(Last Updated On: October 27, 2018)

This guide aims to cover complete installation of Wekan on Ubuntu 18.04 LTS. Wekan is a free and open source Trello-style Kanban Board system that helps you manage tasks and keep your stuff organized, plan for holidays, prepare a personal todo list, managing other people e.t.c.

Features of Wekan Kanban

  • You can list of all your public and private boards using shortcuts at top of page
  • Has a full screen or window on a desktop and full screen on mobile Firefox without a need for browser buttons
  • You have Keyboard shortcuts button at the bottom right corner
  • User management module
  • You can restore an archived board
  • You add, star, watch, archive and delete boards
  • Import Trello board: Text, labels, images, comments, checklists. Not imported yet: stickers, etc.
  • Export Wekan board
  • Clipboard and drag and drop functions
  • Provides a REST API
  • Authentication, Admin Panel, SMTP Settings, and many others.

The easiest way to install Wekan Kanban board tool on Ubuntu 18.04 is by using snap. If you’re new to Snap, check our guide on Installing Snap on Linux

Installation of snap on Ubuntu 18.04 should be as easy as running

sudo apt install snap

For CentOS users, check How to Install Wekan Open source Kanban on CentOS 7 with Nginx and Letsencrypt SSL

Installing Wekan on Ubuntu 18.04 with snap

Once the snap package is installed, install wekan by running the command:

sudo snap install wekan

You need to configure a web URL root for wekan:

sudo snap set wekan root-url="https://wekan.example.com"

You can run Wekan on standard http port 80 or on a different port like.3001 A custom port is useful when running Wekan behind a proxy like Nginx

sudo snap set wekan port='3001'
sudo systemctl restart snap.wekan.mongodb
sudo systemctl restart snap.wekan.wekan

Check for status

# ss -tunelp | grep 3001
tcp   LISTEN  0       128                  0.0.0.0:3001           0.0.0.0:*      users:(("node",pid=5703,fd=14)) ino:29462 sk:6 <->

Its systemd service unit file is /etc/systemd/system/snap.wekan.wekan.service.To check service status, use:

$ systemctl status  snap.wekan.wekan
* snap.wekan.wekan.service - Service for snap application wekan.wekan
   Loaded: loaded (/etc/systemd/system/snap.wekan.wekan.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2018-10-26 12:06:16 PDT; 52s ago
 Main PID: 5285 (wekan-control)
    Tasks: 11 (limit: 507)
   CGroup: /system.slice/snap.wekan.wekan.service
           |-5285 /bin/bash /snap/wekan/309/bin/wekan-control
           `-5703 /snap/wekan/309/bin/node main.js

Oct 26 12:06:17 ubuntu-02 wekan.wekan[5285]: LDAP_SYNC_GROUP_ROLES= (default value)
Oct 26 12:06:17 ubuntu-02 wekan.wekan[5285]: LDAP_DEFAULT_DOMAIN= (default value)
Oct 26 12:06:17 ubuntu-02 wekan.wekan[5285]: MONGO_URL=mongodb:///var/snap/wekan/current/share/mongodb-27019.sock/wekan
Oct 26 12:06:19 ubuntu-02 wekan.wekan[5285]: Presence started serverId=fEzFLcE4M8Numoqou
Oct 26 12:06:19 ubuntu-02 wekan.wekan[5285]: Note: you are using a pure-JavaScript implementation of bcrypt.
Oct 26 12:06:19 ubuntu-02 wekan.wekan[5285]: While this implementation will work correctly, it is known to be
Oct 26 12:06:19 ubuntu-02 wekan.wekan[5285]: approximately three times slower than the native implementation.
Oct 26 12:06:19 ubuntu-02 wekan.wekan[5285]: In order to use the native implementation instead, run
Oct 26 12:06:19 ubuntu-02 wekan.wekan[5285]:   meteor npm install --save bcrypt
Oct 26 12:06:19 ubuntu-02 wekan.wekan[5285]: in the root directory of your application.

Disable and enable wekan service

Use the following snap commands to enable wekan service on Ubuntu 18.04 to start on boot.

sudo snap enable wekan

To disable the service, use:

sudo snap disable wekan

MongoDB service port can also be changed to a custom one:

sudo snap set wekan mongodb-port=27019

Accessing MongoDB CLI for Administration

To use MongoDB CLI, you need to install MongoDB 3.2.x tools, and run on CLI:

$ mongo --port 27019

Restart Wekan after changes

If you need to restart Wekan whenever you make changes, use the command:

sudo systemctl restart snap.wekan.wekan

Step 3: Set Snap Auto-updates

Install all Snap updates automatically between 02:00 AM and 04:00 AM

snap set core refresh.schedule=02:00-04:00

Automatic upgrades happen sometime after Wekan is released, or at a scheduled time, or with:

sudo snap refresh

Step 4: Configure Wekan Email Settings (Optional)

Configure Admin notification email. This is optional since Wekan doesn’t need email configurations to function.

sudo snap set wekan mail-url='smtps://user:[email protected]:453'
sudo snap set wekan mail-from='Wekan Boards <[email protected]>'

