From thought to insight, with agents
English | 中文 | 日本語 | Türkçe | Português
SiYuan is a privacy-first personal knowledge management system, supporting fine-grained block-level reference and Markdown WYSIWYG.


To learn more, read the online user guide or join the SiYuan English Discussion Forum.
Most features are free, even for commercial use.
siyuan://Some features are only available to paid members, for more details please refer to Pricing.
| Project | Description | Forks | Stars |
|---|---|---|---|
| lute | Editor engine | ||
| chrome | Chrome/Edge extension | ||
| bazaar | Community marketplace | ||
| dejavu | Data repo | ||
| petal | Plugin API | ||
| android | Android App | ||
| ios | iOS App | ||
| harmony | HarmonyOS App | ||
| riff | Spaced repetition |
It is recommended to give priority to installing through the application market on desktop and mobile, so that you can upgrade the version with one click in the future.
Mobile:
Desktop:
siyuansiyuan-notedocker run -d \
-v workspace_dir_host:workspace_dir_container \
-p 6806:6806 \
-e PUID=1001 -e PGID=1002 \
b3log/siyuan \
serve \
--workspace=workspace_dir_container \
--accessAuthCode="${AuthCode:?Set AuthCode}"
- `PUID`: Custom user ID (optional, defaults to `1000` if not provided)
- `PGID`: Custom group ID (optional, defaults to `1000` if not provided)
- `workspace_dir_host`: The workspace folder path on the host
- `workspace_dir_container`: The path of the workspace folder in the container, as specified in `--workspace`
- Alternatively, it's possible to set the path via the `SIYUAN_WORKSPACE_PATH` env variable. The commandline will always have the priority, if both are set
- `accessAuthCode`: Lock screen password (please **be sure to modify**, otherwise anyone can access your data)
- Alternatively, it's possible to set the lock screen password via the `SIYUAN_ACCESS_AUTH_CODE` env variable. The commandline will always have the priority, if both are set
- To disable the lock screen password set the env variable `SIYUAN_ACCESS_AUTH_CODE_BYPASS=true`
- OIDC can replace the lock screen password as the required Docker access authentication. Set `SIYUAN_OIDC_ENABLED=true`, `SIYUAN_OIDC_PROVIDER` (`custom`, `google`, `microsoft`, or `github`), `SIYUAN_OIDC_CLIENT_ID`, and the provider-specific values below. GitHub uses its OAuth 2.0 user API adapter; the other providers use OpenID Connect discovery and ID Token validation. An invalid enabled configuration stops Docker startup when no lock screen password is available
- `SIYUAN_OIDC_ISSUER_URL`: Issuer URL required by the `custom` and `microsoft` providers; Microsoft must use a tenant-specific issuer such as `https://login.microsoftonline.com//v2.0`
- `SIYUAN_OIDC_CLIENT_SECRET`: Optional client secret for OpenID Connect providers; required by the GitHub OAuth adapter. Every authorization-code flow also uses PKCE
- `SIYUAN_OIDC_SCOPES`: Comma- or space-separated scopes; `openid` is always included
- `SIYUAN_OIDC_REDIRECT_URL`: Public HTTPS callback URL ending in `/api/system/oidc/callback`, required for remote browser access
- `SIYUAN_OIDC_ALLOW_ALL`: Explicitly grant SiYuan administrator access to every identity authenticated by the provider
- `SIYUAN_OIDC_CLAIM_RULES`: JSON array of claim rules used when allow-all is disabled, for example `[{"claim":"email","operator":"equals","values":["user@example.com"]},{"claim":"email_verified","operator":"equals","values":["true"]}]`; values within a rule use OR, while rules use AND
- Native mobile apps use the fixed callback URI `siyuan:/oidc-callback`; register it exactly as written. Mobile configuration verification uses this callback before saving. Custom providers, Microsoft, and GitHub can be used only when their application registration accepts this callback URI. Google does not accept this private-use URI for its Android client type, so Google login is limited to browser and desktop flows
- `SIYUAN_LANG`: Interface language (optional, defaults to `en` if unset in Docker). Accepts BCP 47 tags like `zh-CN`/`zh-TW`/`en`/`ja`/`pt-BR`; legacy underscore values like `zh_CN`/`en_US` are also accepted for backward compatibility. Omit it if you want the language chosen in **Settings** to persist across restarts; if set, it is applied on every startup and overrides the saved setting
- Alternatively, use the `--lang` command-line parameter. If both are set, the command-line takes priority
To simplify things, it is recommended to configure the workspace folder path to be consistent on the host and container, such as having both `workspace_dir_host` and `workspace_dir_container` configured as `/siyuan/workspace`. The corresponding startup command would be:
First set `AuthCode` to your own strong password (use `export AuthCode='your-strong-password'` in Bash; Compose can also read a `.env` file in the same directory). The example stops with an error if the value is unset or empty.
