Wiki.js 2.x is the centralized documentation platform for the HomeLab — the single source of truth for infrastructure, services, SOPs, troubleshooting, and reference material. Deployed 2026-07-11.
All homelab documentation lives here. If this is down, documentation is unavailable but nothing else breaks (no other service depends on it).
| Field | Value |
|---|---|
| Hostname | WikiJS |
| VMID / Type | LXC 120, unprivileged, nesting + keyctl |
| Proxmox Node | M910q (192.168.86.101) |
| IP Address | 192.168.86.216/24 (static, gw 192.168.86.1) |
| Tailscale | wikijs on tailnet tailbacb1d.ts.net — 100.119.24.74 |
| OS | Debian 13 (trixie), template debian-13-standard_13.1-2 |
| CPU / RAM | 2 vCPU / 2048 MB RAM / 1024 MB swap |
| Storage | 10 GB rootfs on ceph-storage (RBD) + bind mount below |
| DNS | 192.168.86.1, 8.8.8.8 (pinned — do not inherit host MagicDNS) |
| Autostart | onboot=1 |
Why unprivileged: Wiki.js runs entirely in Docker and needs no host device access beyond /dev/net/tun (Tailscale), which works fine unprivileged. Container root maps to host UID 100000, so a container escape lands as an unprivileged host user. Privileged would add risk for zero benefit.
All persistent data lives on cephfs, bind-mounted into the LXC — the container's rootfs holds nothing worth backing up.
Host path /mnt/pve/cephfs/wikijs → container path /opt/wikijs (mp0, shared=1 so the LXC can migrate between nodes):
| Directory | Purpose |
|---|---|
docker-compose.yml |
Stack definition |
.env |
Secrets (Postgres password), mode 600 |
data/ |
Wiki.js content dir (mounted at /wiki/data/content) |
db/ |
PostgreSQL 16 data directory (PGDATA) |
backups/ |
Manual DB dumps and exports land here |
logs/ |
Reserved for exported logs (runtime logs are in Docker, json-file, 10 MB × 3 rotation) |
Ownership note: files are owned by host UIDs 100000+ (unprivileged UID mapping). When editing from the Proxmox host, chown -R 100000:100000 /mnt/pve/cephfs/wikijs afterwards if you create new files.
compose pull), matches the existing homelab standard (monitoring LXC 119 and others use the same pattern).Postgres is not exposed outside the Docker network — Wiki.js reaches it as db:5432 internally.
Docker CE 29.x + compose plugin. No external service dependencies.
| Port | Protocol | Purpose | Exposed to |
|---|---|---|---|
| 3000 | HTTP | Wiki.js web UI | LAN + tailnet |
| 22 | SSH | Admin access | LAN + tailnet |
| 41641/udp | WireGuard | Tailscale | Internet (outbound-initiated) |
| 5432 | — | PostgreSQL | Docker-internal only, NOT exposed |
No Proxmox firewall rules and no Fail2Ban: the service has no WAN exposure (LAN + tailnet only), so the attack surface doesn't justify them. Revisit if it's ever published through the reverse proxy.
/opt/wikijs/docker-compose.yml (inside LXC) = /mnt/pve/cephfs/wikijs/docker-compose.yml (host)..env alongside it (Postgres password, mode 600)./a./etc/pve/lxc/120.conf on any cluster node — includes the two lxc.* lines for the Tailscale TUN passthrough.codyhanna8@gmail.com (display name codyh). Password set at deployment — change from the profile menu if desired.PermitRootLogin yes via /etc/ssh/sshd_config.d/50-root-login.conf). Consider switching to key-based SSH later.Nothing is automated yet (deliberate). To capture everything, back up:
pct exec 120 -- docker exec wikijs-db pg_dump -U wikijs -Fc wiki \
> /mnt/pve/cephfs/wikijs/backups/wiki-$(date +%F).dump
docker-compose.yml and .envdata/ (asset/content sideload dir)/etc/pve/lxc/120.confSince all of 1–3 live under /mnt/pve/cephfs/wikijs/, a nightly vzdump of LXC 120 plus a cron'd pg_dump into backups/ covers everything. The db/ directory is the live PGDATA — do not rely on file-copying it while Postgres runs; use pg_dump.
# from the Proxmox host (or SSH into 192.168.86.216)
pct exec 120 -- bash -c 'cd /opt/wikijs && docker compose pull && docker compose up -d'
pct exec 120 -- docker image prune -f
Take a pg_dump (see Backup) before major-version jumps. OS packages: security updates are automatic (unattended-upgrades); run apt update && apt full-upgrade inside the LXC occasionally for the rest.
Full rebuild from nothing:
/mnt/pve/cephfs/wikijs → /opt/wikijs with shared=1, TUN passthrough lines, install Docker./mnt/pve/cephfs/wikijs contains docker-compose.yml, .env, and either an intact db/ or a dump in backups/.cd /opt/wikijs && docker compose up -d.db/ was lost, restore from dump:docker compose up -d db
docker exec -i wikijs-db pg_restore -U wikijs -d wiki --clean --if-exists < backups/wiki-YYYY-MM-DD.dump
docker compose up -d
curl -I http://192.168.86.216:3000 → 200, log in, spot-check pages.Uptime Kuma monitor "Wiki.js" (HTTP, 60s) on LXC 119 — added 2026-07-11.
pct exec is the equivalent management path.pct exec 120 -- docker compose -f /opt/wikijs/docker-compose.yml ps # stack status
pct exec 120 -- docker logs wikijs --tail 50 # app logs
pct exec 120 -- docker exec wikijs-db psql -U wikijs -d wiki -c '\dt+' # DB sanity
pct enter 120 # shell into LXC
wiki.codycodez.com; update Site URL afterwards.pg_dump into backups/ + vzdump job for LXC 120.| Date | Change |
|---|---|
| 2026-07-11 | Initial deployment (LXC 120, Wiki.js 2.x + PostgreSQL 16 via Docker Compose) |
| 2026-07-11 | Tailscale signed in (100.119.24.74); root password set; SSH root password login enabled |