DokuWiki 2026-07-14c

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick DokuWiki 2026-07-14c on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2.

Choose m5.large, your key pair and a security group as above. DokuWiki is light, so a smaller instance is fine for a small team. Keep the second volume (the wiki data) in the launch settings. You can make it larger there.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dokuwiki}]'

• DokuWiki 2026-07-14c on Ubuntu 24.04: SSH user ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes a few seconds. After that, nginx, PHP and the first boot unit are active:

systemctl is-active nginx php8.3-fpm dokuwiki-firstboot

active active active

nginx serves ports 80 and 443. PHP listens on a local socket only, and there is no database, so the only open ports are 22, 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /nginx|sshd|php/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:22 users:(("sshd"),("systemd")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx"))

The DokuWiki release, the PHP version and the wiki data volume:

cat /var/www/dokuwiki/VERSION php -v | head -1 findmnt -no TARGET,FSTYPE,SIZE /var/lib/dokuwiki

2026-07-14c "Mort" PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS) /var/lib/dokuwiki ext4 19.5G

The credentials file holds the address the wiki is served as (your instance's public DNS name by default), the sign-in page, the administrator user name and the password generated on this instance. Show the file with:

sudo cat /root/dokuwiki-credentials.txt

DOKUWIKI_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ DOKUWIKI_LOGIN_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/start?do=login DOKUWIKI_ADMIN_USER=admin DOKUWIKI_ADMIN_PASSWORD=<24 letters and digits>

Open DOKUWIKI_URL in your browser. The certificate is self-signed (generated on your instance), so accept the browser warning once, or install your own certificate (Step 11). Visitors see the start page.

Choose Log In (top right) and sign in as admin with DOKUWIKI_ADMIN_PASSWORD.

Signed in as admin, Admin (top right) opens the administration area: Access Control List Management, Configuration Settings, Extension Manager, Template Style Settings, User Manager, View Logs, Popularity Feedback and Revert Manager, with the DokuWiki, PHP and Ubuntu versions alongside.

Configuration Settings sets the wiki title (the image starts with "DokuWiki"), the language, the content license and everything else DokuWiki offers.

A few settings show with a light red background. This image pins them (the served address, the data folder, access control, password hashing, secure cookies and the proxy and download limits) in the root-owned file /var/www/dokuwiki/conf/local.protected.php, so neither the browser nor a request can change them.

Open a page name that does not exist yet, for example https://<your-wiki>/projects:roadmap, and choose Create this page. Write in DokuWiki's markup with the toolbar (headings, links, lists, code blocks, images from the media manager), add an edit summary and click Save.

Colons in a page name make namespaces. For example, projects:roadmap is the page roadmap in the namespace projects. Namespaces also appear as folders in the media manager and the access control lists.

Every save keeps the previous revision. Old revisions shows the history of a page, compares any two revisions and restores an older one. Recent Changes lists every change in the wiki.

Admin > User Manager adds, edits and deletes users. New users belong to the group user, which may read, edit, create pages and upload files. Put trusted administrators in the group admin. Self-registration is switched off on this image, so this is the only way to create accounts.

Admin > Access Control List Management sets who may do what, per namespace or page. The image starts with two rules: everyone (@ALL) may read, and signed-in users (@user) may read, edit, create and upload. To make the whole wiki private, set @ALL on * to None. To give one team its own space, add a rule for its group on its namespace.

Email: DokuWiki sends notifications (page subscriptions, new user notices) with PHP's mail(). The image has no mail server, so the notifications are not delivered until you install and configure a mail transfer agent that relays through your mail provider.

Email password reset is switched off for the same reason. An administrator sets a new password in the User Manager, and admin's own password is reset from the shell (Step 12).

DokuWiki keeps the wiki on its own EBS volume at /var/lib/dokuwiki, outside the web root and readable only by the web server. The folders hold the following:

• pages holds the current text of every page.
• attic holds the old revisions.
• media and media_attic hold your uploads.
• meta holds page metadata and the change log.
• index holds the search index.
• cache, locks, log and tmp hold working files.

