on your own server or home NAS, so calls go through a machine you control.

Package and instructions

The package's program and security settings have automated tests, and the gateway can add and use a self-hosted relay. But the whole path, from deploying on a real server or NAS to a call going through it, hasn't been tried in the field yet. Issues are welcome.

What a relay can see

  • It only forwards encrypted audio, and can't hear or change the call: the two ends have their own end-to-end encryption.
  • A self-hosted relay never talks to SimNest's service. Its address and key live only on your gateway; SimNest's servers don't know it exists.
  • It does see both ends' public addresses, when calls happen and how long they last. So run it on a machine you control.

What you need

  • A machine with a public address. A cloud server works as is; a machine at home needs a port mapping on the router and a home connection with a public address (not behind carrier-grade NAT).
  • Docker and Docker Compose.
  • Open UDP and TCP 3478, and UDP 49160–49200.
  • About 100 kbps of upload per call.

Deploy

Get the package, copy the settings file and set EXTERNAL_IP to the machine's public address:

git clone https://github.com/simnest-app/relay.git
cd relay
cp .env.example .env

Then start it:

docker compose up -d

docker compose logs helper then shows the address of a setup page. Open it in a browser on the same network (on a cloud server, through an SSH port forward), copy the connection text into "Your Own Relay" under the gateway's "Network & Relays", and the gateway tests it straight away. The package readme has every step.

What's inside

  • coturn: the TURN relay, from its official image pinned by digest (BSD-3).
  • Helper: creates the key on first run, writes coturn's security settings, shows the connection details for the gateway on its setup page, and checks itself.
  • Security settings: temporary credentials only, quotas, and no relaying to private or reserved addresses.