Step 5: Configure Nginx without SSL

For the default Nginx configuration,/etc/nginx/nginx.conf here are the recommended settings:

user nginx;
worker_processes auto;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;

events {
	worker_connections 1024;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	types_hash_max_size 2048;
	server_tokens off;
        set_real_ip_from 0.0.0.0/32; # All addresses get a real IP.
        real_ip_header X-Forwarded-For;
        limit_conn_zone $binary_remote_addr zone=arbeit:10m;
        client_body_timeout 60;
        client_header_timeout 60;
        keepalive_timeout 10 10;
        send_timeout 60;
        reset_timedout_connection on;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1.2 TLSv1.1 TLSv1; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:30m;
        ssl_session_timeout 1d;
        ssl_ciphers ECDH+aRSA+AESGCM:ECDH+aRSA+SHA384:ECDH+aRSA+SHA256:ECDH:EDH+CAMELLIA:EDH+aRSA:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA;
        ssl_ecdh_curve secp384r1;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header X-XSS-Protection '1; mode=block';
        add_header X-Frame-Options SAMEORIGIN;
        add_header Strict-Transport-Security 'max-age=31536000';
        add_header X-Content-Options nosniff;
        add_header X-Micro-Cache $upstream_cache_status;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;
	gzip_disable "msie6";
        gzip_buffers 16 8k;
        gzip_comp_level 1;
        gzip_http_version 1.1;
        gzip_min_length 10;
        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/x-icon application/vnd.ms-fontobject font/opentype application/x-font-ttf;
        gzip_vary on;
        gzip_proxied any; # Compression for all requests.

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}

If you want to use SSL, check step 6. For http only service, create Nginx Virtual Host for Wekan.

sudo vim /etc/nginx/conf.d/wekan.conf

Add the following contents to the file.

# This section is needed to proxy web-socket connections
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# HTTP
server {
    listen 80;
    server_name wekan.example.com;
    
    # If your application is not compatible with IE <= 10, this will redirect visitors to a page advising a browser update
    # This works because IE 11 does not present itself as MSIE anymore
    if ($http_user_agent ~ "MSIE" ) {
        return 303 https://browser-update.org/update.html;
    }

    # Pass requests to Wekan.
    # If you have Wekan at https://example.com/wekan, change the location to:
    # location /wekan {
    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade; # allow websockets
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-For $remote_addr; # preserve client IP

        # this setting allows the browser to cache the application in a way compatible with Meteor
        # on every applicaiton update the name of CSS and JS file is different, so they can be cache infinitely (here: 30 days)
        # the root path (/) MUST NOT be cached
        #if ($uri != '/wekan') {
        #    expires 30d;
        #}
    }
}

Step 6: Wekan SSL encryption with Let’s Encrypt (optional)

This section demonstrates how to use Let’s Encrypt to secure access to your Wekan Dashboard. Any other valid SSL certificates can be used and skipping Let’s Encrypt certificates generation step.

To request for certbot SSL certificate, you need the port 80  open and not used by any web service. If you have UFW firewall running, open the port using:

sudo ufw allow proto tcp from any to any port 80,443

We’ll request for a certificate using.certbot-auto Provide a valid email address for expiry notifications and a valid domain to be used for Wekan.

wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
mv certbot-auto /usr/local/bin
export DOMAIN="wekan.example.com"
export EMAIL="[email protected]"
certbot-auto certonly --standalone -d $DOMAIN --preferred-challenges http --agree-tos -n -m $EMAIL --keep-until-expiring

When done. configure Nginx Proxy

sudo vim /etc/nginx/conf.d/wekan.conf

Paste these contents into filewekan.conf.

# this section is needed to proxy web-socket connections
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# HTTP
server {
    listen 80; 
    server_name example.com;
    # redirect non-SSL to SSL
    location / {
        rewrite     ^ https://example.com$request_uri? permanent;
    }
}

# HTTPS server
server {
    listen 443 ssl http2; # we enable HTTP/2 here (previously SPDY)
    server_name example.com; # this domain must match Common Name (CN) in the SSL certificate

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # If your application is not compatible with IE <= 10, this will redirect visitors to a page advising a browser update
    # This works because IE 11 does not present itself as MSIE anymore
    if ($http_user_agent ~ "MSIE" ) {
        return 303 https://browser-update.org/update.html;
    }

    # Pass requests to Wekan.
    # If you have Wekan at https://example.com/wekan , change location to:
    # location /wekan {
    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade; # allow websockets
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-For $remote_addr; # preserve client IP

        # this setting allows the browser to cache the application in a way compatible with Meteor
        # on every applicaiton update the name of CSS and JS file is different, so they can be cache infinitely (here: 30 days)
        # the root path (/) MUST NOT be cached
        #if ($uri != '/wekan') {
        #    expires 30d;
        #}
    }
}

Start nginx service and enable it to start on boot:

$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

If config is OK, take it into use by starting nginx service:

sudo systemctl start nginx
sudo systemctl enable nginx

You can view wekan help page by running:

wekan.help

Step 7: Adding Wekan UI Users

Go to your Wekan URL like https://example.com/sign-up  page. For a fresh installation, you need to signup to get an admin account.

Register your username, email address, and password. The first user to be registered have admin privileges, and the next one will be normal users. If you want other admins too, you can change their permission to admin at Admin Panel.

Note: If you get some error about email settings, you can ignore it. WORKING EMAIL IS NOT REQUIRED. Wekan works without setting up email.

Once an account has been created. Login to Wekan at https://example.com/sign-in

Registering normal users:

By default, other users can register themselves by visiting the page https://example.com/sign-up and creating an account. If you would like to disable self-registration, navigate to Admin Panel > Settings > Registration > [X] Disable self-registration. Then invite new users to selected boards by email address.

Conclusion

You should have been successful to install Wekan Kanban application on Ubuntu 18.04 LTS server. It is not a compulsory requirement to configure Nginx reverse proxy with Letsencrypt SSL certificate.