Applications AWS

DokuWiki 2026-07-14c on AWS User Guide

| Product: DokuWiki 2026-07-14c on Ubuntu 24.04 on AWS

Overview

This guide covers launching and using the DokuWiki 2026-07-14c on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg BookStack, CMS, Blogs and Wikis listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

DokuWiki is an open source wiki that needs no database. Every page is a plain text file with a full revision history, so the whole wiki is one folder you can back up, search and move with ordinary file tools. It has a simple markup editor, namespaces to organise pages, a media manager for images and files, page-level access control lists, a user manager and a large catalogue of plugins and templates.

The cloudimg image adds:

  • No web installer, no default login. Out of the box DokuWiki ships install.php, a setup page that hands the new wiki and its administrator account to whoever opens it first. This image removes it. Your instance's first boot configures DokuWiki before the web server starts: an administrator admin with a password generated on your instance (stored only as a bcrypt hash), access control switched on, and a cookie secret of its own. The password is recorded in /root/dokuwiki-credentials.txt. Nothing from the image build ships in the image.
  • The current release, with its security fix. DokuWiki 2026-07-14c "Mort" is the newest stable release, and it fixes CVE-2026-113356 (PHP object injection through page drafts). The download is verified against a pinned checksum.
  • HTTPS from the first boot. nginx serves DokuWiki on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS.
  • Safe defaults for a new wiki. Anyone who can reach the wiki can read it; only signed-in users can edit, create pages and upload files. Self-registration and e-mail password reset are switched off, so accounts are only created by an administrator.
  • Fail closed. nginx and PHP refuse to start until first boot has finished.
  • Configuration and data never served. DokuWiki protects its configuration (including the password hashes), its data and its code folders with Apache .htaccess rules that nginx ignores; this image replaces them. The wiki data lives outside the web root on its own EBS volume, and PHP runs only through DokuWiki's own entry points.
  • Failed-login lockout. DokuWiki itself has none. On this image ten failed sign ins from one address within 15 minutes block that address for five minutes, whether they come through the login form or HTTP Basic credentials. The address comes from the connection, never from a header a client sends, and DokuWiki records editors' addresses the same way.
  • Hardened defaults. The DokuWiki code is owned by root and read only to PHP; PHP can write only the wiki data and the configuration files DokuWiki's own admin tools edit, cannot run shell commands and is confined to DokuWiki's folders. Installing plugins and templates from the browser is off until you switch it on. nginx and PHP are blocked from the instance metadata service, the AMI requires IMDSv2, requests for a host name the instance does not serve are dropped, and DokuWiki's links always use the host name you configure, never the one a request claims.
  • Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: DokuWiki 2026-07-14c "Mort" (the upstream release, checksum verified) with its default template and bundled plugins, PHP 8.3 FPM, nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent. The wiki data is on a separate 20 GiB EBS volume mounted at /var/lib/dokuwiki. First boot creates a welcome start page next to DokuWiki's own help pages (wiki:syntax, wiki:welcome).

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

  • An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet (or a private route you use for management).
  • A security group that allows TCP 22 (SSH), TCP 443 (the wiki) and TCP 80 (redirects to HTTPS) from the networks that should reach them. A wiki for your team only needs 443 and 80 open to your team's networks; keep 22 to your own networks.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick DokuWiki 2026-07-14c on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large (DokuWiki is light; a smaller instance is fine for a small team), your key pair and a security group as above. Keep the second volume (the wiki data) in the launch settings; you can make it larger there.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dokuwiki}]'

Step 2: Connect to your instance

Version SSH user
DokuWiki 2026-07-14c on Ubuntu 24.04 ubuntu 
ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot takes a few seconds. Then nginx, PHP and the first boot unit are active:

systemctl is-active nginx php8.3-fpm dokuwiki-firstboot

active
active
active

nginx serves ports 80 and 443; PHP listens on a local socket only, and there is no database, so the only open ports are 22, 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /nginx|sshd|php/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer
LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx"))
LISTEN 0.0.0.0:22 users:(("sshd"),("systemd"))
LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx"))
LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx"))
LISTEN [::]:22 users:(("sshd"),("systemd"))
LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx"))

The DokuWiki release, the PHP version and the wiki data volume:

cat /var/www/dokuwiki/VERSION
php -v | head -1
findmnt -no TARGET,FSTYPE,SIZE /var/lib/dokuwiki

2026-07-14c "Mort"
PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS)
/var/lib/dokuwiki ext4   19.5G

Step 4: Get your sign-in details

The credentials file holds the address the wiki is served as (your instance's public DNS name by default), the sign-in page, the administrator user name and the password generated on this instance. Show it with:

sudo cat /root/dokuwiki-credentials.txt

DOKUWIKI_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/
DOKUWIKI_LOGIN_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/start?do=login
DOKUWIKI_ADMIN_USER=admin
DOKUWIKI_ADMIN_PASSWORD=<24 letters and digits>

Step 5: Visit your wiki and sign in

Open DOKUWIKI_URL in your browser. The certificate is self signed (generated on your instance), so accept the browser warning once, or install your own certificate (Step 11). Visitors see the start page:

The DokuWiki start page Welcome to your wiki with the Getting started list, the search box and the Recent Changes, Media Manager and Sitemap links

Choose Log In (top right) and sign in as admin with DOKUWIKI_ADMIN_PASSWORD:

The DokuWiki Login form with the Username and Password fields, the Remember me option and the Log In button

Step 6: The administration area

Signed in as admin, Admin (top right) opens the administration area: Access Control List Management, Configuration Settings, Extension Manager, Template Style Settings, User Manager, View Logs, Popularity Feedback and Revert Manager, with the DokuWiki, PHP and Ubuntu versions alongside.

The DokuWiki Administration page listing Access Control List Management, Configuration Settings, Extension Manager, Template Style Settings, User Manager, View Logs, Popularity Feedback and Revert Manager, with the release 2026-07-14c Mort

Configuration Settings sets the wiki title (the image starts with "DokuWiki"), the language, the content licence and everything else DokuWiki offers. A few settings show with a light red background: they are pinned by this image (the served address, the data folder, access control, password hashing, secure cookies and the proxy and download limits) in the root-owned file /var/www/dokuwiki/conf/local.protected.php, so neither the browser nor a request can change them.

Step 7: Write your first page

Open a page name that does not exist yet, for example https://<your-wiki>/projects:roadmap, and choose Create this page. Write in DokuWiki's markup with the toolbar (headings, links, lists, code blocks, images from the media manager), add an edit summary and Save. Colons in a page name make namespaces (projects:roadmap is the page roadmap in the namespace projects), which also appear as folders in the media manager and the access control lists.

The DokuWiki editor for the page projects:roadmap with the toolbar, a heading, a bulleted list and a code block, and the Save, Preview and Cancel buttons

Every save keeps the previous revision. Old revisions shows the history of a page, compares any two revisions and restores an older one; Recent Changes lists every change in the wiki.

Step 8: Users and access control

Admin > User Manager adds, edits and deletes users. New users belong to the group user, which may read, edit, create pages and upload files; put trusted administrators in the group admin. Self-registration is switched off on this image, so this is the only way accounts are created.

The DokuWiki User Manager listing the admin user (Administrator, admin@example.invalid, groups admin and user) and the Add user form

Admin > Access Control List Management sets who may do what, per namespace or page. The image starts with two rules: everyone (@ALL) may read, and signed-in users (@user) may read, edit, create and upload. To make the whole wiki private, set @ALL on * to None; to give one team its own space, add a rule for its group on its namespace.

The DokuWiki Access Control List Management page with the namespace tree and the current rules: * @ALL Read and * @user Upload

Email: DokuWiki sends notifications (page subscriptions, new user notices) with PHP's mail(). The image has no mail server, so they are not delivered until you install and configure a mail transfer agent that relays through your mail provider. E-mail password reset is switched off for the same reason; an administrator sets a new password in the User Manager, and admin's own password is reset from the shell (Step 12).

Step 9: Your wiki data

DokuWiki keeps the wiki on its own EBS volume at /var/lib/dokuwiki, outside the web root and readable only by the web server: pages holds the current text of every page, attic the old revisions, media and media_attic your uploads, meta page metadata and the change log, index the search index, and cache, locks, log and tmp working files. The configuration DokuWiki's admin tools edit (users.auth.php with the password hashes, acl.auth.php, local.php) is in /var/www/dokuwiki/conf, where everything else belongs to root:

sudo ls -l /var/www/dokuwiki/conf | sed -E 's/ +/ /g' | cut -d' ' -f1,3,4,9- | grep -E 'auth|local'

-rw-r----- www-data www-data acl.auth.php
-rw-r--r-- root root acl.auth.php.dist
-rw-r----- www-data www-data local.php
-rw-r--r-- root root local.php.dist
-rw-r--r-- root root local.protected.php
-rw-r----- www-data www-data users.auth.php
-rw-r--r-- root root users.auth.php.dist

Back the wiki up with an EBS snapshot of the data volume (and of the root volume for the configuration), or as files:

sudo tar -czf dokuwiki-backup.tar.gz -C / var/lib/dokuwiki var/www/dokuwiki/conf

To restore onto a new instance, let its first boot finish, stop nginx and PHP (sudo systemctl stop nginx php8.3-fpm), replace /var/lib/dokuwiki and the files users.auth.php, acl.auth.php and local.php in /var/www/dokuwiki/conf with your copies (owned by www-data), and start them again. The restored users.auth.php brings its own passwords.

