Outline

Wiki and knowledge base for growing teams

• Category: Apps
• Status: 3, stable
• Image: outlinewiki/outline, 4, upstream
• Healthcheck: Yes
• Backups: Yes
• Email: Yes
• Tests: No
• SSO: 3 (OAuth)

Basic usage

1. Set up Docker Swarm and abra
2. Deploy coop-cloud/traefik
3. abra app new outline
4. Insert secrets:
   • abra app secret insert <APP-DOMAIN> secret_key v1 $(openssl rand -hex 32)
   • abra app secret generate -a <APP-DOMAIN>
5. abra app deploy <APP-DOMAIN>
6. Open the configured domain in your browser to finish set-up

Tips & Tricks

Create an initial admin user

abra app cmd <APP-DOMAIN> app create_email_user test@example.com

Setting up your .env config

Avoid the use of quotes ("...") as much as possible, the NodeJS scripts flip out for some reason on some vars.

Deleting a user (e.g. to fix SSO weirdness)

abra app cmd <APP-DOMAIN> db delete_user <USERNAME-TO-DELETE> <USERNAME-TO-REPLACE>

Where <USERNAME-TO-DELETE> is the username of the user to be removed, and <USERNAME-TO-REPLACE> is the username of another user, to assign documents and revisions to (instead of deleting them).

Migrate from S3 to local storage

1. abra app config <APP-DOMAIN>, add

   • COMPOSE_FILE="$COMPOSE_FILE:compose.local.yml"
   • FILE_STORAGE_UPLOAD_MAX_SIZE=26214400

2. abra app deploy <APP-DOMAIN> -f

   • compose.aws.yml should still be deployed!

3. abra app undeploy <APP-DOMAIN>

4. On the docker host, find mount *point of newly created volume via docker volume ls and docker volume inspect

   • volume name is something like <APP-DOMAIN>_storage-data
   • take note which Linux user owns <STORAGE_MOUNTPOINT> (likely 1001)
   • use s3cmd/rclone/... to sync your bucket to <STORAGE_MOUNTPOINT>

5. chown -R <STORAGE_USER>:<STORAGE_USER> <STORAGE_MOUNTPOINT>

6. abra app config <APP-DOMAIN>, switch storage back-end

   • remove AWS_* vars, SECRET_AWS_SECRET_KEY_VERSION and COMPOSE_FILE="$COMPOSE_FILE:compose.aws.yml"
   • set FILE_STORAGE=local

7. abra app deploy <APP-DOMAIN> -f

8. Enjoy getting rid of S3 🥳

Single Sign On with Keycloak/Authentik

1. Create an OIDC client in Keycloak (in Authentik this is called a provider and application)

2. Run abra app config <APP-DOMAIN>, then uncomment everything in the OIDC_ section.

   • Valid Redirect URIs: https://<APP-DOMAIN>/auth/oidc.callback
   • Reference the client/provider info to populate the OIDC_AUTH_URI OIDC_TOKEN_URI and OIDC_USERINFO_URI values

3. Set the OIDC secret using the value from the client/provider abra app secret insert <APP-DOMAIN> oidc_client_secret v1 "<SECRET_VALUE>"

4. abra app deploy <APP-DOMAIN>

Advanced: Group Sync with Authentik

As outline doesn't support group sync, you can make use of an extra service, the Outline-Authentik-Connector, to do so.

1. Uncomment the respective section in your .env, and set the necessary envs.

2. Then follow these instructions to create the needed user and tokens

   Note

   For the authentik-token make sure you don't use the token it shows when creating the user (that is a password), create as the user (it will expire) but in the admin interface (path: https://<APP_DOMAIN>/if/admin/#/core/tokens). Also setting the needed global permissions was not possible on the user directly, but I had to create a role for this.

3. and insert them as secrets:

abra app secret insert <APP-DOMAIN> agsoutline v1 "<SECRET_VALUE>"
abra app secret insert <APP-DOMAIN> agsauthentik v1 "<SECRET_VALUE>"
abra app secret insert <APP-DOMAIN> agswebhook v1 "<SECRET_VALUE>"