TiddlyWiki on AWS User Guide

Overview

This image runs TiddlyWiki 5.4.1, the open source self-contained personal wiki and non-linear notebook, on Ubuntu 24.04 LTS. Instead of rigid pages, everything you write is captured as a small, individually addressable note called a tiddler, and tiddlers link, tag and transclude each other freely so a knowledge base grows the way you think.

The image runs TiddlyWiki's own built-in Node.js server (the tiddlywiki npm package) on the Node.js 22 LTS runtime, run by an unprivileged tiddlywiki system account under a systemd service that starts it on boot and restarts it on failure. Each tiddler is stored as a file under a server wiki folder, so every change you make in the browser is written straight back to the instance.

The server listens on the loopback address 127.0.0.1:8080 by design and is never exposed directly. nginx is installed as a reverse proxy on port 80 that forwards requests to the server, with a raised upload limit for large tiddlers and attachments. Visitors reach the notebook on the standard HTTP port.

TiddlyWiki's own built-in HTTP Basic Authentication is the load-bearing gate: the server runs with readers=(authenticated) writers=(authenticated), so every read and every write must present the admin credential and an unauthenticated request is rejected with 401. On the first boot of every deployed instance a one-shot service generates a fresh per-instance admin password, writes it to a file the server reads at start and to /root/tiddlywiki-credentials.txt (mode 0600, readable only by root). Two instances launched from the same AMI never share a password, and no default password ships in the image.

The wiki content - each tiddler file, plus the per-instance password file - lives under /var/lib/tiddlywiki on a dedicated, independently resizable EBS data volume kept separate from the operating system disk.

The default security group for this listing opens port 22 (SSH) and port 80 (HTTP) only.

What is included:

• TiddlyWiki 5.4.1 running on its built-in Node.js server as the tiddlywiki system user
• Node.js 22 LTS preinstalled from the NodeSource apt repository
• The TiddlyWiki notebook UI on port 80, fronted by nginx
• TiddlyWiki's built-in HTTP Basic Authentication requiring a per-instance credential for every read and write
• A unique admin password generated on first boot and recorded in a root-only file
• A dedicated EBS data volume for the wiki store, mounted by filesystem UUID
• tiddlywiki.service + nginx.service as enabled, active systemd units
• An unauthenticated /healthz endpoint for load balancer health checks
• 24/7 cloudimg support

Prerequisites

• An AWS account subscribed to this product in AWS Marketplace.
• An EC2 key pair in your target region for SSH access.
• A security group allowing inbound TCP 22 (SSH) from your IP and TCP 80 (HTTP) from your users.
• Recommended instance type: m5.large or larger.

Connecting to your instance

SSH in as the default login user for your operating system variant, using the key pair you launched with.

Step 1 - Launch from the AWS Marketplace console

In the AWS Marketplace, open this product and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch. Pick your region, the m5.large instance type (or larger), your VPC and subnet, your key pair, and a security group that allows inbound TCP 22 from your IP and TCP 80 from your users. Launch the instance.

Step 2 - Launch from the AWS CLI (alternative)

You can also launch from the CLI. Replace the AMI id with the one shown on the product's launch page for your region, and supply your own key pair, subnet and security group:

aws ec2 run-instances \
  --image-id ami-0example1234567890 \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-0example \
  --subnet-id subnet-0example \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=tiddlywiki}]'

Step 3 - Retrieve the per-instance admin password

SSH to the instance and read the credentials file written on first boot. It is mode 0600 and owned by root, so read it with sudo:

sudo cat /root/tiddlywiki-credentials.txt

You will see the URL and the unique admin password generated for this instance:

# TiddlyWiki - generated on first boot by tiddlywiki-firstboot.service
# These credentials are unique to this instance. Store them somewhere safe.

TIDDLYWIKI_URL=http://203.0.113.10/
TIDDLYWIKI_USERNAME=admin
TIDDLYWIKI_PASSWORD=REDACTED-unique-per-instance

Step 4 - Confirm the services are healthy

Confirm both services are active, and check the installed versions:

systemctl is-active tiddlywiki.service nginx.service
tiddlywiki --version
node --version

active
active
5.4.1
v22.23.1

Confirm the listeners - the TiddlyWiki server is loopback-only on 8080 and nginx is on 80:

sudo ss -tlnp | grep -E ':80 |:8080 '

LISTEN 0 511 127.0.0.1:8080 0.0.0.0:* users:(("node",...))
LISTEN 0 511   0.0.0.0:80   0.0.0.0:* users:(("nginx",...))

