Deployment guide

MediaWiki

Overview

MediaWiki is the open-source wiki engine that powers Wikipedia and thousands of knowledge bases. It gives teams a collaborative, version-controlled documentation platform with page histories, talk pages, categories, full-text search and a large extension ecosystem.

This SecureAnyCloud image installs MediaWiki 1.43 LTS on a full LAMP stack from the Ubuntu 24.04 repositories: nginx, PHP 8.3-FPM and MariaDB. The entire headless install runs at build time, so there is no web wizard.

What you get:

MediaWiki 1.43 LTS served on port 80 by nginx through the PHP 8.3-FPM FastCGI socket, with short article URLs (/wiki/Article_Name)
MariaDB on loopback, with its data directory on a dedicated Azure data disk
A dedicated Azure data disk at /var/lib/mediawiki for the MariaDB database and the wiki uploads (the images/ directory)
A per-VM database password, fresh MediaWiki secret keys and a unique administrator account, all generated on the first boot of every VM
nginx.service, php8.3-fpm.service and mariadb.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the MediaWiki web interface. For public exposure, put TLS in front of the wiki (see Enabling HTTPS in Step 10).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for MediaWiki by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, create the VM, then open port 80.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mediawiki-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name mediawiki \
  --image sac1647283583153:mediawiki-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name mediawiki --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH with the key you supplied at deployment.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the LAMP stack is running

On first boot, the VM rotates the MediaWiki database password, regenerates the secret keys, resets the administrator account to a fresh per-VM password, sets the wiki URL to your VM's public IP and starts the stack. Check that all three services are running:

systemctl is-active nginx php8.3-fpm mariadb

All three report active.

Then confirm the component versions and that the wiki Main Page answers on port 80:

php -v | head -1 mariadb --version curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/wiki/Main_Page

The Main Page returns HTTP 200.

Step 5 - Retrieve the administrator password

The administrator account is unique to your VM and is generated on first boot. Read the credentials file as root:

sudo cat /root/mediawiki-credentials.txt

The file contains the login (Admin), the wiki URL and a unique password. After your first sign-in, change the password and add an email address in your preferences.

Step 6 - Browse to your wiki

Browse to http://<vm-public-ip>/. The root URL redirects to the canonical Main Page at /wiki/Main_Page.

The image ships with a sample Main Page, so you see a complete wiki immediately rather than a blank page.

Step 7 - Sign in

Browse to http://<vm-public-ip>/index.php?title=Special:UserLogin and sign in with Admin and the password from the credentials file.

Step 8 - Create and edit pages

To create or edit a page, browse to it and choose Edit (or Create). MediaWiki uses wikitext: == Heading == for sections, '''bold''' for bold, [[Page Name]] for internal links and * item for bullet lists. Enter a summary and select Save changes.

Review every edit across the wiki from Special:RecentChanges. Each entry links to the page, the diff and the contributing user. This is the core of MediaWiki's version control.

Step 9 - The dedicated data disk

The MariaDB database and the wiki uploads (the images/ directory) live on a dedicated Azure data disk mounted at /var/lib/mediawiki, separate from the OS disk. This keeps your content independent of the OS image and lets you resize the disk as your wiki grows. Confirm the mount:

df -h /var/lib/mediawiki findmnt /var/lib/mediawiki

Step 10 - Enabling HTTPS

For any public deployment, put TLS in front of MediaWiki. Point a DNS A record at your VM's public IP, then install a certificate with Certbot and its nginx plugin. Run these steps on your VM, substituting your own domain and email address for the example values.

Install Certbot: sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
Obtain and install a certificate for your domain by running Certbot with the nginx plugin for your-domain.example.com. Supply your contact email when prompted.
After issuance, set $wgServer = "https://your-domain.example.com"; in /var/www/mediawiki/LocalSettings.php so that generated links use https://.

Certbot installs a renewal timer automatically, so certificates renew without further action.

Step 11 - Maintenance

Updates. The OS continues to receive unattended security updates. To upgrade MediaWiki itself, replace the code tree and run php /var/www/mediawiki/maintenance/run.php update. See the MediaWiki upgrade documentation for details.
Backups. Back up the MariaDB wiki database (for example with mysqldump) and the /var/lib/mediawiki/images directory. Together they hold all of your content and uploads.
Logs. Web server logs are under /var/log/nginx/. For application-level logs, enable MediaWiki debug logging with $wgDebugLogFile in LocalSettings.php.

Support

This image is maintained by SecureAnyCloud with 24/7 support. For help with the image, contact sales@secureanycloud.com.

MediaWiki is a trademark of the Wikimedia Foundation. SecureAnyCloud is not affiliated with or endorsed by the Wikimedia Foundation or the MediaWiki project.

Deploy on Azure

Launch MediaWiki on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

MediaWiki is the free and open source wiki engine that powers Wikipedia and tens of thousands of knowledge bases, intranets and documentation sites. This image delivers it as a production LAMP application, so a complete collaborative wiki is running within minutes of launch.

What you get:

MediaWiki as a PHP 8.3 application under php-fpm, served by nginx on port 80 with clean short URLs
A MariaDB database that stores every page, revision and uploaded file
The MediaWiki application code under /var/www/mediawiki
The wiki database at /var/lib/mysql, on a dedicated, independently resizable EBS data volume that survives instance replacement
systemd management of MariaDB, the PHP FastCGI workers and nginx, which start on boot and restart on failure
A fresh MariaDB password and a fresh administrator password on every instance, generated on first boot by a one-shot service

On the first boot of every deployed instance, the one-shot service also creates the wiki administrator account and writes a fresh LocalSettings.php with new secret keys. It pins the wiki to the instance address, so two instances launched from the same Amazon Machine Image never share credentials.

