siyuan

Overview

The easiest way to serve SiYuan on a server is to deploy it through Docker.

• Image name b3log/siyuan
• Image URL

File structure

The overall program is located under /opt/siyuan/, which is basically the structure under the resources folder of the Electron installation package:

• appearance: icon, theme, languages
• guide: user guide document
• stage: interface and static resources
• kernel: kernel program

Entrypoint

The entry point is set when building the Docker image: ENTRYPOINT ["/opt/siyuan/entrypoint.sh"]. This script allows changing the PUID and PGID of the user that will run inside the container. This is especially relevant to solve permission issues when mounting directories from the host. The PUID (User ID) and PGID (Group ID) can be passed as environment variables, making it easier to ensure correct permissions when accessing host-mounted directories.

Use the following parameters when running the container with docker run b3log/siyuan:

Note: Since v3.7.0, the serve subcommand must be passed explicitly (e.g. docker run b3log/siyuan serve --workspace=...). Run docker run --rm b3log/siyuan serve --help to see all serving options.

• --workspace: Specifies the workspace folder path, mounted to the container via -v on the host
• --accessAuthCode: Specifies the lock screen password

More parameters can be found using --help. Here’s an example of a startup command with the new environment variables:

docker run -d \
  -v workspace_dir_host:workspace_dir_container \
  -p 6806:6806 \
  -e PUID=1001 -e PGID=1002 \
  b3log/siyuan \
  serve \
  --workspace=workspace_dir_container \
  --accessAuthCode=xxx

• PUID: Custom user ID (optional, defaults to 1000 if not provided)
• PGID: Custom group ID (optional, defaults to 1000 if not provided)
• workspace_dir_host: The workspace folder path on the host
• workspace_dir_container: The path of the workspace folder in the container, as specified in --workspace
  • Alternatively, it's possible to set the path via the SIYUAN_WORKSPACE_PATH env variable. The commandline will always have the priority, if both are set
• accessAuthCode: Lock screen password (please be sure to modify, otherwise anyone can access your data)
  • Alternatively, it's possible to set the lock screen password via the SIYUAN_ACCESS_AUTH_CODE env variable. The commandline will always have the priority, if both are set
  • To disable the lock screen password set the env variable SIYUAN_ACCESS_AUTH_CODE_BYPASS=true
• OIDC can replace the lock screen password as the required Docker access authentication. Set SIYUAN_OIDC_ENABLED=true, SIYUAN_OIDC_PROVIDER (custom, google, microsoft, or github), SIYUAN_OIDC_CLIENT_ID, and the provider-specific values below. GitHub uses its OAuth 2.0 user API adapter; the other providers use OpenID Connect discovery and ID Token validation. An invalid enabled configuration stops Docker startup when no lock screen password is available
  • SIYUAN_OIDC_ISSUER_URL: Issuer URL required by the custom and microsoft providers; Microsoft must use a tenant-specific issuer such as https://login.microsoftonline.com/<tenant-id>/v2.0
  • SIYUAN_OIDC_CLIENT_SECRET: Optional client secret for OpenID Connect providers; required by the GitHub OAuth adapter. Every authorization-code flow also uses PKCE
  • SIYUAN_OIDC_SCOPES: Comma- or space-separated scopes; openid is always included
  • SIYUAN_OIDC_REDIRECT_URL: Public HTTPS callback URL ending in /api/system/oidc/callback, required for remote browser access
  • SIYUAN_OIDC_ALLOW_ALL: Explicitly grant SiYuan administrator access to every identity authenticated by the pr