docker run -d \
-v /siyuan/workspace:/siyuan/workspace \
-p 6806:6806 \
-e PUID=1001 -e PGID=1002 \
b3log/siyuan \
serve \
--workspace=/siyuan/workspace/ \
--accessAuthCode="${AuthCode:?Set AuthCode}"
#### Docker Compose
For users running SiYuan with Docker Compose, the environment variables `PUID` and `PGID` can be passed to customize the user and group IDs. Here's an example of a Docker Compose configuration:
First set `AuthCode` to your own strong password (use `export AuthCode='your-strong-password'` in Bash; Compose can also read a `.env` file in the same directory). The example stops with an error if the value is unset or empty.
version: "3.9"
services:
main:
image: b3log/siyuan
command: ['serve', '--workspace=/siyuan/workspace/', '--accessAuthCode=${AuthCode:?Set AuthCode}']
ports:
- 6806:6806
volumes:
- /siyuan/workspace:/siyuan/workspace
restart: unless-stopped
environment:
- TZ=${YOUR_TIME_ZONE} # A list of time zone identifiers can be found at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
- PUID=${YOUR_USER_PUID} # Customize user ID
- PGID=${YOUR_USER_PGID} # Customize group ID
In this setup:
- `PUID` and `PGID` are set dynamically and passed to the container
- If these variables are not provided, the default `1000` will be used
By specifying `PUID` and `PGID` in the environment, you avoid the need to explicitly set the `user` directive (`user: '1000:1000'`) in the compose file. The container will dynamically adjust the user and group based on these environment variables at startup.
#### User Permissions
In the image, the `entrypoint.sh` script ensures the creation of the `siyuan` user and group with the specified `PUID` and `PGID`. Therefore, when the host creates a workspace folder, pay attention to setting the user and group ownership of the folder to match the `PUID` and `PGID` you plan to use. For example:
chown -R 1001:1002 /siyuan/workspace
If you use custom `PUID` and `PGID` values, the entrypoint script will ensure that the correct user and group are created inside the container, and ownership of mounted volumes will be adjusted accordingly. There’s no need to manually pass `-u` in `docker run` or `docker-compose` as the environment variables will handle the customization.
#### Hidden port
Use an NGINX reverse proxy to hide port 6806. Please note:
- Configure the WebSocket reverse proxy for `/ws`
- Preserve the original `Host` header, including the port, for both regular requests and `/ws`. In NGINX, configure `proxy_set_header Host $http_host;` in both proxy locations. Using `$host` drops non-standard ports (such as `8443`), which can cause Origin validation to fail, leaving the page stuck on the logo with repeated reloads, API responses of `401`, or failed WebSocket connections
#### Note
- Be sure to confirm the correctness of the mounted volume, otherwise the data will be lost after the container is deleted
- Do not use URL rewriting for redirection, otherwise there may be problems with authentication, it is recommended to configure a reverse proxy
- If you encounter permission issues, verify that the `PUID` and `PGID` environment variables match the ownership of the mounted directories on your host system
#### Limitations
- Does not support desktop and mobile application connections, only supports use on browsers
- Export to PDF, HTML and Word formats is not supported
- Import Markdown file is not supported
helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install siyuan helmforge/siyuan --namespace siyuan --create-namespace --wait
kubectl -n siyuan get secret siyuan-siyuan-auth -o go-template='{{index .data "access-code" | base64decode}}{{"\n"}}'
kubectl -n siyuan port-forward service/siyuan-siyuan 6806:6806
Open and enter the generated lock screen password. Keep this password secure; it is distinct from the API token. The names above assume the default chart values and release name `siyuan`.