The administrator password is written to /root/mediawiki-aws-credentials.txt with mode 0600, so only the root user can read it.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances.
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products.
An EC2 key pair in the target Region for SSH access to the instance.
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the wiki.
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line.

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for MediaWiki. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that opens port 22 from your management network and port 80 for the wiki. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass. During this time the per-instance database and administrator passwords are generated and the wiki schema is created.

Launch the instance from the AWS CLI

Run the command below to launch an instance from the SecureAnyCloud MediaWiki Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22 and 80.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mediawiki}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect to your instance

Connect over SSH with your key pair. On the Ubuntu 24.04 image, the SSH login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the administrator password

The MediaWiki administrator password is unique to your instance and was generated on first boot. Read the credentials file as root:

sudo cat /root/mediawiki-aws-credentials.txt

The file lists the wiki URL, the administrator login (Admin) and the generated password. Keep this password somewhere safe.

Sign in to the wiki

nginx serves the wiki on port 80 through php-fpm. In a browser, go to:

http://<instance-public-ip>/

Sign in as Admin with the password from the credentials file. You land on the wiki main page, which shows the Read, Edit and View history tabs, the search box and the Tools sidebar.

Confirm MediaWiki is running

Over SSH, confirm that the database, the PHP FastCGI workers and nginx are active and that the wiki answers:

sudo systemctl is-active mariadb php8.3-fpm nginx curl -s -o /dev/null -w 'api.php HTTP %{http_code}\n' 'http://127.0.0.1/api.php?action=query&meta=siteinfo&format=json'

All three services report active, and the MediaWiki Action API answers 200. MariaDB listens on loopback only and is never exposed publicly. Only nginx on port 80 is reachable from outside the instance.

Create and edit pages

To create a page, search for its title and choose to create it. Alternatively, browse to http://<instance-public-ip>/wiki/Your_Page_Title and select Create. To change an existing page, open it and choose the Edit tab.

Write in wikitext markup, with == headings ==, '''bold''', ''italics'' and [[internal links]]. Then add an edit summary and select Save changes.

Every save is recorded as a revision. Open the View history tab of any page to see every change, compare two revisions in a side-by-side diff, and restore an earlier version. Use Recent changes in the sidebar to watch activity across the whole wiki. Add pages to your watchlist to follow the ones you care about.

Special pages and the installed version

MediaWiki ships a rich set of special pages for administering the wiki. Browse to any of these:

Special:SpecialPages for the full index
Special:RecentChanges for activity
Special:ListUsers and Special:UserRights to manage accounts and permissions
Special:Upload to add files
Special:Version to list the installed MediaWiki, PHP, database and extension versions for your instance

Use the Action API

Every wiki operation is also available programmatically through the MediaWiki Action API, on the same port 80 at /api.php. To confirm API access, fetch the site information by browsing to the URL below. Replace <instance-public-ip> with your instance address.

http://<instance-public-ip>/api.php?action=query&meta=siteinfo&siprop=general&format=json

To make authenticated API calls for bots or integrations, sign in as the administrator and create a dedicated bot password under Special:BotPasswords. Use the returned credentials with the action=login then action=clientlogin token flow.

Treat bot passwords like any other password, and scope each one to the minimum rights its integration needs.

Short URLs and a custom domain

This image uses clean short URLs, so articles are served at /wiki/Page_Title rather than /index.php?title=Page_Title. The article path and the canonical server URL are set in /var/www/mediawiki/LocalSettings.php. First boot pins the canonical server URL ($wgServer) to your instance public IP, which is why the wiki is reachable immediately.

To put the wiki behind a custom domain or a load balancer, edit /var/www/mediawiki/LocalSettings.php and set $wgServer to your domain, for example $wgServer = "https://wiki.example.com";. Then reload php-fpm so the change takes effect:

sudo systemctl reload php8.3-fpm

Finally, point the domain's DNS A record at the instance public IP and browse to your domain.

The data volume

The wiki database lives on a dedicated EBS volume mounted at /var/lib/mysql. This keeps the database off the operating system disk and lets you resize or snapshot it independently. Confirm the mount:

df -h /var/lib/mysql

To grow the database store, expand the EBS volume in the AWS console. Then grow the filesystem on the instance with sudo resize2fs on the underlying device.

Because the database is on its own volume, you can snapshot it for backup, or detach it and reattach it to a replacement instance.

Enable HTTPS

nginx serves the wiki over plain HTTP on port 80. For production use, place it behind TLS.

Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and to proxy to php-fpm exactly as the bundled site does for port 80.

Set $wgServer to your https:// URL in LocalSettings.php as shown in Step 10. Restrict the security group so that ports 80 and 443 are reachable only from the networks that need the wiki.

Backup and maintenance

Back up. Snapshot the /var/lib/mysql EBS volume, which captures the entire wiki database. Also keep a copy of /var/www/mediawiki/LocalSettings.php, which holds the database credentials and the secret keys, and of /var/www/mediawiki/images, which holds uploaded files. You can also take a logical dump of the database with mysqldump over the loopback socket.

Patch the OS. Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. MariaDB, php-fpm and nginx start automatically on boot.

Upgrade MediaWiki. Back up the database, replace the application code under /var/www/mediawiki with a newer release, then run sudo -u www-data php /var/www/mediawiki/maintenance/update.php --quick.

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, user and rights management, extensions and skins, the Action API, short URL and custom domain configuration, database tuning, TLS and scaling. Contact SecureAnyCloud through the support channel on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch MediaWiki on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS