nihilist - 16 / 07 / 2023

wikiless Setup

In this tutorial we're going to check out how to install Wikiless, a privacy front-end for wikipedia.

Initial Setup

First git clone the repository

[ nowhere.moe ] [ /dev/pts/2 ] [/srv]
→ git clone https://github.com/Metastem/wikiless
Cloning into 'wikiless'...
remote: Enumerating objects: 1080, done.
remote: Counting objects: 100% (314/314), done.
remote: Compressing objects: 100% (135/135), done.
remote: Total 1080 (delta 216), reused 250 (delta 175), pack-reused 766
Receiving objects: 100% (1080/1080), 488.53 KiB | 8.14 MiB/s, done.
Resolving deltas: 100% (598/598), done.

[ nowhere.moe ] [ /dev/pts/2 ] [/srv]
→ cd wikiless
	

run the docker files

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ git pull
remote: Enumerating objects: 9, done.
remote: Counting objects: 100% (9/9), done.
remote: Compressing objects: 100% (6/6), done.
remote: Total 6 (delta 4), reused 0 (delta 0), pack-reused 0
Unpacking objects: 100% (6/6), 1.32 KiB | 1.32 MiB/s, done.
From https://github.com/Metastem/wikiless
   cd561d0..23087c5  main       -> origin/main
Updating cd561d0..23087c5
Fast-forward
 README.md          | 12 ------------
 docker-compose.yml |  8 +++-----
 2 files changed, 3 insertions(+), 17 deletions(-)

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ vim docker-compose.yml ; vim wikiless.config 

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ cat wikiless.config
const config = {
  /**
  * Set these configs below to suite your environment.
  */
  domain: process.env.DOMAIN || 'wikiless.nowhere.moe', // Set to your own domain
  default_lang: process.env.DEFAULT_LANG || 'en', // Set your own language by default
  theme: process.env.THEME || 'dark', // Set to 'white' or 'dark' by default
  http_addr: process.env.HTTP_ADDR || '0.0.0.0', // don't touch, unless you know what your doing
  nonssl_port: process.env.NONSSL_PORT || 8080, // don't touch, unless you know what your doing

  /**
  * You can configure redis below if needed.
  * By default Wikiless uses 'redis://127.0.0.1:6379' as the Redis URL.
  * Versions before 0.1.1 Wikiless used redis_host and redis_port properties,
  * but they are not supported anymore.
  * process.env.REDIS_HOST is still here for backwards compatibility.
  */
  redis_url: process.env.REDIS_URL || process.env.REDIS_HOST || 'redis://127.0.0.1:6379',
  redis_password: process.env.REDIS_PASSWORD,

  /**
  * You might need to change these configs below if you host through a reverse
  * proxy like nginx.
  */
  trust_proxy: process.env.TRUST_PROXY === 'true' || true,
  trust_proxy_address: process.env.TRUST_PROXY_ADDRESS || '127.0.0.1',

  /**
  * Redis cache expiration values (in seconds).
  * When the cache expires, new content is fetched from Wikipedia (when the
  * given URL is revisited).
  */
  setexs: {
    wikipage: process.env.WIKIPAGE_CACHE_EXPIRATION || (60 * 60 * 1), // 1 hour
  },

  /**
  * Wikimedia requires a HTTP User-agent header for all Wikimedia related
  * requests. It's a good idea to change this to something unique.
  * Read more: https://meta.wikimedia.org/wiki/User-Agent_policy
  */
  wikimedia_useragent: process.env.wikimedia_useragent || 'Wikiless media proxy bot (https://github.com/Metastem/wikiless)',

