Wiki-Go

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size. The wiki is light, so content volume rather than CPU decides when you need more.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the wiki. Put TLS in front of the wiki before you expose it publicly, as described in Enabling HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Wiki-Go by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:wiki-go-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name wiki-go \
  --image sac1647283583153:wiki-go-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the wiki port on the VM's network security group:

az vm open-port --resource-group <your-rg> --name wiki-go --port 80 --priority 1001

Step 3 - Retrieve the per-VM administrator password

The image ships with no wiki configuration. On the first boot of every VM, a bootstrap service generates a unique administrator password and hashes it with bcrypt at the project's own cost factor. It writes the wiki configuration around the hash, and only then starts the wiki. The password is written to a root-only file.

SSH in and read the file:

ssh azureuser@<vm-public-ip>
sudo cat /root/wiki-go-credentials.txt

The file contains the wiki URL, the admin user name and the generated password:

wikigo.url=http://<vm-ip>/ wikigo.admin.user=admin wikigo.admin.pass=<WIKIGO_ADMIN_PASSWORD>

Keep this password safe. It is the only administrator credential on the VM.

The address in this file comes from the Azure instance metadata service, which returns an empty value for Standard SKU public IPs. The file therefore usually shows the VM's private address. Use the VM's public IP address from the Azure Portal to browse to the wiki. The recorded address only affects this note and the footer text, and does not restrict what the wiki serves.

Step 4 - Confirm the wiki is healthy

Run these commands on the VM. One service runs the whole product, so there is a single unit to check:

systemctl is-active wiki-go.service curl -s -o /dev/null -w 'homepage HTTP %{http_code}\n' http://127.0.0.1/ curl -s -o /dev/null -w 'sign-in page HTTP %{http_code}\n' http://127.0.0.1/login

Expected output:

active homepage HTTP 200 sign-in page HTTP 200

Confirm that both units are enabled for future reboots and that the wiki owns port 80:

systemctl is-enabled wiki-go.service wiki-go-firstboot.service ss -tln | grep ':80 '

Expected output:

enabled enabled LISTEN 0 4096 *:80 *:*

Step 5 - Sign in to the web interface

Open http://<vm-public-ip>/login in a browser and sign in with admin and the password from Step 3.

After you sign in, you see the page tree and the search box in the sidebar, the page itself in the main pane, and the authoring toolbar across the top. Tables, syntax-highlighted code blocks, Mermaid diagrams and LaTeX maths are rendered from the Markdown source.

The sign-in page shows the project's standard notice that the wiki is private and requires authentication. On a freshly deployed image, the wiki is actually public to read, and only editing requires a login. To change that, see Making the wiki private below.

Step 6 - Write and edit pages

Select New in the toolbar to create a page, or Edit to change the page you are viewing. The editor shows the raw Markdown with a formatting toolbar, a live word and line count, and a preview toggle. Select Save to write the page straight back to disk as a .md file.

History on the same toolbar lists previous revisions of the page and restores any of them, so an accidental edit is never destructive. Attachments uploads images and documents against the page, and Move/Rename reorganises the tree.

To control the order of pages in the sidebar, prefix the page slug with a number, for example 1-overview and 2-installation. The sidebar title comes from the first # heading in the page, so the slug and the displayed title can differ.

Step 7 - Search the wiki

Type in the search box at the top of the sidebar. Search covers the full text of every page and highlights matched terms in context. Use quoted phrases for exact matching, and -term to exclude a word.

Where your content lives

Every page is a plain Markdown file under /var/lib/wiki-go/data/documents, in one directory per page containing a document.md. There is no database anywhere on the VM. List the pages and check the data size with:

find /var/lib/wiki-go/data/documents -name '*.md' | sort du -sh /var/lib/wiki-go/data

Example output (your pages will differ):

/var/lib/wiki-go/data/documents/onboarding-checklist/document.md /var/lib/wiki-go/data/documents/platform-runbook/document.md /var/lib/wiki-go/data/documents/release-notes/document.md 624K /var/lib/wiki-go/data

Because the content is plain files, a backup is a file copy with no dump step:

sudo tar czf ~/wiki-go-backup-$(date +%F).tar.gz -C /var/lib/wiki-go data

To restore, extract the archive back over /var/lib/wiki-go/data and run sudo systemctl restart wiki-go. The same property makes it easy to keep the wiki in git, or to author pages on your laptop and copy them up.

Security and the first boot

Upstream Wiki-Go writes its configuration on first run and seeds it with a published default administrator: user admin with password admin. This image never allows that. It ships with no configuration file, and wiki-go.service carries a condition that keeps it from starting until the first-boot service has written a configuration containing the generated per-VM password.

You can confirm on any VM that the upstream default is not in use. Wiki-Go exposes this check as an API:

curl -s http://127.0.0.1/api/check-default-password; echo
curl -s -o /dev/null -w 'upstream default admin/admin -> HTTP %{http_code}\n' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"admin"}' http://127.0.0.1/api/login

Expected output:

{"defaultPasswordInUse":false} upstream default admin/admin -> HTTP 401

Other security notes:

• Sign-in rate limiting. Repeated failed sign-in attempts are rate limited and temporarily ban the source address, after five failures in three minutes by default. Tune this under Settings, Security.
• Unprivileged service. The wiki runs as the unprivileged wikigo user. It binds port 80 through a targeted Linux capability rather than by running as root, and the unit restricts it with NoNewPrivileges, ProtectSystem and ProtectHome.
• Named accounts. Change the administrator password from the UI at any time under Settings. You can also add named accounts under Settings, Users and give each person their own login with an administrator, editor or viewer role.

Making the wiki private

A freshly deployed wiki is readable by anyone who can reach port 80, and only editing requires a login. To require a login for reading as well, sign in and set the wiki to private under Settings, General. You can also edit the configuration directly on the VM.

The configuration file is /var/lib/wiki-go/data/config.yaml. Set private: true under the wiki: section and restart the service. For finer control, use Settings, Access to mark individual paths public, private or restricted to a named group. This lets you keep most of the wiki open and lock down a section.

Enabling HTTPS

Wiki-Go serves plain HTTP on port 80 out of the box. The image sets allow_insecure_cookies: true so that sign-in works in a browser over plain HTTP. Without that setting, Wiki-Go marks its session cookie Secure, browsers silently discard it on an HTTP connection, and sign-in fails even though every page still returns HTTP 200.

For any public-facing wiki, put TLS in front and turn that setting back off. Wiki-Go has native TLS support. Point a DNS A record at the VM's public IP and obtain a certificate for that name. Then, in /var/lib/wiki-go/data/config.yaml, set ssl: true, set ssl_cert and ssl_key to your certificate and key paths, set port: 443 and set allow_insecure_cookies: false. Restart the service, and open 443/tcp on the network security group.

Alternatively, terminate TLS at a reverse proxy such as nginx or Caddy and leave Wiki-Go on plain HTTP behind it. In that case, keep allow_insecure_cookies: true for the proxy-to-app hop and make sure the proxy forwards the X-Forwarded-Proto header.

Maintenance

• OS updates: the image keeps Ubuntu's unattended-upgrades enabled, so security patches continue to land. Apply pending updates manually at any time with sudo apt-get update && sudo apt-get upgrade -y.
• Service logs: sudo journalctl -u wiki-go.service -f follows the wiki log. sudo journalctl -u wiki-go-firstboot.service shows what the first boot did.
• Restart: sudo systemctl restart wiki-go.service.
• Configuration: the file is /var/lib/wiki-go/data/config.yaml. Most settings are also editable in the UI under Settings, which writes to the same file. Restart the service after you edit the file by hand.
• Upgrading Wiki-Go: the whole application is the single binary at /opt/wiki-go/wiki-go. Download a newer release from the project's GitHub releases page, verify its checksum, replace that file and restart the service. Your content is untouched because it lives in /var/lib/wiki-go/data.
• Page history: every edit is versioned, and the last ten revisions of each page are kept by default. Raise max_versions in the configuration for a deeper history.

Support

This image is maintained by SecureAnyCloud with 24/7 support. Contact sales@secureanycloud.com for assistance.

Deploy on Azure

Launch Wiki-Go on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com