Step 10: Security checks

Port 80 sends browsers to HTTPS, the health endpoint answers for load balancer checks, and the installer, the configuration and password files, the data folder, DokuWiki's code and a crafted media address are not reachable:

H=$(sed -n 's/^set \$dw_host "\(.*\)";$/\1/p' /etc/nginx/dokuwiki-host.conf)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/start"
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz"
for p in /install.php /conf/users.auth.php /conf/local.protected.php /data/pages/start.txt /inc/init.php /bin/plugin.php /vendor/autoload.php "/lib/exe/fetch.php?media=../../conf/users.auth.php"; do
  curl -sk -o /dev/null -w "$p: %{http_code}\n" --resolve "$H:443:127.0.0.1" "https://$H$p"
done
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/start
ok
/install.php: 404
/conf/users.auth.php: 404
/conf/local.protected.php: 404
/data/pages/start.txt: 404
/inc/init.php: 404
/bin/plugin.php: 404
/vendor/autoload.php: 404
/lib/exe/fetch.php?media=../../conf/users.auth.php: 404
unknown host name: 000

(000 means nginx closed the connection without an answer.) DokuWiki's own view of its settings: one account whose password is a bcrypt hash, access control on, the configured HTTPS address as the base of every link, no trust in forwarded client addresses, the remote API and remote downloads off, self-registration and password reset off, no installer and a cookie secret of this instance's own:

sudo -u www-data php /usr/local/lib/cloudimg/dokuwiki/dokuwiki-admin.php summary

version=2026-07-14c "Mort"
users=admin
adminGroups=admin,user
hashAlgo=bcrypt
useacl=1
authtype=authplain
passcrypt=bcrypt
superuser=@admin
baseurl=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com
savedir=/var/lib/dokuwiki
userewrite=1
securecookie=1
trustedproxies=0
remote=0
fetchsize=0
allowdebug=0
disableactions=register,resendpwd
install=absent
cookiesalt=ok
cookiesaltLegacy=no

The credentials file is readable by root only, the password file and the wiki data by the web server only, and the code and the pinned settings belong to root:

sudo stat -c '%a %U:%G %n' /root/dokuwiki-credentials.txt /var/www/dokuwiki/conf/users.auth.php /var/lib/dokuwiki /var/www/dokuwiki/conf/local.protected.php /var/www/dokuwiki/doku.php

600 root:root /root/dokuwiki-credentials.txt
640 www-data:www-data /var/www/dokuwiki/conf/users.auth.php
750 www-data:www-data /var/lib/dokuwiki
644 root:root /var/www/dokuwiki/conf/local.protected.php
644 root:root /var/www/dokuwiki/doku.php

The certificate was generated on this instance and names its own addresses:

H=$(sed -n 's/^set \$dw_host "\(.*\)";$/\1/p' /etc/nginx/dokuwiki-host.conf)
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = cloudimg
X509v3 Subject Alternative Name:
    DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

nginx and PHP cannot reach the instance metadata service, PHP cannot run shell commands or open URLs as files, is confined to DokuWiki's folders and runs the login guard before every request, and nginx hands PHP the configured host name and the real client address from the connection, never values a client sends:

systemctl show nginx -p IPAddressDeny
systemctl show php8.3-fpm -p IPAddressDeny
php-fpm8.3 -i 2>/dev/null | grep -E '^(open_basedir|disable_functions|expose_php|allow_url_fopen|auto_prepend_file) ' | cut -d' ' -f1-3
grep -E 'fastcgi_param (HTTP_HOST|SERVER_NAME|HTTP_X_FORWARDED_FOR|HTTP_CLIENT_IP) ' /etc/nginx/snippets/cloudimg-dokuwiki-php.conf

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32
IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32
allow_url_fopen => Off
auto_prepend_file => /usr/local/lib/cloudimg/dokuwiki/login-guard.php
disable_functions => exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec
expose_php => Off
open_basedir => /var/www/dokuwiki/:/var/lib/dokuwiki/:/usr/local/lib/cloudimg/dokuwiki/:/var/lib/php/sessions/:/tmp/:/etc/os-release:/usr/lib/os-release
fastcgi_param HTTP_HOST $dw_host;
fastcgi_param SERVER_NAME $dw_host;
fastcgi_param HTTP_X_FORWARDED_FOR $remote_addr;
fastcgi_param HTTP_CLIENT_IP $remote_addr;

If you lock yourself out with ten wrong passwords, wait five minutes or clear the lockout:

sudo dokuwiki-reset-lockout

Step 11: Your own DNS name and certificate

Point a DNS record at the instance, then set the name DokuWiki is served as. This mints a new self signed certificate for the name, updates nginx and DokuWiki's base address (every absolute link DokuWiki builds, in conf/local.protected.php) and the URLs in /root/dokuwiki-credentials.txt, and keeps the name across reboots:

sudo dokuwiki-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx (running dokuwiki-set-hostname again replaces it with a self signed one):

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/dokuwiki.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/dokuwiki.key
sudo nginx -t && sudo systemctl reload nginx

Once browsers trust the certificate you can also add an HSTS header (add_header Strict-Transport-Security "max-age=31536000" always;) to /etc/nginx/snippets/cloudimg-dokuwiki-headers.conf. The image does not send one: browsers ignore HSTS from a site whose certificate they do not trust, so it only takes effect with a trusted certificate.

