A self-hosted BookStack wiki for your team's documentation

What your wiki needs underneath it

BookStack organises your writing into shelves, books, chapters and pages. Underneath, it is a PHP web app that stores pages in a database and keeps uploaded images and attachments as files. Its installation guide asks for:

• PHP 8.2 or newer, usable from the command line, with a dozen common extensions (gd, mbstring, pdo_mysql, xml, zip and others the guide lists)
• MySQL 8.0 or newer, or MariaDB 10.6 or newer, with one database the app fully controls
• Git, which the standard update process uses, and Composer 2.2.0 or newer for PHP packages
• A web server that only serves BookStack's public folder

You will not find a memory or processor figure in the official docs, so nobody can honestly promise you one. Our own view, not the project's: a wiki for a team is a modest load, and the things that hurt are running out of disk for uploads and backups, or losing access to the box at a bad moment. BookStack also does not support shared PHP hosting, which is why a server of your own is the usual home for it.

Three ways in, and the one we would pick

• The Ubuntu install script. Official, for a fresh Ubuntu 22.04, 24.04 or 26.04 only. It installs Apache, MySQL and PHP, downloads BookStack and configures the site. Run it on a machine that already serves websites and it may clobber that setup; email and system security stay your job.
• A manual install. You clone the release branch, run Composer, write the .env file and run the database migration yourself. Good when the server already hosts other things.
• Docker. The project links two images run by others, from linuxserver.io and solidnerd, plus a sample compose file. Handy if you already live in containers, but the BookStack team does not maintain those images.

On a fresh dedicated server the script is the shortest road, and the fresh-OS rule costs you nothing: you can wipe and reinstall the system from your control panel whenever you want a clean start. The steps below use the 24.04 script, which most guides still follow. The 26.04 one works the same way, except that you type in an email address and it generates the admin password for you instead of using the default.

Up and running on Ubuntu 24.04

1. Turn on the firewall before installing anything, allowing only SSH. Check that ufw is filtering IPv6 too: the file /etc/default/ufw should say IPV6=yes.
2. Download the script to the server instead of running it straight from the web. Open it and read it: it is ordinary bash, and you will see exactly which packages it installs and where BookStack goes (/var/www/bookstack).
3. Run it with sudo while logged in as your normal user. A brand-new server may only have root: in that case make yourself an account with adduser yourname, give it sudo rights with usermod -aG sudo yourname, and sign in again as that account first. The script hands the files to whoever called sudo, which lets you run updates later without root.
4. When it asks for a domain, type the name your wiki will use, like wiki.example.com, even though DNS does not point there yet.

sudo ufw allow OpenSSH
sudo ufw enable
grep IPV6 /etc/default/ufw

wget https://codeberg.org/bookstack/devops/raw/branch/main/scripts/installation-ubuntu-24.04.sh
less installation-ubuntu-24.04.sh
sudo bash installation-ubuntu-24.04.sh

Piping a downloaded script into bash runs code you have never looked at, as root. Keep the two steps separate: save the file, read it, then run that same file.

Change the default login while the wiki is still private

After the 24.04 script, anyone who reaches the login page can sign in as admin@admin.com with the password password. Right now the firewall keeps port 80 closed, so the only way in is an SSH tunnel from your own computer. BookStack sends you to whatever address APP_URL in its .env file names, so point that at the tunnel for now.

# on the server: use the tunnel address for this first visit
sudo sed -i 's|^APP_URL=.*|APP_URL=http://localhost:8080|' /var/www/bookstack/.env

# on your own computer: open the tunnel, then visit http://localhost:8080
ssh -L 8080:127.0.0.1:80 you@your-server-ip

1. Sign in with the default details, then open your profile and replace both the email address and the password.
2. Add multi-factor authentication to your account: an authenticator app or a set of backup codes.
3. Go through the settings: decide whether strangers may register, and whether Allow public viewing? should be on. For an internal wiki, both stay off.
4. Close the browser tab and the tunnel. Avoid uploading images during this visit, since their links would carry the temporary address.