The configuration that DokuWiki's admin tools edit (users.auth.php with the password hashes, acl.auth.php, local.php) is in /var/www/dokuwiki/conf, where everything else belongs to root:

sudo ls -l /var/www/dokuwiki/conf | sed -E 's/ +/ /g' | cut -d' ' -f1,3,4,9- | grep -E 'auth|local'

-rw-r----- www-data www-data acl.auth.php -rw-r--r-- root root acl.auth.php.dist -rw-r----- www-data www-data local.php -rw-r--r-- root root local.php.dist -rw-r--r-- root root local.protected.php -rw-r----- www-data www-data users.auth.php -rw-r--r-- root root users.auth.php.dist

Back up the wiki with an EBS snapshot of the data volume (and of the root volume for the configuration), or as files:

sudo tar -czf dokuwiki-backup.tar.gz -C / var/lib/dokuwiki var/www/dokuwiki/conf

To restore onto a new instance, let its first boot finish, then stop nginx and PHP (sudo systemctl stop nginx php8.3-fpm). Replace /var/lib/dokuwiki and the files users.auth.php, acl.auth.php and local.php in /var/www/dokuwiki/conf with your copies (owned by www-data), and start nginx and PHP again. The restored users.auth.php brings its own passwords.

Port 80 sends browsers to HTTPS, and the health endpoint answers for load balancer checks. The installer, the configuration and password files, the data folder, DokuWiki's code and a crafted media address are not reachable:

H=$(sed -n 's/^set \$dw_host "\(.*\)";$/\1/p' /etc/nginx/dokuwiki-host.conf)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/start"
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz" for p in /install.php /conf/users.auth.php /conf/local.protected.php /data/pages/start.txt /inc/init.php /bin/plugin.php /vendor/autoload.php "/lib/exe/fetch.php?media=../../conf/users.auth.php"; do
curl -sk -o /dev/null -w "$p: %{http_code}\n" --resolve "$H:443:127.0.0.1" "https://$H$p" done
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/start ok /install.php: 404 /conf/users.auth.php: 404 /conf/local.protected.php: 404 /data/pages/start.txt: 404 /inc/init.php: 404 /bin/plugin.php: 404 /vendor/autoload.php: 404 /lib/exe/fetch.php?media=../../conf/users.auth.php: 404 unknown host name: 000

000 means nginx closed the connection without an answer.

The next command shows DokuWiki's own view of its settings: one account whose password is a bcrypt hash, access control on, the configured HTTPS address as the base of every link, no trust in forwarded client addresses, the remote API and remote downloads off, self-registration and password reset off, no installer, and a cookie secret of this instance's own:

sudo -u www-data php /usr/local/lib/sac/dokuwiki/dokuwiki-admin.php summary

version=2026-07-14c "Mort" users=admin adminGroups=admin,user hashAlgo=bcrypt useacl=1 authtype=authplain passcrypt=bcrypt superuser=@admin baseurl=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com savedir=/var/lib/dokuwiki userewrite=1 securecookie=1 trustedproxies=0 remote=0 fetchsize=0 allowdebug=0 disableactions=register,resendpwd install=absent cookiesalt=ok cookiesaltLegacy=no

The credentials file is readable by root only, and the password file and the wiki data by the web server only. The code and the pinned settings belong to root:

sudo stat -c '%a %U:%G %n' /root/dokuwiki-credentials.txt /var/www/dokuwiki/conf/users.auth.php /var/lib/dokuwiki /var/www/dokuwiki/conf/local.protected.php /var/www/dokuwiki/doku.php

600 root:root /root/dokuwiki-credentials.txt 640 www-data:www-data /var/www/dokuwiki/conf/users.auth.php 750 www-data:www-data /var/lib/dokuwiki 644 root:root /var/www/dokuwiki/conf/local.protected.php 644 root:root /var/www/dokuwiki/doku.php

The certificate was generated on this instance and names its own addresses:

H=$(sed -n 's/^set \$dw_host "\(.*\)";$/\1/p' /etc/nginx/dokuwiki-host.conf)
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

nginx and PHP cannot reach the instance metadata service. PHP cannot run shell commands or open URLs as files, is confined to DokuWiki's folders, and runs the login guard before every request. nginx hands PHP the configured host name and the real client address from the connection, never values that a client sends:

systemctl show nginx -p IPAddressDeny
systemctl show php8.3-fpm -p IPAddressDeny php-fpm8.3 -i 2>/dev/null | grep -E '^(open_basedir|disable_functions|expose_php|allow_url_fopen|auto_prepend_file) ' | cut -d' ' -f1-3 grep -E 'fastcgi_param (HTTP_HOST|SERVER_NAME|HTTP_X_FORWARDED_FOR|HTTP_CLIENT_IP) ' /etc/nginx/snippets/sac-dokuwiki-php.conf

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 allow_url_fopen => Off auto_prepend_file => /usr/local/lib/sac/dokuwiki/login-guard.php disable_functions => exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec expose_php => Off open_basedir => /var/www/dokuwiki/:/var/lib/dokuwiki/:/usr/local/lib/sac/dokuwiki/:/var/lib/php/sessions/:/tmp/:/etc/os-release:/usr/lib/os-release fastcgi_param HTTP_HOST $dw_host; fastcgi_param SERVER_NAME $dw_host; fastcgi_param HTTP_X_FORWARDED_FOR $remote_addr; fastcgi_param HTTP_CLIENT_IP $remote_addr;

