Tiki Wiki CMS Groupware 30.1

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Tiki Wiki CMS Groupware 30.1 on Ubuntu 24.04 as the software version and select your Region. Then choose Launch through EC2.

Choose m5.large, your key pair and a security group as above. The root volume holds the site, the database and your uploads, so size it for your content.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=tiki}]'

Version SSH user

Tiki Wiki CMS Groupware 30.1 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes about half a minute, because it creates the database and runs Tiki's console install. After that, nginx, PHP, MariaDB and the first-boot unit are active, and Tiki's scheduler timer is waiting:

systemctl is-active nginx php8.3-fpm mariadb tiki-firstboot tiki-scheduler.timer

active active active active active

nginx serves ports 80 and 443. PHP and MariaDB listen on local sockets only, so the only open ports are 22, 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /nginx|sshd|php|maria/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:22 users:(("sshd"),("systemd")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx"))

To see how the download was verified and confirm that every shipped file is unchanged, run:

head -4 /usr/share/doc/tiki/RELEASE cd /var/www/tiki && sudo sha256sum -c --quiet /usr/share/doc/tiki/TIKI-30.1.sha256 && echo "$(grep -c . /usr/share/doc/tiki/TIKI-30.1.sha256) shipped files match the manifest" php -v | head -1 mariadb --version

Tiki Wiki CMS Groupware 30.1 source https://sourceforge.net/projects/tikiwiki/files/Tiki_30.x_Alpheratz/30.1/tiki-30.1.tar.gz/download sha256 92c21d5b472f8233e6636d782d1951de20f5db64de9363da931f9a91afa13c0e licence LGPL-2.1-only (license.txt sha256 ab1b0666be21c29d39a122891b423a1a9b8901f08cfb1501285cf80411c68c51) 37621 shipped files match the manifest PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS) mariadb Ver 15.1 Distrib 10.11.14-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper

The check covers every file the image shipped. Files Tiki writes later, such as uploads and caches, are not in the list.

The credentials file holds the address Tiki is served as (your instance's public DNS name by default), the admin user name and password, and the database credentials. All of them were created on this instance. Show the file with:

sudo cat /root/tiki-credentials.txt

TIKI_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ TIKI_ADMIN_USER=admin TIKI_ADMIN_PASSWORD=<24 letters and digits> TIKI_DB_NAME=tiki TIKI_DB_USER=tiki TIKI_DB_PASSWORD=<48 hexadecimal characters>

Open TIKI_URL in your browser. The certificate is self-signed (created on your instance), so your browser warns once. Compare the certificate's SHA-256 fingerprint with the one on the instance (sudo openssl x509 -in /etc/nginx/ssl/tiki.crt -noout -fingerprint -sha256) and continue. Alternatively, install a certificate from your own certificate authority (Step 11).

A fresh site shows the starter HomePage, an ordinary wiki page you can edit or replace:

Choose Log in and sign in with TIKI_ADMIN_USER and TIKI_ADMIN_PASSWORD:

Settings > Control Panels (tiki-admin.php) is where you turn Tiki's features on and off:

Open the admin pages from Tiki's menus. A link into them that comes from another site, a bookmark or the address bar is refused (Step 9), while the site's pages always open. The admin account can do everything. For editors, create accounts and groups with only the permissions they need.

Every page is a wiki page with full revision history. Choose Edit to change a page, and practice on the Playground page:

Wiki > List Pages shows every page, its author and its version:

Turn on further features under Control Panels > Features: articles, blogs, forums, file galleries, trackers, calendars, surveys and more. Uploads to file galleries are stored in the database by default. To move them to /var/www/tiki/storage, use Control Panels > File Galleries.

Tiki's command-line console runs as the web server's user through tiki-console:

sudo tiki-console preferences:get server_domain | sed -E 's/value .*/value <your host>/'
sudo tiki-console preferences:get allowRegister
sudo tiki-console preferences:get feature_version_checks
sudo cat /var/www/tiki/db/sac-system.ini.php

Preference server_domain has value <your host> Preference allowRegister has value n Preference feature_version_checks has value n <?php if (isset($_SERVER['SCRIPT_FILENAME']) && realpath($_SERVER['SCRIPT_FILENAME']) === __FILE__) { exit; } ?> ; sac: Tiki system configuration (locked preferences; an administrator cannot change them in the control panel). ; Tiki's ShellCommand scheduler task runs arbitrary shell commands; it is never offered on this image. [sac] preference.scheduler_shell_command = n ; HTTPS for every session (nginx serves Tiki over HTTPS only; port 80 redirects). preference.session_protected = y ; Absolute links (canonical, OpenGraph, notification mail) use https. preference.https_external_links_for_users = y

sudo tiki-console list shows every command (clearing caches, rebuilding the search index, database updates, users). Never pass a password to it as an argument. Use tiki-set-password instead (Step 12).

The settings in /var/www/tiki/db/sac-system.ini.php are Tiki's own system configuration. They override the database and are locked in the control panel. The file locks Tiki's shell command scheduler task off, keeps every session on HTTPS and makes Tiki's absolute links use https. Version checks (feature_version_checks) and registration (allowRegister) start off. An admin can switch them on in the control panel.