Opening it to your team

With the admin account secured, point your domain's DNS at the server and let web traffic through by allowing ufw's Apache Full profile: sudo ufw allow 'Apache Full'. Port 80 has to be open before you ask for a certificate, because Let's Encrypt, the usual free choice, checks your domain over it. Once Apache has its TLS certificate, set APP_URL to the final address, such as https://wiki.example.com. BookStack's security guide asks for this so its links cannot be tampered with, and an https address makes it send login cookies over encrypted connections only.

Two quieter settings are worth a minute. Uploaded images can be fetched by anyone who knows their URL, so switch on higher security image uploads, which puts a random string in every image's file name. And if you want to see failed sign-ins, set LOG_FAILED_LOGIN_MESSAGE in .env; the security page suggests it for tools such as Fail2Ban.

Email that reaches people

Without email, password resets and user invitations fail. Open .env in an editor and fill in your mail provider's SMTP details: host, port 587, tls encryption, the username and password, and the from address and name. Typing the password into the file rather than on a command line keeps it out of your shell history. The file holds your database password and app key too, so tighten it to the mode the project suggests by running sudo chmod 640 .env inside the BookStack folder (the script sets 740). Then try it: Settings > Maintenance has a Send a Test Email action that displays any error it hits.

Backups and updates you will actually do

BookStack has no backup button. A complete copy is the database dump plus four things from /var/www/bookstack: the .env file, public/uploads for images, storage/uploads for attachments, and themes. Keep the .env safe: its APP_KEY decrypts your users' two-factor settings, and a new key breaks them. The backup lines below follow the project's backup page. Save them as a small script, run it nightly with bash from root's crontab, prune old copies, and copy the results to a second machine.

# as root, nightly; root signs in to MySQL through the local socket
cd /var/www/bookstack
umask 077
mysqldump -u root bookstack > /root/bookstack-db-$(date +%F).sql
tar -czf /root/bookstack-files-$(date +%F).tar.gz .env public/uploads storage/uploads themes

# updating, as your own user, after a fresh backup
cd /var/www/bookstack
git pull origin release
composer install --no-dev
php artisan migrate
php artisan cache:clear && php artisan config:clear && php artisan view:clear

Check the version-specific notes on the updates page before each upgrade. Many recent releases close security holes, and v26.09 started requiring an APP_KEY.

The server that fits

Most teams land in our everyday servers: one processor with plenty of headroom, which is what most sites, apps and databases need. Browse them on the dedicated servers page. A ready server is handed over within 30 minutes of the payment being approved, with root access, an unmetered port, one IPv4 address and IPv6 at no charge. If a firewall slip cuts off SSH, rack servers and blades still give you their own console with the screen and power button, and you can fix it yourself. Terms are month to month.

Be honest about the chores. If nobody will apply updates or test a restore, a self-hosted wiki is a liability. If someone will, the same server can host your team's code with Gitea or its chat with Mattermost.

Questions people ask

What username and password does a fresh BookStack use?

A manual install and the Ubuntu 22.04 and 24.04 scripts create admin@admin.com with the password password. The 26.04 script is different: you choose the email, and it makes up a random password and shows it once. Change the default before the site is reachable by anyone else.

Should I use Docker for BookStack?

You can, with a community image such as linuxserver.io's. If you do, publish the port as 127.0.0.1:6875:80 rather than 6875:80, because Docker's port rules skip ufw, so blocking the port in ufw would not keep the wiki private. Also replace the sample APP_KEY and passwords in the example compose file.

How big a server does BookStack need?

The project lists software requirements only, without CPU or RAM numbers. A small team wiki is light work, so choose by disk space for uploads and backups and by how easily you can recover the machine.

Can I make some of the wiki public?

Yes. The Allow public viewing? setting opens the site to visitors who are not signed in, and what they can then see depends on the permissions you have set. It also changes the robots.txt rules, so search engines follow your choice.

What if I lock myself out of the admin account?

From the BookStack folder, php artisan bookstack:create-admin makes a fresh admin. Given no flags, the command prompts you for each detail, so the new password never appears on the command line.