kumbuka

README

Keep your knowledge close.
A small, self-hosted, Markdown-first wiki for documentation.

Kumbuka is a self-hosted knowledge platform backed by PostgreSQL. It provides a clean place for documentation, notes, and team knowledge while keeping your data under your control.

For installation, configuration, authentication, plugins, and administration, see the Kumbuka documentation.

Quick start

Start Kumbuka with Docker Compose:

docker compose -f deploy/compose.yaml up -d

Then open:

http://localhost:8080

On a fresh database, Kumbuka will guide you through creating the first administrator.

Example Kubernetes manifests are available in deploy/kubernetes.

You can also run the server directly:

kumbuka \
  --database-url 'postgres://USER:PASS@HOST:5432/kumbuka?sslmode=disable' \
  --listen-address 0.0.0.0:8080 \
  --public-url http://localhost:8080

Configuration

Kumbuka can be configured using command-line flags or environment variables. Environment variables use the KUMBUKA__ prefix.

Flag	Environment variable	Default
--listen-address	KUMBUKA__LISTEN_ADDRESS	127.0.0.1:8080
--management-listen-address	KUMBUKA__MANAGEMENT_LISTEN_ADDRESS	127.0.0.1:8081
--public-url	KUMBUKA__PUBLIC_URL	http://localhost:8080
--route-prefix	KUMBUKA__ROUTE_PREFIX	empty
--database-url	KUMBUKA__DATABASE_URL	—
--read-only	KUMBUKA__READ_ONLY	false
--trusted-proxy-cidrs	KUMBUKA__TRUSTED_PROXY_CIDRS	empty

The management listener exposes GET /healthz, GET /readyz, and, unless disabled, GET /metrics. It is separate from the public application listener and is not mounted below --route-prefix.

When using proxy authentication, configure --trusted-proxy-cidrs with the CIDRs of the immediate trusted ingress peers. Requests from any other peer cannot authenticate through identity headers. Your ingress must strip client-supplied identity headers before setting its own. Without a trusted CIDR list, proxy authentication cannot be enabled; local and OIDC modes are unaffected. A sole * permits every valid immediate peer (never mix it with CIDRs). Only use * when network policy prevents direct access except through the identity-verifying proxy. A startup warning is logged for wildcard trust.

For all available settings and deployment options, see kumbuka.me.

Ecosystem

• Kumbuka CLI — builds, Markdown mirrors, and plugin management
• Plugin SDK — build Go/WASI plugins for Kumbuka
• Official plugins — first-party Kumbuka plugins

License

Licensed under the Apache License, Version 2.0.