If you lock yourself out with ten wrong passwords, wait five minutes or clear the lockout with this command:

sudo dokuwiki-reset-lockout

Point a DNS record at the instance, then set the name that DokuWiki is served as. This command mints a new self-signed certificate for the name. It updates nginx, DokuWiki's base address (every absolute link DokuWiki builds, in conf/local.protected.php) and the URLs in /root/dokuwiki-credentials.txt. It also keeps the name across reboots:

sudo dokuwiki-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running dokuwiki-set-hostname again replaces it with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/dokuwiki.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/dokuwiki.key
sudo nginx -t && sudo systemctl reload nginx

Once browsers trust the certificate, you can also add an HSTS header (add_header Strict-Transport-Security "max-age=31536000" always;) to /etc/nginx/snippets/sac-dokuwiki-headers.conf. The image does not send one, because browsers ignore HSTS from a site whose certificate they do not trust. It only takes effect with a trusted certificate.

dokuwiki-set-password gives admin a new random password, keeps every other user, signs out every open session and records the password in /root/dokuwiki-credentials.txt.

Run it without arguments, or pass your own password (24 to 64 letters and digits) on stdin. Other users change their own password with Update Profile, and administrators can set any user's password in the User Manager.

sudo dokuwiki-set-password printf '%s\n' '<your-new-password>' | sudo dokuwiki-set-password --stdin

Plugins and templates. DokuWiki's Extension Manager installs plugins and templates, which are PHP code, from the internet. On this image the plugin and template folders belong to root, so code cannot be added from the browser. The manager lists the extensions, but installing, updating or removing one stops with DokuWiki's message "Plugin directory is not writable".

To install or update extensions, switch the installer on, use Admin > Extension Manager, and switch it off again. Extensions you install keep working:

sudo dokuwiki-extensions status

disabled

sudo dokuwiki-extensions enable
sudo dokuwiki-extensions disable

Only install extensions you trust, because an extension runs with the same rights as DokuWiki. PHP cannot reach the instance metadata service whether the Extension Manager is on or off.

Upgrades. DokuWiki shows a notice on the administration page when a new release is out. To upgrade, snapshot the instance, download the new release from download.dokuwiki.org, and check its checksum against the one published there.

Unpack the release over the code as root, without its data folder, its installer and its .htaccess files. The tarball carries no local.php, users.auth.php or acl.auth.php, so your settings and users stay as they are. Then give the conf folder back to the web server's group and follow the release notes:

sudo tar -xzf dokuwiki-<release>.tgz -C /var/www/dokuwiki --strip-components=1 --no-same-owner \
  --exclude='*/data' --exclude='*/install.php' --exclude='*/.htaccess' sudo chown root:www-data /var/www/dokuwiki/conf && sudo chmod 1775 /var/www/dokuwiki/conf

Your pages and media on /var/lib/dokuwiki are untouched.

• DokuWiki code (root-owned): /var/www/dokuwiki
• Wiki data (pages, revisions, media, metadata, search index): /var/lib/dokuwiki (its own EBS volume)
• Users, access control and settings: /var/www/dokuwiki/conf (users.auth.php, acl.auth.php, local.php, local.protected.php)
• nginx site: /etc/nginx/sites-available/sac-dokuwiki
• PHP settings: /etc/php/8.3/fpm/conf.d/99-sac-dokuwiki.ini
• Login guard: /usr/local/lib/sac/dokuwiki/login-guard.php
• Certificate and key: /etc/nginx/ssl/
• First boot script: /usr/local/sbin/dokuwiki-firstboot.sh
• Helpers: /usr/local/sbin/dokuwiki-set-hostname, dokuwiki-set-password, dokuwiki-reset-lockout, dokuwiki-extensions
• License and release notes: /usr/share/doc/dokuwiki/
• Credentials: /root/dokuwiki-credentials.txt (mode 0600)

• Allow port 22 in the security group from your own networks only, and 443 from the networks that should read the wiki.
• Keep the administrator password secret, and rotate it if it may have been shared (Step 12). Give each person their own account.
• Review the access control lists before you put anything confidential in the wiki (Step 8).
• Use your own DNS name and a certificate your browsers trust (Step 11).
• Keep the Extension Manager switched off except while you install or update extensions.
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.
• PHP-FPM comes from Ubuntu's universe repository. sudo pro security-status --esm-apps shows whether Ubuntu Pro (ESM Apps) has security updates for it. None were pending when the image was built.
• Snapshot the data volume regularly (Step 9).