Everything that makes your site lives in the tiki database in MariaDB, and uploaded files in /var/www/tiki/storage and /var/www/tiki/img/wiki_up. Tiki rebuilds the caches in /var/www/tiki/temp automatically. Keep /var/www/tiki/db/local.php with your backup, because it holds this site's database password.

Back up the database to a file that only root can read, and back up the files. MariaDB's root signs in over the local socket without a password, so no password appears on the command line:

sudo sh -c 'umask 077; mysqldump --single-transaction tiki > /root/tiki-$(date +%F).sql'
sudo tar -C /var/www/tiki -czf /root/tiki-files-$(date +%F).tgz storage img/wiki img/wiki_up img/trackers db/local.php

For a whole-instance copy, snapshot the EBS volume.

Port 80 sends browsers to HTTPS, and the health endpoint answers for load balancer checks. The database configuration, the installer, the console, the templates, Tiki's source and stray PHP files in the writable folders are not reachable:

H=$(sed -n 's/^set \$tiki_host "\(.*\)";$/\1/p' /etc/nginx/tiki-host.conf)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/tiki-index.php" | sed -E 's#https://[^/]+#https://<your host>#'
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz" for p in /db/local.php /tiki-install.php /installer/tiki-installer.php /console.php /templates/tiki-login.tpl /lib/tikilib.php /tiki-check.php /temp/public/x.php; do
curl -sk -o /dev/null -w "$p: %{http_code}\n" -H 'Sec-Fetch-Site: same-origin' --resolve "$H:443:127.0.0.1" "https://$H$p" done
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://<your host>/tiki-index.php ok /db/local.php: 404 /tiki-install.php: 404 /installer/tiki-installer.php: 404 /console.php: 404 /templates/tiki-login.tpl: 404 /lib/tikilib.php: 404 /tiki-check.php: 404 /temp/public/x.php: 404 unknown host name: 000

The status 000 means nginx closed the connection without an answer.

An admin page opens when the request comes from your own site. It is refused when it comes from anywhere else (another site, a bookmark, the address bar). The same applies to anything sent to Tiki's router, so a link or a form on another site cannot make your signed-in browser act on your Tiki:

H=$(sed -n 's/^set \$tiki_host "\(.*\)";$/\1/p' /etc/nginx/tiki-host.conf) for s in same-origin cross-site none; do curl -sk -o /dev/null -w "admin page, Sec-Fetch-Site $s: %{http_code}\n" -H "Sec-Fetch-Site: $s" --resolve "$H:443:127.0.0.1" "https://$H/tiki-admin.php" done for s in same-origin cross-site; do curl -sk -o /dev/null -w "form sent to a page, Sec-Fetch-Site $s: %{http_code}\n" -H "Sec-Fetch-Site: $s" --data 'x=1' --resolve "$H:443:127.0.0.1" "https://$H/HomePage" done

admin page, Sec-Fetch-Site same-origin: 302 admin page, Sec-Fetch-Site cross-site: 403 admin page, Sec-Fetch-Site none: 403 form sent to a page, Sec-Fetch-Site same-origin: 200 form sent to a page, Sec-Fetch-Site cross-site: 403

A 200 or a redirect means Tiki answered. The admin page itself asks you to sign in when you are not signed in. The rules live in /etc/nginx/conf.d/sac-xsite-guard.conf (pinned to your host name by tiki-set-hostname) and /etc/nginx/conf.d/sac-tiki-guard.conf.

Only root can read the credentials file. Only root and the web server can read the database configuration. The Tiki code belongs to root. MariaDB has no network listener, PHP cannot shell out, and nginx, PHP, MariaDB, first boot and the scheduler cannot reach the instance metadata service:

sudo stat -c '%a %U:%G %n' /root/tiki-credentials.txt /var/www/tiki/db/local.php /var/www/tiki/tiki-index.php /var/www/tiki/temp
sudo mysql -N -e 'SELECT @@skip_networking, @@bind_address' php-fpm8.3 -i 2>/dev/null | grep -E '^(disable_functions|open_basedir|ffi.enable) ' for u in nginx php8.3-fpm mariadb tiki-firstboot tiki-scheduler; do printf '%s: %s\n' "$u" "$(systemctl show -p IPAddressDeny --value $u)"; done

600 root:root /root/tiki-credentials.txt 640 root:www-data /var/www/tiki/db/local.php 644 root:root /var/www/tiki/tiki-index.php 750 www-data:www-data /var/www/tiki/temp 1 127.0.0.1 disable_functions => exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,pcntl_fork,putenv,mail,dl => exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,pcntl_fork,putenv,mail,dl open_basedir => /var/www/tiki/:/var/lib/php/sessions/:/tmp/ => /var/www/tiki/:/var/lib/php/sessions/:/tmp/ ffi.enable => Off => Off nginx: fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 php8.3-fpm: fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 mariadb: fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 tiki-firstboot: fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 tiki-scheduler: fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32

sudo tiki-cred-roundtrip signs in through the real sign-in form with the password from the credentials file and checks that wrong passwords are refused.

nginx removes X-Forwarded-For, X-Real-IP, Client-IP and Forwarded from every request, and Tiki reads the client address from the connection (feature_loadbalancer is off), so Tiki's logs and its sign-in protection use the address of the connection. Behind an AWS load balancer, that is the load balancer's address. nginx's own access log (/var/log/nginx/access.log) records it the same way.

