GROWI on Ubuntu 24.04 on Azure User Guide

Overview

This image runs GROWI 7.5.6, the open source team wiki and knowledge base, on Ubuntu 24.04 LTS. GROWI stores everything as Markdown pages in a navigable page tree, supports real-time collaborative editing, diagrams and math, comments, tags and a full revision history. It is built from source and run from /opt/growi on the Node.js 24 runtime by an unprivileged growi system account under a systemd service that starts it on boot and restarts it on failure. A local MongoDB 8.0 Community database holds all pages and attachments.

GROWI listens on the loopback address 127.0.0.1:3000 by design and is never exposed directly. nginx is installed as a reverse proxy on port 80 that forwards every request to GROWI, so visitors reach the wiki on the standard HTTP port. Full-text search via Elasticsearch/OpenSearch is optional and is not bundled - the image ships as a self-contained single node, and you can attach a search cluster later.

What is included:

• GROWI 7.5.6 built from source, run by systemd as the unprivileged growi user
• The GROWI web UI on :80 (nginx reverse proxy to 127.0.0.1:3000)
• A per-VM admin account whose password is generated on first boot and recorded in a root-only file
• MongoDB 8.0 Community, bound to loopback with a per-VM credential, its data directory on a dedicated Azure data disk at /var/lib/growi
• Secure-by-default authentication: self registration is set to Closed, so the wiki is not world-writable
• mongod.service, growi.service and nginx.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger teams and heavier editing. NSG inbound: allow 22/tcp from your management network and 80/tcp for the wiki. GROWI serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain and set APP_SITE_URL accordingly.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for GROWI by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name growi \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name growi --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

GROWI is served by nginx on port 80, which reverse-proxies to the Node.js app on 127.0.0.1:3000, which in turn talks to MongoDB on 127.0.0.1:27017. Confirm the services are active and the ports are listening:

systemctl is-active mongod growi nginx growi-firstboot
sudo ss -tlnp | grep -E ':80 |:3000 |:27017 '

Expected output:

active
active
active
active
LISTEN 0  511      0.0.0.0:80     0.0.0.0:*  users:(("nginx",pid=...))
LISTEN 0  4096  127.0.0.1:27017   0.0.0.0:*  users:(("mongod",pid=...))
LISTEN 0  511            *:3000         *:*  users:(("MainThread",pid=...))

Step 5 - Retrieve your admin password

On the first boot of every VM, growi-firstboot.service generates a unique administrator password, a unique MongoDB credential and a unique application secret (PASSWORD_SEED), and writes them - together with the admin username and the wiki URL - into a root-only file. Confirm the file exists and is root-only:

sudo ls -l /root/growi-credentials.txt

Expected output:

-rw------- 1 root root ... /root/growi-credentials.txt

Read the file to get your admin password with sudo cat /root/growi-credentials.txt. It contains GROWI_ADMIN_USER, GROWI_ADMIN_PASSWORD, MONGO_PASSWORD and PASSWORD_SEED - all unique to this VM.

Step 6 - Confirm the stack and health endpoint

nginx serves an unauthenticated /healthz endpoint for load balancer probes. Confirm the Node.js and MongoDB versions and that the wiki responds:

node -v
mongod --version | head -1
curl -sI http://127.0.0.1/healthz | head -1
curl -s http://127.0.0.1/login | grep -o '<title>[^<]*</title>'

Expected output:

v24.18.0
db version v8.0.26
HTTP/1.1 200 OK
<title>GROWI</title>

Step 7 - Sign in to the wiki

Browse to http://<vm-public-ip>/. You will be redirected to the sign-in page. Enter admin and the password from Step 5.

Step 8 - Explore the top page and page tree

After signing in you land on the Welcome to GROWI top page. The left sidebar shows the Page Tree - a hierarchical view of every page, including the seeded /Sandbox examples - and the right sidebar lists the page contents. From here you can create new pages, search, tag and organise your knowledge base.

Step 9 - Browse and edit Markdown pages

Open a page from the tree - for example /Sandbox/Markdown - to see GROWI's rendered Markdown: alerts, code blocks, tables, task lists, footnotes and more. Click Edit (top right) to open the collaborative editor, where you write Markdown on the left with a live preview on the right; multiple people can edit the same page at once.

Step 10 - Manage users and keep the wiki private

Open Admin then User Management. The image ships with a single active admin user and self registration set to Closed, so nobody can sign up on their own - the wiki is not world-writable by default. Invite teammates from here, or change the registration mode under Security Settings if you want approval-based or open sign-up.

Step 11 - Confirm wiki data lives on the dedicated disk

All MongoDB data - every page, revision, comment and attachment (stored in GridFS) - lives under /var/lib/growi, which is a dedicated Azure data disk captured into the image and re-provisioned on every VM:

df -h /var/lib/growi | tail -1
findmnt -no SOURCE,TARGET,FSTYPE /var/lib/growi
sudo ls /var/lib/growi/mongodb

Expected output (the data-disk device name may vary between VMs):

/dev/sdX  30G  ...  /var/lib/growi
/dev/sdX /var/lib/growi ext4
WiredTiger
WiredTiger.lock
WiredTiger.turtle
WiredTiger.wt
_mdb_catalog.wt
...

Maintenance

• Back up your wiki: everything GROWI stores lives in MongoDB's data files under /var/lib/growi. Snapshot the data disk, or use mongodump/mongorestore for logical backups.
• Add teammates: sign in as admin, open Admin then User Management, and invite users. Registration is Closed by default; change it under Security Settings if you prefer approval-based or open sign-up.
• Rotate credentials: the admin, MongoDB and app secrets live in /opt/growi/apps/app/.env.local and /root/growi-credentials.txt; update them and restart with sudo systemctl restart growi to change them.
• Add full-text search: attach an OpenSearch or Elasticsearch cluster and set ELASTICSEARCH_URI in /opt/growi/apps/app/.env.local, then restart GROWI to enable full-text search across all pages.
• Security updates: unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.
• TLS: for production, front GROWI with your own domain and a TLS-terminating reverse proxy or Azure Application Gateway, and set APP_SITE_URL to your https:// URL.

Support

cloudimg provides 24/7/365 expert technical support for this image. Contact support@cloudimg.co.uk. GROWI is licensed under the MIT License. This image is provided by cloudimg; additional charges apply for build, maintenance and 24/7 support.