For remote access, use a dedicated HTTPS hostname and an Ingress controller that proxies WebSockets on `/ws`, without URL rewriting. Configure `ingress` and allow the controller's namespace through `networkPolicy.ingressFrom`; the default policy allows same-namespace ingress and DNS egress only. Add explicit egress rules for cloud sync or other external services. See the [chart guide and production example](https://helmforge.dev/docs/charts/siyuan) for TLS, existing Secrets, and storage configuration.
- **One workspace, one writer:** Never scale replicas or mount the same workspace in another running instance, even with ReadWriteMany storage. The chart uses `Recreate`, so upgrades stop the old writer before starting the new one and cause downtime.
- **Persistence:** The complete workspace is mounted at `/siyuan/workspace`. The chart retains its generated PVC on uninstall by default; deleting the namespace or PVC can still destroy data. Reuse a retained or restored claim with `persistence.existingClaim`.
- **Backups and upgrades:** Gracefully stop the writer before backing up the complete workspace, or use an application-consistent backup procedure. A copy of the live SQLite index alone is insufficient. Securely preserve authentication Secrets, encryption keys, and encrypted-notebook recovery passwords, and test restores into a separate PVC. Back up before upgrades and review storage-format changes: Helm rollback does not undo data migrations.
The Docker hosting limitations also apply: browser use only, no desktop or mobile application connections, no PDF/HTML/Word export, and no Markdown file import.
Web UI: 6806
Container Port: 6806
Container Path: /siyuan/workspace
Host path: /mnt/user/appdata/siyuan
PUID: 1000
PGID: 1000
Publish parameters: serve --accessAuthCode=******(Lock screen password)
zfs create Pool_1/Apps_Data/siyuan
chown -R 1001:1002 /mnt/Pool_1/Apps_Data/siyuan
chmod 755 /mnt/Pool_1/Apps_Data/siyuan
Navigate to Apps - DiscoverApps - More Options (on top right, besides Custom App) - Install via YAML
Template reference:
Before deploying, fill in your own strong password after `SIYUAN_ACCESS_AUTH_CODE=` below; do not leave it empty.
services:
siyuan:
image: b3log/siyuan
container_name: siyuan
command: ['serve', '--workspace=/siyuan/workspace/']
ports:
- 6806:6806
volumes:
- /mnt/Pool_1/Apps_Data/siyuan:/siyuan/workspace # Adjust to your dataset path
restart: unless-stopped
environment:
- SIYUAN_ACCESS_AUTH_CODE=
- TZ=America/New_York # Replace with your timezone if needed
- PUID=1001
- PGID=1002
Select Beta or Alpha in Settings - About - Update channel to receive prereleases. Beta includes stable, RC, and Beta releases; Alpha includes all releases. Test channels require access to GitHub.
The built-in CLI provides direct access to workspace data — no running server required.
The CLI does not support operations on encrypted notebooks. Unlock and access them through the dedicated in-app workflow.