  /**
  * Cache control. Wikiless can automatically remove the cached media files from
  * the server. Cache control is on by default.
  * 'cache_control_interval' sets the interval for often the cache directory
  * is emptied (in hours). Default is every 24 hours.
  */
  cache_control: process.env.CACHE_CONTROL !== 'true' || true,
  cache_control_interval: process.env.CACHE_CONTROL_INTERVAL || 24,
}

module.exports = config

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ cat docker-compose.yml
version: "3.7"

services:
  wikiless:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: wikiless
    hostname: wikiless
    restart: always
    networks:
      wikiless_net:
        ipv4_address: 172.4.0.6
    environment:
      REDIS_HOST: redis://172.4.0.5:6379
    ports:
      - "127.0.0.1:8180:8080" # change port if needed
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    depends_on:
        - wikiless-redis

  wikiless-redis:
    container_name: wikiless-redis
    hostname: wikiless-redis
    image: redis:latest
    restart: always
    networks:
      wikiless_net:
        ipv4_address: 172.4.0.5
    ports:
      - "6379"
    user: nobody
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /data:size=10M,mode=0770,uid=65534,gid=65534,noexec,nosuid,nodev
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
      - DAC_OVERRIDE

networks:
  wikiless_net:
    ipam:
      config:
        - subnet: 172.4.0.0/16

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ ls
docker-compose.yml  LICENSE.md  media  nginx.conf  package.json  package-lock.json  README.md  SECURITY.md  src  static  wikiless.config

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ vim Dockerfile

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ docker-compose down
Stopping wikiless       ... done
Stopping wikiless-redis ... done
Removing wikiless       ... done
Removing wikiless-redis ... done
Removing network wikiless_wikiless_net

[ nowhere.moe ] [ /dev/pts/0 ] [/srv/wikiless]
→ docker-compose up -d --build
Creating network "wikiless_wikiless_net" with the default driver
Building wikiless
Step 1/9 : FROM node:20-alpine3.17 AS build
20-alpine3.17: Pulling from library/node
4db1b89c0bd1: Pull complete
c14d172ed001: Pull complete
c07dc96d4e30: Pull complete
db1d0c17eb17: Pull complete
Digest: sha256:e6df1a7e4da3c01fee080bfb504dc5b980a19bea23bd1884629469b55d6cd02f
Status: Downloaded newer image for node:20-alpine3.17
 ---> 063cc1778b5d
Step 2/9 : WORKDIR /wikiless
 ---> Running in 85a222226267
Removing intermediate container 85a222226267
 ---> ec73414a5f0a
Step 3/9 : COPY . /wikiless
 ---> 97c84d369440
Step 4/9 : RUN npm install --no-optional
 ---> Running in 53377f121301
npm WARN config optional Use `--omit=optional` to exclude optional dependencies, or
npm WARN config `--include=optional` to include them.
npm WARN config
npm WARN config     Default value does install optional deps unless otherwise omitted.

added 117 packages, and audited 118 packages in 2s

23 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
npm notice
npm notice New minor version of npm available! 9.7.2 -> 9.8.0
npm notice Changelog: <https://github.com/npm/cli/releases/tag/v9.8.0>
npm notice Run `npm install -g npm@9.8.0` to update!
npm notice
Removing intermediate container 53377f121301
 ---> a0ca7a91b7b4

Step 5/9 : FROM gcr.io/distroless/nodejs20-debian11
latest: Pulling from distroless/nodejs20-debian11
a7ca0d9ba68f: Already exists
fe5ca62666f0: Already exists
b02a7525f878: Already exists
fcb6f6d2c998: Already exists
e8c73c638ae9: Already exists
1e3d9b7d1452: Already exists
4aa0ea1413d3: Already exists
7c881f9ab25e: Already exists
5627a970d25e: Already exists
96266735468f: Already exists
2758d0c31c8c: Already exists
08553ba93cfe: Already exists
dfc02eb7708f: Already exists
52907d314ddc: Already exists
4eec690774a4: Already exists
960f4c0076bf: Already exists
Digest: sha256:9468dc4069714f71a30c6075027f75edca89cc4b30d1afc6741c3430def76d7f
Status: Downloaded newer image for gcr.io/distroless/nodejs20-debian11:latest
 ---> b0a23627a0ab
Step 6/9 : COPY --from=build /wikiless /wikiless
 ---> 72b7dee566ed
Step 7/9 : WORKDIR /wikiless
 ---> Running in 3f227aaf0a85
Removing intermediate container 3f227aaf0a85
 ---> 1cb668fc638e
Step 8/9 : COPY wikiless.config config.js
 ---> cba58fa6593a
Step 9/9 : CMD ["src/wikiless.js"]
 ---> Running in ac6bf21520f9
Removing intermediate container ac6bf21520f9
 ---> 7c3ecb0313e1

