Wiki-Go on Ubuntu 24.04 on Azure User Guide

Overview

Wiki-Go is an open source wiki platform written in Go that stores every page as a plain Markdown file on disk instead of rows in a database. That single design decision removes most of the operational work a wiki normally brings with it: there is no database engine to install, tune, back up or migrate, and your content is a folder tree you can read, copy, grep or put under version control at any time.

It is still a full featured wiki. Pages are hierarchical with breadcrumb navigation, every edit is versioned and restorable, and the editor supports tables, syntax highlighted code, Mermaid diagrams, LaTeX maths, emoji shortcodes, task lists and file attachments. Full text search covers the whole wiki with phrase matching and term exclusion, and there are comments with moderation, kanban boards, a light and dark theme, and administrator, editor and viewer roles with path based access rules.

The cloudimg image installs Wiki-Go 1.8.12 as a single self contained binary, runs it as one systemd service on port 80 as an unprivileged user, and generates a unique administrator password on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Wiki-Go 1.8.12 (GPL-3.0), installed from the official prebuilt binary with its checksum verified at build time
• The wiki published directly on port 80 by one service, with no database and no reverse proxy in the path
• A unique administrator password generated on first boot and written to a root only credentials file
• A bootstrap guard that stops the wiki starting at all until that password exists, so an instance can never come up on the upstream default login
• Session cookies preconfigured so sign in works over plain HTTP out of the box, with the switch to your own TLS certificate documented below
• Content stored as plain Markdown under /var/lib/wiki-go/data/documents
• wiki-go.service as a systemd unit, enabled and active, running as the unprivileged wikigo user
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point, and the wiki is light enough that content volume rather than CPU decides when you need more. NSG inbound: allow 22/tcp from your management network and 80/tcp for the wiki. Front it with TLS before exposing it publicly, as described in Enabling HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Wiki-Go by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name wiki-go \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open the wiki port on the VM's network security group:

az vm open-port --resource-group <your-rg> --name wiki-go --port 80 --priority 1001

Step 3 - Retrieve the per-VM administrator password

The image ships with no wiki configuration at all. On the first boot of every VM a bootstrap service generates a unique administrator password, hashes it with bcrypt at the project's own cost factor, writes the wiki configuration around it, and only then starts the wiki. The password is written to a root only file.

SSH in and read it:

ssh azureuser@<vm-public-ip>
sudo cat /root/wiki-go-credentials.txt

The file contains the wiki URL, the administrator username (admin) and the generated password:

wikigo.url=http://<vm-ip>/
wikigo.admin.user=admin
wikigo.admin.pass=<WIKIGO_ADMIN_PASSWORD>

Keep this password safe. It is the only administrator credential on the VM.

The address recorded in this file is resolved from the Azure instance metadata service, which returns an empty value for Standard SKU public IPs, so the file usually shows the VM's private address. Browse to the VM's public IP address from the Azure Portal instead. The value only affects this note and the footer text; it does not restrict what the wiki serves.

Step 4 - Confirm the wiki is healthy

Run these on the VM. One service runs the whole product, so there is a single unit to check:

systemctl is-active wiki-go.service
curl -s -o /dev/null -w 'homepage HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'sign-in page HTTP %{http_code}\n' http://127.0.0.1/login

Expected output:

active
homepage HTTP 200
sign-in page HTTP 200

Confirm both units are enabled for future reboots, and that the wiki owns port 80:

systemctl is-enabled wiki-go.service wiki-go-firstboot.service
ss -tln | grep ':80 '

Expected output:

enabled
enabled
LISTEN 0      4096               *:80              *:*

Step 5 - Sign in to the web interface

Open http://<vm-public-ip>/login in a browser and sign in with admin and the password from Step 3.

Once you are signed in you get the full wiki: the page tree and the search box in the sidebar, the page itself in the main pane, and the authoring toolbar across the top. Tables, syntax highlighted code blocks, Mermaid diagrams and LaTeX maths are all rendered from the Markdown source.

The sign-in page carries the project's standard notice that the wiki is private and requires authentication. On a freshly deployed image the wiki is in fact public to read and only editing requires a login. See Making the wiki private below to change that.

Step 6 - Write and edit pages

Select New in the toolbar to create a page, or Edit to change the one you are looking at. The editor shows the raw Markdown with a formatting toolbar, a live word and line count, and a preview toggle, and Save writes it straight back to disk as a .md file.

History on the same toolbar lists previous revisions of the page and restores any of them, so an accidental edit is never destructive. Attachments uploads images and documents against the page, and Move/Rename reorganises the tree.

To control the order of pages in the sidebar, prefix the page slug with a number, for example 1-overview and 2-installation. The title shown in the sidebar comes from the first # heading in the page, so the slug and the displayed title can differ.