Step 12: Passwords, plugins and upgrades

dokuwiki-set-password gives admin a new random password, keeps every other user, signs out every open session and records the password in /root/dokuwiki-credentials.txt. Run it without arguments, or pass your own password (24 to 64 letters and digits) on stdin. Other users change their own password with Update Profile, and administrators can set any user's password in the User Manager.

sudo dokuwiki-set-password
printf '%s\n' '<your-new-password>' | sudo dokuwiki-set-password --stdin

Plugins and templates. DokuWiki's Extension Manager installs plugins and templates, which are PHP code, from the internet. On this image the plugin and template folders belong to root, so code cannot be added from the browser: the manager lists the extensions, but installing, updating or removing one stops with DokuWiki's message "Plugin directory is not writable". To install or update extensions, switch it on, use Admin > Extension Manager, and switch it off again; extensions you install keep working:

sudo dokuwiki-extensions status

disabled

sudo dokuwiki-extensions enable
sudo dokuwiki-extensions disable

Only install extensions you trust: an extension runs with the same rights as DokuWiki. PHP cannot reach the instance metadata service whether the Extension Manager is on or off.

Upgrades. DokuWiki shows a notice on the administration page when a new release is out. To upgrade, snapshot the instance, download the new release from download.dokuwiki.org, check its checksum against the one published there, and unpack it over the code as root, without its data folder, its installer and its .htaccess files (the tarball carries no local.php, users.auth.php or acl.auth.php, so your settings and users stay as they are); then give the conf folder back to the web server's group and follow the release notes:

sudo tar -xzf dokuwiki-<release>.tgz -C /var/www/dokuwiki --strip-components=1 --no-same-owner \
  --exclude='*/data' --exclude='*/install.php' --exclude='*/.htaccess'
sudo chown root:www-data /var/www/dokuwiki/conf && sudo chmod 1775 /var/www/dokuwiki/conf

Your pages and media on /var/lib/dokuwiki are untouched.

Step 13: Server components

Component Path
DokuWiki code (root owned) /var/www/dokuwiki
Wiki data (pages, revisions, media, metadata, search index) /var/lib/dokuwiki (its own EBS volume)
Users, access control and settings /var/www/dokuwiki/conf (users.auth.php, acl.auth.php, local.php, local.protected.php)
nginx site /etc/nginx/sites-available/cloudimg-dokuwiki
PHP settings /etc/php/8.3/fpm/conf.d/99-cloudimg-dokuwiki.ini
Login guard /usr/local/lib/cloudimg/dokuwiki/login-guard.php
Certificate and key /etc/nginx/ssl/
First boot script /usr/local/sbin/dokuwiki-firstboot.sh
Helpers /usr/local/sbin/dokuwiki-set-hostname, dokuwiki-set-password, dokuwiki-reset-lockout, dokuwiki-extensions
Licence and release notes /usr/share/doc/dokuwiki/
Credentials /root/dokuwiki-credentials.txt (mode 0600)

Step 14: Security recommendations

  • Allow port 22 in the security group from your own networks only, and 443 from the networks that should read the wiki.
  • Keep the administrator password secret, and rotate it if it may have been shared (Step 12). Give each person their own account.
  • Review the access control lists before you put anything confidential in the wiki (Step 8).
  • Use your own DNS name and a certificate your browsers trust (Step 11).
  • Keep the Extension Manager switched off except while you install or update extensions.
  • Keep the operating system patched; unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else. PHP-FPM comes from Ubuntu's universe repository; sudo pro security-status --esm-apps shows whether Ubuntu Pro (ESM Apps) has security updates for it (none were pending when the image was built).
  • Snapshot the data volume regularly (Step 9).

Support and licensing

DokuWiki is open source under the GNU General Public License version 2 (a copy is at /usr/share/doc/dokuwiki/COPYING); there is no per user or per CPU licence fee. This image installs the unmodified upstream release, with the web installer and the Apache .htaccess files removed. The AMI price covers cloudimg's hardening, first boot setup and support.

  • Email: support@cloudimg.co.uk
  • Website: https://www.cloudimg.co.uk
  • Support: 24/7, with a 24 hour response SLA