The static /healthz endpoint is served by nginx itself and is the one path that does not require authentication - use it for load balancer health checks:

curl -s -o /dev/null -w 'healthz:%{http_code}\n' http://127.0.0.1/healthz

healthz:200

Prove the authentication gate end to end without printing the password: an unauthenticated request is rejected, and the per-instance password from the credentials file is accepted. The password is read into a shell variable and never echoed:

curl -s -o /dev/null -w 'unauth:%{http_code}\n' http://127.0.0.1/
PW=$(sudo grep '^TIDDLYWIKI_PASSWORD=' /root/tiddlywiki-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'authed:%{http_code}\n' -u "admin:$PW" http://127.0.0.1/

unauth:401
authed:200

Step 5 - Sign in and open your notebook

Browse to http://<instance-public-ip>/. Your browser prompts for a login: enter the username admin and the password from Step 3. TiddlyWiki opens with the story river on the left - the column of open tiddlers - and the sidebar on the right, which holds the title, the search box, and the Open, Recent, Tools and More tabs. Click any link to open that tiddler in the river; click a tiddler's close icon to remove it from the river without deleting it.

Step 6 - Create and link tiddlers

Click the plus icon in the sidebar to create a new tiddler, or click the edit pencil on any tiddler to change it. In edit mode you get a formatting toolbar, a tags field, and the raw wiki-text body. Link to another tiddler by wrapping its title in double square brackets, tag a tiddler to group it with related notes, and transclude one tiddler inside another so a single fact lives in one place. Click the tick to save - every change is written back to the server wiki folder on the instance.

Step 7 - Find anything with search

Type into the search box at the top of the sidebar. TiddlyWiki matches on titles and full text as you type and shows a live results list, so a growing knowledge base stays instantly navigable however many tiddlers it holds.

Step 8 - Administer with the control panel

Click the gear icon in the sidebar to open the control panel. Its tabs let you set the wiki title and subtitle, choose which tiddlers open at startup, manage appearance and themes, review plugins, and set keyboard shortcuts. The Info tab confirms the running TiddlyWiki version.

Step 9 - Change the admin password

The admin password is read by the server from /var/lib/tiddlywiki/.tw-password at start. To set your own password, write the new value to that file (owned by the tiddlywiki user) and restart the service:

sudo sh -c 'printf "%s" "<new-password>" > /var/lib/tiddlywiki/.tw-password'
sudo chown tiddlywiki:tiddlywiki /var/lib/tiddlywiki/.tw-password
sudo chmod 600 /var/lib/tiddlywiki/.tw-password
sudo systemctl restart tiddlywiki.service

Update the record in /root/tiddlywiki-credentials.txt afterwards so it matches, or keep your new password in your own password manager.

Step 10 - Where your data lives, and backup

The wiki store is on a dedicated EBS data volume mounted at /var/lib/tiddlywiki (by filesystem UUID, so it survives reboots and re-launch). Each tiddler is a file under /var/lib/tiddlywiki/mywiki/tiddlers. Because it is a separate volume you can grow it independently of the OS disk, and you can snapshot it with Amazon EBS. To take a file-level backup of the wiki folder:

sudo tar czf <backup-dir>/tiddlywiki-$(date +%F).tgz -C /var/lib/tiddlywiki mywiki

Copy the archive off the instance, or take an EBS snapshot of the data volume, on whatever schedule suits you.

Step 11 - Enable HTTPS (recommended)

TiddlyWiki serves plain HTTP on port 80. For production, put it behind TLS. The simplest options are to terminate TLS at an AWS Application Load Balancer or CloudFront in front of the instance, or to run Let's Encrypt directly on the instance with your own domain:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Point your domain's DNS at the instance (or the load balancer) first, and open port 443 in the security group.

Step 12 - Service management

Both units are enabled and start on boot:

systemctl is-enabled tiddlywiki.service nginx.service

enabled
enabled

Manage them with the usual systemctl verbs when you need to:

sudo systemctl restart tiddlywiki.service
sudo systemctl restart nginx.service
sudo journalctl -u tiddlywiki.service -n 50 --no-pager

Support

cloudimg provides 24/7 technical support for this image by email and live chat. Our engineers help with deployment, the built-in authentication model and password rotation, backing up and restoring the server wiki folder, TLS termination and scaling.

• Email: support@cloudimg.co.uk
• Live chat: available 24/7

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.