Step 7 - Search the wiki

Type in the search box at the top of the sidebar. Search covers the full text of every page, highlights the matched terms in context, and supports quoted phrases for exact matching and -term to exclude a word.

Where your content lives

Every page is a plain Markdown file under /var/lib/wiki-go/data/documents, one directory per page containing a document.md. There is no database anywhere on the VM:

find /var/lib/wiki-go/data/documents -name '*.md' | sort
du -sh /var/lib/wiki-go/data

Example output (your pages will differ):

/var/lib/wiki-go/data/documents/onboarding-checklist/document.md
/var/lib/wiki-go/data/documents/platform-runbook/document.md
/var/lib/wiki-go/data/documents/release-notes/document.md

624K    /var/lib/wiki-go/data

Because the content is just files, a backup is a file copy and needs no dump step:

sudo tar czf ~/wiki-go-backup-$(date +%F).tar.gz -C /var/lib/wiki-go data

Restore by extracting the archive back over /var/lib/wiki-go/data and running sudo systemctl restart wiki-go. The same property makes it easy to keep the wiki in git, or to author pages on your laptop and copy them up.

Security and the first boot

Upstream Wiki-Go writes its configuration on first run and seeds a published default administrator, admin with the password admin, into it. This image never allows that to happen. It ships with no configuration file, and wiki-go.service carries a condition that keeps it from starting until the first boot service has written a configuration containing the generated per VM password.

You can confirm on any VM that the upstream default is not in use. Wiki-Go exposes this as an API, so there is no guesswork:

curl -s http://127.0.0.1/api/check-default-password; echo
curl -s -o /dev/null -w 'upstream default admin/admin -> HTTP %{http_code}\n' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"admin"}' http://127.0.0.1/api/login

Expected output:

{"defaultPasswordInUse":false}
upstream default admin/admin -> HTTP 401

Other security notes:

• Repeated failed sign in attempts are rate limited and temporarily ban the source address, five failures in three minutes by default. Tune this under Settings, Security.
• The wiki runs as the unprivileged wikigo user. It binds port 80 through a targeted Linux capability rather than by running as root, and the unit restricts it with NoNewPrivileges, ProtectSystem and ProtectHome.
• Change the administrator password from the UI at any time under Settings, or add named accounts under Settings, Users and give each person their own login with an administrator, editor or viewer role.

Making the wiki private

A freshly deployed wiki is readable by anyone who can reach port 80, and only editing requires a login. To require a login to read anything as well, sign in and set the wiki to private under Settings, General, or edit the configuration directly on the VM.

The configuration file is /var/lib/wiki-go/data/config.yaml. Set private: true under the wiki: section and restart the service. For finer control, Settings, Access lets you mark individual paths public, private or restricted to a named group, so you can keep most of the wiki open and lock down a section.

Enabling HTTPS

Wiki-Go serves plain HTTP on port 80 out of the box, and the image sets allow_insecure_cookies: true so that sign in works in a browser over plain HTTP. Without that setting Wiki-Go marks its session cookie Secure, browsers silently discard it on an HTTP connection, and sign in fails even though every page still returns HTTP 200.

For anything public facing, put TLS in front and turn that setting back off. Wiki-Go has native TLS support: point a DNS A record at the VM's public IP, obtain a certificate for that name, then in /var/lib/wiki-go/data/config.yaml set ssl: true, set ssl_cert and ssl_key to your certificate and key paths, set port: 443, set allow_insecure_cookies: false, and restart the service. Remember to open 443/tcp on the network security group.

Alternatively terminate TLS at a reverse proxy such as nginx or Caddy in front of the wiki and leave Wiki-Go on plain HTTP behind it, in which case keep allow_insecure_cookies: true for the proxy to app hop and make sure the proxy forwards the X-Forwarded-Proto header.

Maintenance

• OS updates: the image keeps Ubuntu's unattended-upgrades enabled, so security patches continue to land. Apply pending updates manually at any time with sudo apt-get update && sudo apt-get upgrade -y.
• Service logs: sudo journalctl -u wiki-go.service -f follows the wiki log. sudo journalctl -u wiki-go-firstboot.service shows what the first boot did.
• Restart: sudo systemctl restart wiki-go.service.
• Configuration: /var/lib/wiki-go/data/config.yaml. Most settings are also editable in the UI under Settings, which writes to the same file. Restart the service after editing it by hand.
• Upgrading Wiki-Go: the whole application is the single binary at /opt/wiki-go/wiki-go. Download a newer release from the project's GitHub releases page, verify its checksum, replace that file and restart the service. Your content is untouched because it lives in /var/lib/wiki-go/data.
• Page history: every edit is versioned, keeping the last ten revisions of each page by default. Raise max_versions in the configuration if you want a deeper history.

Support

This image is maintained by cloudimg with 24/7 support. Contact support@cloudimg.co.uk for assistance.