Build and self-host OrbitLan

Written by Furqan Ahmed · Updated September 27, 2026

Choose a deployment

Setup	What it hosts	Best for
Cloudflare, direct-only	Worker + Durable Objects	The simplest setup with no relay bandwidth to operate.
Cloudflare managed	Worker + Durable Objects + Realtime TURN	Global managed fallback with the least server maintenance.
Cloudflare + Oracle	Cloudflare coordinator + coturn on an Oracle VM	People who want to own the relay and its bandwidth path.

The current coordinator uses Cloudflare Durable Objects, so an Oracle VM is an alternative relay host—not a drop-in replacement for the coordinator. A completely Oracle-only control plane is not supported by this release.

Requirements

For the coordinator

• A Cloudflare account with Workers enabled.
• Git and Node.js 22 or newer on your development machine.
• The OrbitLan source from GitHub.

For a Windows client build

• 64-bit Windows 10 or Windows 11.
• Go matching client/engine/go.mod.
• Visual Studio with the Desktop development with C++ workload and a Windows SDK.
• CMake 3.24 or newer and PowerShell 5.1 or newer.

1. Deploy the coordinator to Cloudflare

Clone the repository and install the coordinator's locked dependencies:

git clone https://github.com/furqan-ahm/orbitlan.git
cd orbitlan/coordinator
npm ci
npm run typecheck
npx wrangler login

Open wrangler.toml and give name a unique value, such as my-orbitlan. Keep the Durable Object binding and migration unchanged.

Direct-only setup

Set RELAY_ENABLED = "false" in wrangler.toml. No TURN credentials are required. Deploy and test the health endpoint:

npx wrangler deploy
curl https://YOUR-WORKER.YOUR-SUBDOMAIN.workers.dev/net/health

The response should be ok. Cloudflare currently makes SQLite-backed Durable Objects available on its Free and Paid plans; check the current Durable Objects documentation and limits before relying on any particular allowance.

2A. Add Cloudflare's managed TURN relay

1. Create a TURN key. In the Cloudflare dashboard, open Realtime → TURN and create a key.
2. Keep both values private. Copy the TURN key ID and its API token. They are server-side secrets, not client settings.
3. Store the secrets with Wrangler. Run the commands below and paste each value when prompted.
4. Enable and redeploy. Confirm RELAY_ENABLED = "true" in wrangler.toml, then deploy again.

npx wrangler secret put CF_TURN_KEY_ID
npx wrangler secret put CF_TURN_API_TOKEN
npx wrangler deploy

The coordinator exchanges the long-lived key for short-lived client credentials. Cloudflare documents a shared monthly free allowance for Realtime services and charges beyond it; verify the current Realtime pricing before enabling relay for a public community.

2B. Use coturn on Oracle Cloud instead

This option still uses the Cloudflare Worker for rooms and signaling, but sends relay traffic through a VM you control. Oracle's Free Tier and capacity rules can change, and bandwidth can become billable, so confirm the current Oracle Free Tier terms first.

Create and open the VM

1. Create an Ubuntu VM in a public subnet and assign it a public IPv4 address. Save the SSH private key.
2. In the VM's VCN security list or network security group, allow inbound UDP 3478 and UDP 49160–49260.
3. SSH to the VM as ubuntu, then install coturn.

ssh -i PATH_TO_KEY ubuntu@PUBLIC_IPV4
sudo apt update
sudo apt install -y coturn
openssl rand -hex 32

Keep the generated secret. Find the VM's private IPv4 address with hostname -I, then edit /etc/turnserver.conf:

listening-port=3478
fingerprint
use-auth-secret
static-auth-secret=PASTE_THE_GENERATED_SECRET
realm=orbitlan
external-ip=PUBLIC_IPV4/PRIVATE_IPV4
min-port=49160
max-port=49260
no-cli
no-multicast-peers

Match the operating-system firewall to the same narrow port range, then enable coturn:

sudo ufw allow 3478/udp
sudo ufw allow 49160:49260/udp
sudo systemctl enable --now coturn
sudo systemctl status coturn

If the Ubuntu package is disabled by default, set TURNSERVER_ENABLED=1 in /etc/default/coturn and restart the service. Coturn's own project documents the package and container installation options in its official repository.

Connect coturn to the coordinator

In coordinator/wrangler.toml, keep relay enabled and add the VM address:

RELAY_ENABLED = "true"
TURN_URL = "turn:PUBLIC_IPV4:3478?transport=udp"

Store the same coturn secret in Cloudflare and redeploy:

npx wrangler secret put TURN_SHARED_SECRET
npx wrangler deploy

TURN_URL takes priority over Cloudflare TURN when both are configured. Never commit TURN_SHARED_SECRET or place it in the Windows app.

3. Point OrbitLan at your coordinator

1. Open Settings in OrbitLan.
2. Replace Coordinator with the HTTPS Worker URL printed by Wrangler. Do this on every participating PC.
3. Leave Relay on Auto for direct-first connections with fallback, or choose Off to guarantee direct-only behavior.
4. Test from different networks. Create a room on one PC, join from another internet connection, and confirm both nodes show a working connection.

All members of a room must use the same coordinator. A custom domain is optional, but it gives you a stable URL if you later rename the Worker.

4. Build the Windows client

Open a Developer PowerShell in the repository root. The build script tests and packages the Go engine, native C++ UI, Windows service, setup helper, installer, and portable archive:

powershell -ExecutionPolicy Bypass -File .\scripts\build-native-release.ps1

Community outputs are written to dist\OrbitLan-Installer.exe and dist\OrbitLan-Portable.zip. The optional Supporter flavor is built from the same MIT-licensed source:

powershell -ExecutionPolicy Bypass -File .\scripts\build-native-release.ps1 -Edition Supporter

Security and operating notes

• Treat room codes as temporary shared secrets and create a new room when membership should change.
• Do not publish TURN keys, API tokens, or coturn shared secrets. Use Wrangler secrets.
• A relay forwards encrypted OrbitLan packets but consumes server bandwidth. Monitor usage and keep a narrow relay port range.
• Keep the Worker dependencies, coturn package, and VM operating system patched.
• Direct peers learn one another's public network addresses during ICE. Self-hosting does not change that peer-to-peer behavior.

Useful official references

• Cloudflare Wrangler commands
• Cloudflare TURN credential generation
• Oracle: creating a compute instance
• Coturn official source and installation notes

Read the source before you deploy

OrbitLan is MIT licensed. Review the coordinator, client, and architecture notes, then adapt the deployment to your own risk and bandwidth limits.

View sourceAsk for help