TiddlyWiki 5.4.1

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select TiddlyWiki 5.4.1 on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2. Choose m5.large, your key pair and a security group as described above. TiddlyWiki is light, so a smaller instance is fine for one person. The wiki lives under /var/lib/tiddlywiki on the root volume.

Alternatively, launch with the AWS CLI. Replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=tiddlywiki}]'

Connect over SSH as the default user, ubuntu, on TiddlyWiki 5.4.1 on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes a few seconds. After it finishes, the three units are active:

systemctl is-active tiddlywiki nginx tiddlywiki-firstboot

active active active

TiddlyWiki (a Node.js process) listens on loopback only. nginx serves ports 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /node|nginx|sshd/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN 127.0.0.1:8080 users:(("node")) LISTEN [::]:22 users:(("sshd"),("systemd")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx"))

tiddlywiki --version node --version

5.4.1 v22.23.3

Read the credentials file as root:

sudo cat /root/tiddlywiki-credentials.txt

The file holds the address the wiki is served at (your instance's public DNS name by default), the user and the password generated on this instance:

TIDDLYWIKI_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ TIDDLYWIKI_USERNAME=admin TIDDLYWIKI_PASSWORD=<24 letters and digits>

Open TIDDLYWIKI_URL in your browser. The certificate is self-signed (generated on your instance), so accept the browser warning once, or install your own certificate (Step 10). Your browser then asks for a user name and password. Enter admin and the password from Step 4.

TiddlyWiki loads its notebook view. The story river on the left shows your open tiddlers, starting with GettingStarted. The sidebar on the right holds the new tiddler, control panel and sync buttons, the search box, and the Open, Recent, Tools and More tabs.

Click + (new tiddler) at the top of the sidebar. TiddlyWiki opens an edit view. Give the note a title, add tags and type the body, using the toolbar for headings, lists, links, images and more. Click the check mark to save. The server writes the change to a file on your instance immediately.

Type in the search box at the top of the sidebar. TiddlyWiki matches titles and full text as you type and lists the results in a dropdown. This is how you find your way around a growing wiki without folders.

Open the Control Panel (the gear icon in the sidebar) to set the wiki's title and subtitle, choose which tiddlers open at startup, and manage appearance, themes, plugins and keyboard shortcuts. The Info tab shows the running TiddlyWiki version and the user name your edits are signed with.

Port 80 sends browsers to HTTPS. The health endpoint answers without a password (for load balancer checks), and the wiki itself does not:

H=$(sudo grep '^TIDDLYWIKI_URL=' /root/tiddlywiki-credentials.txt | sed -E 's#^TIDDLYWIKI_URL=https://([^/]+)/.*#\1#')
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -sk -w '\n' --resolve "$H:443:127.0.0.1" "https://$H/healthz"
curl -sk -o /dev/null -w 'wiki without a password: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/"

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ ok wiki without a password: 401

With the password, TiddlyWiki's status endpoint confirms who you are signed in as. The command reads the password from the credentials file and passes it to curl on stdin, so it never appears on a command line:

H=$(sudo grep '^TIDDLYWIKI_URL=' /root/tiddlywiki-credentials.txt | sed -E 's#^TIDDLYWIKI_URL=https://([^/]+)/.*#\1#')
sudo sed -n 's/^TIDDLYWIKI_PASSWORD=\(.*\)$/user = "admin:\1"/p' /root/tiddlywiki-credentials.txt \
  | curl -sk -K - --resolve "$H:443:127.0.0.1" "https://$H/status" \
  | jq '{username, anonymous, read_only, tiddlywiki_version}'

{ "username": "admin", "anonymous": false, "read_only": false, "tiddlywiki_version": "5.4.1" }

The password is in a credentials file that only root can change and the TiddlyWiki user can read. The server starts with the file's path, not the password:

sudo stat -c '%a %U:%G %n' /etc/tiddlywiki/users.csv /root/tiddlywiki-credentials.txt systemctl show tiddlywiki -p ExecStart | grep -o 'credentials=[^ ]*'

640 root:tiddlywiki /etc/tiddlywiki/users.csv 600 root:root /root/tiddlywiki-credentials.txt credentials=/etc/tiddlywiki/users.csv

The instance generated its own certificate, and the certificate names the instance's own addresses:

H=$(sudo grep '^TIDDLYWIKI_URL=' /root/tiddlywiki-credentials.txt | sed -E 's#^TIDDLYWIKI_URL=https://([^/]+)/.*#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

TiddlyWiki runs unprivileged in a sandbox, and neither TiddlyWiki nor nginx can reach the instance metadata service. Check the sandbox settings:

systemctl show tiddlywiki -p User -p ProtectSystem -p NoNewPrivileges -p IPAddressDeny
systemctl show nginx -p IPAddressDeny

IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32 User=tiddlywiki ProtectSystem=strict NoNewPrivileges=yes IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32

nginx passes TiddlyWiki a fixed host name and the real client address from the connection, never values that a client sends. It closes the connection for any host name the instance does not serve:

grep -E 'proxy_set_header (Host|X-Forwarded-For|X-Real-IP)' /etc/nginx/sites-available/sac-tiddlywiki curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

proxy_set_header Host 127.0.0.1:8080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; unknown host name: 000

The value 000 means nginx closed the connection without an answer. Every change to the wiki also needs TiddlyWiki's X-Requested-With: TiddlyWiki header, which a browser cannot add to a cross-site form. In addition, nginx refuses a change whose Origin is another website (HTTP 403), because browsers resend Basic Auth credentials on cross-site requests.

Point a DNS record at the instance, then set the name that TiddlyWiki is served at. The helper creates a new self-signed certificate for the name, updates nginx and the URL in /root/tiddlywiki-credentials.txt, and keeps the name across reboots:

sudo tiddlywiki-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running tiddlywiki-set-hostname again replaces your certificate with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/tiddlywiki.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/tiddlywiki.key
sudo nginx -t && sudo systemctl reload nginx

tiddlywiki-set-password sets a new admin password in TiddlyWiki's credentials file, records it in /root/tiddlywiki-credentials.txt and restarts TiddlyWiki. Run it without arguments for a new random password, or pass your own (24 to 64 letters and digits) on stdin:

sudo tiddlywiki-set-password printf '%s\n' '<your-new-password>' | sudo tiddlywiki-set-password --stdin

Your wiki is a folder with one file per tiddler, and every change you make in the browser is saved there. List the folder:

sudo ls /var/lib/tiddlywiki/mywiki /var/lib/tiddlywiki/mywiki/tiddlers

/var/lib/tiddlywiki/mywiki: tiddlers tiddlywiki.info /var/lib/tiddlywiki/mywiki/tiddlers: $__StoryList.tid

Back up /var/lib/tiddlywiki/mywiki (or snapshot the root volume) to keep your notes. You can also save the whole wiki as a single standalone HTML file from the browser. In the sidebar, choose Tools, then export all.

TiddlyWiki is installed as a global npm package. To move to a newer release later, snapshot the instance, then run sudo npm install -g tiddlywiki@<version> and sudo systemctl restart tiddlywiki. The image ships the version named in the listing.

The server reads its settings from the tiddlywiki.service unit. The image defaults are:

• host / port (bind address and port): 127.0.0.1 / 8080, with nginx in front of it.
• credentials (file of users and passwords): /etc/tiddlywiki/users.csv, with the user admin.
• readers / writers (who may read and change the wiki, after authentication): only a signed-in user.

The server components are installed at the following paths:

• TiddlyWiki: /usr/lib/node_modules/tiddlywiki (command /usr/bin/tiddlywiki).
• Wiki folder: /var/lib/tiddlywiki/mywiki.
• Credentials file read by TiddlyWiki: /etc/tiddlywiki/users.csv (root:tiddlywiki, 0640).
• Service unit: /etc/systemd/system/tiddlywiki.service.
• nginx site: /etc/nginx/sites-available/sac-tiddlywiki.
• Certificate and key: /etc/nginx/ssl/.
• First boot script: /usr/local/sbin/tiddlywiki-firstboot.sh.
• Host name and password helpers: /usr/local/sbin/tiddlywiki-set-hostname and /usr/local/sbin/tiddlywiki-set-password.
• Credentials: /root/tiddlywiki-credentials.txt (mode 0600).

• Allow ports 22, 80 and 443 in the security group from your own networks only.
• Keep the admin password secret, and change it if it may have been shared (Step 11).
• Use your own DNS name and a certificate your browsers trust (Step 10).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else, including Node.js updates from the NodeSource repository.
• Back up the wiki folder regularly (Step 11).