To record visitors' addresses, use nginx's real_ip module with set_real_ip_from set to your load balancer's subnet only.

Point a DNS record at the instance, then set the name Tiki is served as. The command below creates a new self-signed certificate for the name. It updates nginx (which hands the name to Tiki), the cross-site rule and Tiki's site domain, clears Tiki's caches, and updates the address in /root/tiki-credentials.txt. The name persists across reboots.

sudo tiki-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running tiki-set-hostname again replaces it with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/tiki.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/tiki.key
sudo nginx -t && sudo systemctl reload nginx

Once browsers trust the certificate, you can also add an HSTS header (add_header Strict-Transport-Security "max-age=31536000" always;) to /etc/nginx/snippets/sac-tiki-headers.conf. The image does not send one, because browsers ignore HSTS from a site whose certificate they do not trust.

tiki-set-password gives the admin account a new random password with Tiki's own console, signs out every session and records the password in /root/tiki-credentials.txt. Run it without arguments, or pass your own password (24 to 72 letters and digits) on stdin. Users change their own passwords under their preferences.

sudo tiki-set-password printf '%s\n' '<your-new-password>' | sudo tiki-set-password --stdin

Email. The image ships no local mail server, and PHP's mail() is disabled. Set an SMTP server under Control Panels > General > Mail (choose SMTP as the mail sender) before you rely on notifications, password resets or invitations.

Features that stay off on this image.

Tiki's server check page (tiki-check.php) is refused because it runs shell commands, which PHP cannot do here.

Printing several pages or a whole structure as one document (tiki-print_pages.php, tiki-print_multi_pages.php) is refused until a Tiki release carries the permission fix that is already on Tiki's 30.x branch. After you upgrade to that release, you can lift the two lines in /etc/nginx/conf.d/sac-tiki-guard.conf.

Tiki's in-browser template editor and theme writes need the templates and themes folders to be writable, which they are not here.

Tiki's search-engine-friendly URL aliases for the AJAX service, log out, tracker fields and the REST API need same-origin proof, like the pages they lead to. Call tiki-api.php directly from scripts.

Upgrades. Take a snapshot first. Replace the code with the new release's files, keeping db/local.php, db/sac-system.ini.php, storage and img. Then run sudo tiki-console database:update and sudo tiki-console cache:clear all.

After an upgrade, /usr/share/doc/tiki/TIKI-30.1.sha256 describes the old release, so the check in Step 3 reports the changed files.

Component Path

Tiki (root-owned) /var/www/tiki

Database configuration (this instance's password) /var/www/tiki/db/local.php

Tiki system configuration (locked settings) /var/www/tiki/db/sac-system.ini.php

Uploads and wiki images /var/www/tiki/storage, /var/www/tiki/img/wiki_up, /var/www/tiki/img/wiki, /var/www/tiki/img/trackers

Caches (rebuilt automatically) /var/www/tiki/temp

Database (MariaDB datadir) /var/lib/mysql

nginx site, request limits and cross-site link rules /etc/nginx/sites-available/sac-tiki, /etc/nginx/conf.d/sac-tiki-guard.conf, /etc/nginx/conf.d/sac-xsite-guard.conf, /etc/nginx/snippets/sac-tiki-*.conf

PHP settings /etc/php/8.3/fpm/conf.d/99-sac-tiki.ini

MariaDB settings /etc/mysql/mariadb.conf.d/99-sac-tiki.cnf

Scheduler tiki-scheduler.timer, tiki-scheduler.service, /usr/local/lib/sac/tiki-scheduler-php

Certificate and key /etc/nginx/ssl/

First boot script and helpers /usr/local/sbin/tiki-firstboot.sh, /usr/local/lib/sac/tiki/

Helpers /usr/local/sbin/tiki-console, tiki-set-hostname, tiki-set-password, tiki-cred-roundtrip

License, release, manifest, dependency audit and image notes /usr/share/doc/tiki/

Credentials /root/tiki-credentials.txt (mode 0600)

• Allow port 22 in the security group from your own networks only.
• Keep the admin password secret and rotate it if it may have been shared (Step 12). Give editors their own accounts with limited groups.
• Keep db/local.php and your database backups secret (Step 8).
• Use your own DNS name and a certificate your browsers trust (Step 11).
• Keep Tiki on the newest 30.x LTS release (Step 12).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else. MariaDB and PHP-FPM, with its zip, intl and bcmath extensions, come from Ubuntu's universe repository. sudo pro security-status --esm-apps shows whether Ubuntu Pro (ESM Apps) has security updates for them. None were pending when the image was built.