Successfully built 7c3ecb0313e1
Successfully tagged wikiless_wikiless:latest
Creating wikiless-redis ... done
Creating wikiless       ... done

then install the reverse nginx proxyi, by default the app is available on local port 8180:

[ nowhere.moe ] [ /dev/pts/2 ] [/srv/wikiless]
→ nmap 127.0.0.1 -p 8180
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-16 16:01 CEST
Nmap scan report for localhost.localdomain (127.0.0.1)
Host is up (0.00010s latency).

PORT     STATE SERVICE
8180/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

root@Datura /srv/wikiless # cd /etc/nginx/sites-available/
root@Datura /etc/nginx/sites-available # vim wikiless.nowhere.moe.conf


[ nowhere.moe ] [ /dev/pts/0 ] [/etc/nginx/sites-available]
→ cat /etc/nginx/sites-available/wikiless.nowhere.moe.conf
server {
  server_name wikiless.nowhere.moe;

    listen 443 ssl;
    listen [::]:443 ssl;
    #http2 on;
    ssl_certificate /etc/acme/certs/wikiless.nowhere.moe/wikiless.nowhere.moe.cer;
    ssl_certificate_key /etc/acme/certs/wikiless.nowhere.moe/wikiless.nowhere.moe.key;

    #ssl_certificate /etc/letsencrypt/live/wikiless.nowhere.moe/fullchain.pem;
    #ssl_certificate_key /etc/letsencrypt/live/wikiless.nowhere.moe/privkey.pem;
    #include /etc/letsencrypt/options-ssl-nginx.conf;
    #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header strict_sni on;
    add_header strict_sni_header on;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy upgrade-insecure-requests;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "DENY";
    add_header Clear-Site-Data "cookies";
    add_header Referrer-Policy "no-referrer";
    add_header Permissions-Policy "interest-cohort=(),accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()";
    resolver 1.1.1.1;

    #ssl_trusted_certificate /etc/letsencrypt/live/wikiless.nowhere.moe/chain.pem;
    #ssl_trusted_certificate /etc/acme/certs/wikiless.nowhere.moe/wikiless.nowhere.moe.cer;
    #ssl_stapling on;
    #ssl_stapling_verify on;

    access_log /dev/null;
    error_log  /dev/null;

   location / {
   proxy_set_header X-Forwarded-For $remote_addr;
   proxy_pass http://localhost:8180;
        }
}

server {
  listen 80;
  listen [::]:80;
  server_name wikiless.nowhere.moe;
  return 301 https://wikiless.nowhere.moe$request_uri;
  }


root@Datura /etc/nginx/sites-available # ln -s /etc/nginx/sites-available/wikiless.nowhere.moe.conf  /etc/nginx/sites-enabled/
root@Datura /etc/nginx/sites-available # systemctl stop nginx
root@Datura /etc/nginx/sites-available # acme.sh --issue --standalone -d wikiless.nowhere.moe -k 4096

root@Datura /etc/nginx/sites-available # nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
root@Datura /etc/nginx/sites-available # systemctl restart nginx

then check that your instance is working here:

Next we're going to make sure the website is accessible over tor:

[ nowhere.moe ] [ /dev/pts/2 ] [/srv]
→ cat /etc/nginx/sites-available/wikiless.nowhere.moe.conf
server {
  server_name wikiless.nowhere.moe;

    listen 443 ssl;
    listen [::]:443 ssl;
    #http2 on;
    ssl_certificate /etc/acme/certs/wikiless.nowhere.moe/wikiless.nowhere.moe.cer;
    ssl_certificate_key /etc/acme/certs/wikiless.nowhere.moe/wikiless.nowhere.moe.key;

    ######## TOR CHANGES ########
    listen 4444 ssl;
    listen [::]:4444 ssl;
    server_name wikiless.daturab6drmkhyeia4ch5gvfc2f3wgo6bhjrv3pz6n7kxmvoznlkq4yd.onion;
    add_header Onion-Location "http://wikiless.daturab6drmkhyeia4ch5gvfc2f3wgo6bhjrv3pz6n7kxmvoznlkq4yd.onion$request_uri" always;
    ######## TOR CHANGES #######

