Wiki-Go 1.9.2

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Wiki-Go 1.9.2 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Choose m5.large, your key pair and a security group as described in Prerequisites. Wiki-Go is light, so a smaller instance is fine for a small team.

Alternatively, launch with the AWS CLI. Replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=wiki-go}]'

Version SSH user

Wiki-Go 1.9.2 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes a few seconds. After it completes, nginx, Wiki-Go and the first-boot unit are all active:

systemctl is-active nginx wiki-go wiki-go-firstboot

active active active

List the listening ports. nginx serves ports 80 and 443, Wiki-Go listens on the loopback address only, and there is no database. The only open ports are 22, 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /nginx|sshd|wiki-go/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN 127.0.0.1:8080 users:(("wiki-go")) LISTEN [::]:22 users:(("sshd"),("systemd")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx"))

Read the release record. It names the binary and the source it was built from:

cat /usr/share/doc/wiki-go/RELEASE sha256sum /opt/wiki-go/wiki-go

Wiki-Go 1.9.2 binary sha256 c640b78d65d9904762141eb727f19d4cf362a551a6fd33259014cb68268ebeef source sha256 c521c3cc537ede4e0a1fa9d2705c1f339258db00fb50b2fb669e4e9640a66eed patch sha256 53580dec1466769f514e955ae684cfb85634fd70b94d4b14a4176de541f7b897 license GPL-3.0 sha256 8b1ba204bb69a0ade2bfcf65ef294a920f6bb361b317dba43c7ef29d96332b9b c640b78d65d9904762141eb727f19d4cf362a551a6fd33259014cb68268ebeef /opt/wiki-go/wiki-go

The credentials file holds the address the wiki is served as (your instance's public DNS name by default), the user name and the password generated on this instance. Display it with:

sudo cat /root/wiki-go-credentials.txt

WIKIGO_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ WIKIGO_ADMIN_USER=admin WIKIGO_ADMIN_PASSWORD=<24 letters and digits>

Open WIKIGO_URL in your browser. The certificate is self-signed and generated on your instance, so accept the browser warning once, or install your own certificate (Step 10).

The wiki is readable without signing in. Choose Login (or open /login) and sign in as admin with WIKIGO_ADMIN_PASSWORD. The sign-in page always carries Wiki-Go's notice that the wiki is private. In fact, a fresh wiki is readable by anyone who can reach it until you make it private in Step 7.

After you sign in, the toolbar shows the authoring tools and Settings. The sidebar holds the page tree and the search box. The home page is Wiki-Go's own welcome page, and you can edit it like any other page. Its note about setting allow_insecure_cookies: true is for wikis served over plain HTTP and does not apply here. This image serves HTTPS, so leave that setting false.

Choose New to create a page, or Edit to change the page you are on. The editor shows the Markdown with a formatting toolbar and a preview toggle. Save writes the page to disk as a .md file.

While editing, History lists earlier versions and restores any of them. Attachments uploads images and documents to the page. Move/Rename and Delete reorganise the tree.

Tables, syntax-highlighted code, task lists, Mermaid diagrams and LaTeX maths all render from the Markdown.

The search box searches the full text of every page. Use quotes for an exact phrase and -word to leave a word out. To order pages in the sidebar, start their slugs with a number (1-overview, 2-install).

Open Settings, then Users, and add an account for each person with the admin, editor or viewer role. Viewers can read and comment, and editors can also write. Change your own password under Settings, Profile.

A fresh wiki is readable by anyone who can reach port 443, and only signed-in users can edit. To require a sign-in to read anything, turn on Private wiki under Settings, Content.

Under Settings, Access, you can mark individual paths public, private or restricted to a group. This lets you keep most of the wiki open and lock down a single section.

The wiki stores everything under /var/lib/wiki-go/data. This includes the settings and users (config.yaml), pages (documents/, with the home page in pages/home/), uploaded attachments next to their page, version history, comments, and the session and sign-in ban state (temp/). Each page is a folder with a document.md:

sudo ls /var/lib/wiki-go/data
sudo du -sh /var/lib/wiki-go/data

config.yaml documents pages static temp 572K /var/lib/wiki-go/data

Wiki-Go has a built-in backup under Settings, Backup. Because the content is just files, a file copy is also a full backup. Stop the wiki first so nothing changes during the copy:

sudo systemctl stop wiki-go
sudo tar czf /home/ubuntu/wiki-go-backup-$(date +%F).tar.gz -C /var/lib/wiki-go data
sudo systemctl start wiki-go

To keep the wiki on its own EBS volume, follow these steps. Attach the volume and stop Wiki-Go. Copy /var/lib/wiki-go onto the volume, then mount the volume on /var/lib/wiki-go (by UUID in /etc/fstab). Make sure it is owned by wikigo:wikigo with mode 750, then start Wiki-Go again. EBS snapshots of that volume are then your backups.

Run these checks to confirm the security posture. Port 80 sends browsers to HTTPS, the health endpoint answers load balancer checks, the upstream default password is not in use, and requests for a host name the instance does not serve are dropped:

H=$(sed -n 's/^set \$wg_host "\(.*\)";$/\1/p' /etc/nginx/wiki-go-host.conf)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz"
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/api/check-default-password"; echo
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ ok {"defaultPasswordInUse":false} unknown host name: 000

A result of 000 means nginx closed the connection without an answer. The upstream default admin / admin is refused, and the password generated on this instance signs in. The next block passes the password from the credentials file to curl without printing it:

H=$(sed -n 's/^set \$wg_host "\(.*\)";$/\1/p' /etc/nginx/wiki-go-host.conf)
curl -sk -w ' %{http_code}\n' --resolve "$H:443:127.0.0.1" -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"admin"}' "https://$H/api/login"
sudo sed -n 's/^WIKIGO_ADMIN_PASSWORD=\(.*\)/{"username":"admin","password":"\1"}/p' /root/wiki-go-credentials.txt \
  | curl -sk -o /dev/null -w 'generated password: %{http_code}\n' --resolve "$H:443:127.0.0.1" \
  -H 'Content-Type: application/json' --data-binary @- "https://$H/api/login"

{"message":"Invalid credentials","success":false} 401 generated password: 200

Only root can read the credentials file, only Wiki-Go's own user can read the wiki's data folder, and the binary belongs to root. Wiki-Go listens on loopback, keeps its session cookie Secure, trusts forwarded addresses from nginx only, and stores the administrator's password as a bcrypt hash:

sudo stat -c '%a %U:%G %n' /root/wiki-go-credentials.txt /var/lib/wiki-go/data /var/lib/wiki-go/data/config.yaml /opt/wiki-go/wiki-go
sudo grep -E '^ (host|port|allow_insecure_cookies|trusted_proxies):' /var/lib/wiki-go/data/config.yaml
sudo grep -A1 '^ - username: admin' /var/lib/wiki-go/data/config.yaml | cut -c1-23

600 root:root /root/wiki-go-credentials.txt 750 wikigo:wikigo /var/lib/wiki-go/data 640 wikigo:wikigo /var/lib/wiki-go/data/config.yaml 755 root:root /opt/wiki-go/wiki-go host: "127.0.0.1" port: 8080 allow_insecure_cookies: false trusted_proxies: [127.0.0.1] - username: admin password: $2y$14$

nginx replaces the client address headers with the connection's own address and passes the configured host name, never the one a client sends:

grep -E 'X-Forwarded-For|X-Real-IP|Host ' /etc/nginx/snippets/sac-wiki-go-proxy.conf | grep -v '^#'

proxy_set_header Host $wg_host; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Host "";

Wiki-Go runs as wikigo with no capabilities and a read-only system. Only its data folder is writable, and neither service can reach the instance metadata service:

systemctl show wiki-go -p User -p ProtectSystem -p ReadWritePaths -p NoNewPrivileges -p IPAddressDeny
systemctl show nginx -p IPAddressDeny

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 User=wikigo ReadWritePaths=/var/lib/wiki-go ProtectSystem=strict NoNewPrivileges=yes IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32

The certificate was generated on this instance and names its own addresses:

H=$(sed -n 's/^set \$wg_host "\(.*\)";$/\1/p' /etc/nginx/wiki-go-host.conf)
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

Point a DNS record at the instance, then set the name the wiki is served as. This command creates a new self-signed certificate for the name, updates nginx and the URL in /root/wiki-go-credentials.txt, and keeps the name across reboots:

sudo wiki-go-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running wiki-go-set-hostname again replaces it with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/wiki-go.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/wiki-go.key
sudo nginx -t && sudo systemctl reload nginx

When browsers trust the certificate, you can also add an HSTS header (add_header Strict-Transport-Security "max-age=31536000" always;) to the port 443 server in /etc/nginx/sites-available/sac-wiki-go. The image does not send one, because browsers ignore HSTS from a site whose certificate they do not trust.

Keep Wiki-Go's own ssl setting off and allow_insecure_cookies false. nginx handles TLS.

Change the administrator password in the web interface (Settings, Profile), or reset it over SSH if it is lost. wiki-go-set-password writes a new bcrypt hash into the wiki, records the password in /root/wiki-go-credentials.txt, signs every session out and restarts Wiki-Go. Run it without arguments for a random password, or pass your own (24 to 64 letters and digits) on stdin:

sudo wiki-go-set-password printf '%s\n' '<your-new-password>' | sudo wiki-go-set-password --stdin

Wiki-Go bans an address for 60 seconds after five failed sign-ins in three minutes. Each further ban of that address doubles, up to 24 hours. Tune this under Settings, Security. A ban clears itself. To clear every ban at once, run sudo systemctl stop wiki-go && sudo rm -f /var/lib/wiki-go/data/temp/login_ban.json && sudo systemctl start wiki-go.

Wiki-Go saves settings changed in the web interface to /var/lib/wiki-go/data/config.yaml. If you edit that file by hand, restart Wiki-Go afterwards (sudo systemctl restart wiki-go). Keep host: "127.0.0.1", port: 8080 and trusted_proxies: [127.0.0.1] as they are, because nginx depends on them.

To upgrade to a later Wiki-Go release, snapshot the instance first. Download the wiki-go-linux-amd64 binary of the new release from the Wiki-Go releases page on GitHub and check its checksum. Replace /opt/wiki-go/wiki-go with it (owned by root, mode 755), then restart Wiki-Go. Your content is untouched because it lives in /var/lib/wiki-go/data.

SecureAnyCloud also publishes new versions of this image as Wiki-Go releases appear.

Component Path

Wiki-Go binary (root owned) /opt/wiki-go/wiki-go

Wiki data, settings and users /var/lib/wiki-go/data (config.yaml, documents/)

Wiki-Go service /etc/systemd/system/wiki-go.service

nginx site and proxy settings /etc/nginx/sites-available/sac-wiki-go, /etc/nginx/snippets/sac-wiki-go-proxy.conf

Certificate and key /etc/nginx/ssl/

First boot script and settings template /usr/local/sbin/wiki-go-firstboot.sh, /usr/share/sac/wiki-go/config.template.yaml

Helpers /usr/local/sbin/wiki-go-set-hostname, /usr/local/sbin/wiki-go-set-password

Licence, source and release record /usr/share/doc/wiki-go/

Credentials /root/wiki-go-credentials.txt (mode 0600)

• Allow port 22 in the security group from your own networks only, and port 443 from the networks that should reach the wiki.
• Give each person their own account with the smallest role they need. Make the wiki private (Step 7) if its content is not for everyone.
• Use your own DNS name and a certificate your browsers trust (Step 10).
• Every page loads /var/lib/wiki-go/data/static/custom.css and custom.js (only comments by default) for your own styling and scripts. Anything you put there runs for every visitor, so keep those files to content you trust.
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.
• Back up /var/lib/wiki-go/data (Step 8).