    #ssl_certificate /etc/letsencrypt/live/wikiless.nowhere.moe/fullchain.pem;
    #ssl_certificate_key /etc/letsencrypt/live/wikiless.nowhere.moe/privkey.pem;
    #include /etc/letsencrypt/options-ssl-nginx.conf;
    #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header strict_sni on;
    add_header strict_sni_header on;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy upgrade-insecure-requests;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "DENY";
    add_header Clear-Site-Data "cookies";
    add_header Referrer-Policy "no-referrer";
    add_header Permissions-Policy "interest-cohort=(),accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()";
    resolver 1.1.1.1;

    #ssl_trusted_certificate /etc/letsencrypt/live/wikiless.nowhere.moe/chain.pem;
    #ssl_trusted_certificate /etc/acme/certs/wikiless.nowhere.moe/wikiless.nowhere.moe.cer;
    #ssl_stapling on;
    #ssl_stapling_verify on;

    access_log /dev/null;
    error_log  /dev/null;

   location / {
   proxy_set_header X-Forwarded-For $remote_addr;
   proxy_pass http://localhost:8180;
        }
}

server {
  listen 80;
  listen [::]:80;
  server_name wikiless.nowhere.moe;
  return 301 https://wikiless.nowhere.moe$request_uri;
  }

[ nowhere.moe ] [ /dev/pts/2 ] [/srv]
→ cat /etc/tor/torrc | grep 444
HiddenServicePort 80 127.0.0.1:4443
HiddenServicePort 443 127.0.0.1:4444
	

It may give an ssl error but at least it serves everything over https over tor. Let me know if you managed to make this work without the need of https.

And lastly let's make it update automatically via a cronjob:

[ nowhere.moe ] [ /dev/pts/2 ] [/srv]
→ crontab -e
	
@daily docker-compose -f /srv/wikiless/docker-compose.yml stop ; git -C /srv/wikiless/ pull ; docker-compose -f /srv/wikiless/docker-compose.yml up -d --build

[ nowhere.moe ] [ /dev/pts/2 ] [/srv]
→ cronitor select

Use the arrow keys to navigate: ↓ ↑ → ←
? Select job to run:
✔ docker-compose -f /srv/wikiless/docker-compose.yml stop ; git -C /srv/wikiless/ pull ; docker-compose -f /srv/wikiless/docker-compose.yml up -d --build
----► Running command: docker-compose -f /srv/wikiless/docker-compose.yml stop ; git -C /srv/wikiless/ pull ; docker-compose -f /srv/wikiless/docker-compose.yml up -d --build

Stopping wikiless       ... done
Stopping wikiless-redis ... done
Already up to date.
Building wikiless
Step 1/9 : FROM node:20-alpine3.17 AS build
 ---> 063cc1778b5d
Step 2/9 : WORKDIR /wikiless
 ---> Using cache
 ---> ec73414a5f0a
Step 3/9 : COPY . /wikiless
 ---> Using cache
 ---> 97c84d369440
Step 4/9 : RUN npm install --no-optional
 ---> Using cache
 ---> a0ca7a91b7b4

Step 5/9 : FROM gcr.io/distroless/nodejs20-debian11
 ---> b0a23627a0ab
Step 6/9 : COPY --from=build /wikiless /wikiless
 ---> Using cache
 ---> 72b7dee566ed
Step 7/9 : WORKDIR /wikiless
 ---> Using cache
 ---> 1cb668fc638e
Step 8/9 : COPY wikiless.config config.js
 ---> Using cache
 ---> cba58fa6593a
Step 9/9 : CMD ["src/wikiless.js"]
 ---> Using cache
 ---> 7c3ecb0313e1

Successfully built 7c3ecb0313e1
Successfully tagged wikiless_wikiless:latest
Starting wikiless-redis ... done
Recreating wikiless     ... done

----► ✔ Command successful    Elapsed time 13.038s