# List all notebooks
siyuan notebook list -w ~/SiYuan
# Full-text search with JSON output
siyuan search "keyword" -w ~/SiYuan -f json
# Search inside asset files (PDF/Word/Excel/txt etc.)
siyuan search "phrase" --asset -w ~/SiYuan
siyuan search "phrase" --asset --ext pdf --ext docx -w ~/SiYuan
# Export a document as Markdown
siyuan export md --id <block-id> -w ~/SiYuan
| Category | Commands |
|---|---|
| Notebooks & Documents | notebook, document, dailynote — CRUD and daily notes |
| Content | block, attr, outline — block read/write, attributes, outline |
| Metadata | tag, bookmark, template — tags, bookmarks, template snippets |
| Queries | search, sql — full-text, semantic, asset-content, and SQL queries |
| References | ref — backlinks and mentions |
| Import/Export | export, import, inbox — Markdown, HTML, preview, Word, .sy.zip, Data, cloud inbox |
| Data Management | repo, history, sync — snapshots, versions, cloud sync |
| Utilities | asset, file — resources and file system |
| Database | database — attribute view management |
| Server | serve — start the kernel HTTP server |
| Workspace & System | workspace, system — list, inspect, system info |
Run siyuan --help for the full command tree. Use -f json (default is -f table) for script-friendly output. Most mutating commands also support --dry-run to preview changes without applying them.
The CLI binary is <install-dir>/resources/kernel/SiYuan-Kernel, invoked via the siyuan command.
PATH, so siyuan works out of the box. The Microsoft Store edition (3.8.7+) registers the siyuan.exe app execution alias on Windows 10 1607 (build 14393) or later. After installing or updating, open a new terminal and run siyuan --help
```powershell
siyuan --help# Check which command is being used
Get-Command siyuan -All
where.exe siyuan
``
If the command is unavailable, check that the SiYuan app execution alias is enabled in Windows and%LOCALAPPDATA%\Microsoft\WindowsAppsis inPATH. The commands above show command resolution; multiple SiYuan editions orPATH` order may select another executable
If you created the old siyuan.cmd shim, first verify the Store alias directly with & "$env:LOCALAPPDATA\Microsoft\WindowsApps\siyuan.exe" --help, then optionally remove the shim: Remove-Item "$env:LOCALAPPDATA\Microsoft\WindowsApps\siyuan.cmd"
- macOS: create a symlink after installing:
bash
ln -s /Applications/SiYuan.app/Contents/Resources/kernel/SiYuan-Kernel /usr/local/bin/siyuan
- Linux: create a symlink after installing:
bash
ln -s <install-dir>/resources/kernel/SiYuan-Kernel /usr/local/bin/siyuan
See Development Guide.
The data is saved in the workspace data folder:
assets is used to save all inserted assetsemojis is used to save emoji imagessnippets is used to save code snippetsstorage is used to save query conditions, layouts and flashcards, etc.templates is used to save template snippetswidgets is used to save widgetsplugins is used to save pluginspublic is used to save public data.sy documents as JSON; encrypted notebooks store them as ciphertext.Data synchronization through third-party synchronization disks is not supported, otherwise data may be corrupted.
Although it does not support third-party sync disks, it supports connecting with third-party cloud storage (Members' privileges).
SiYuan is completely open source, and contributions are welcome:
For more details, please refer to Development Guide.
You can Check update in Settings - About - Current Version, or pay attention to Official Download or GitHub Releases to get the new version.
Note: Keep your workspace outside the installation directory; updating SiYuan clears files in the installation directory.
The block icon is omitted for the first sub-block under the list item. You can move the cursor into this block and trigger its block menu with Ctrl+/ .
The data repo key protects snapshots and sync data. It is separate from the encrypted-notebook master password and key backups. Resetting the data repo cannot recover a lost master password or replace matching encryption key backups.
Before resetting, exit SiYuan normally and back up the complete workspace. If you have encrypted notebooks, also keep separate, matching encryption key backups and confirm that the master password works. Delete old cloud sync directories and snapshots only after the new sync completes, data is verified, and recovery materials are safely preserved.
Most features are free, even for commercial use.
Member's privileges can only be used after payment, please refer to Pricing.
The birth of SiYuan is inseparable from many open source projects and contributors. Please refer to the project source code kernel/go.mod, app/package.json and project homepage.
The growth of SiYuan is inseparable from user feedback and promotion. Thank you, everyone, for your help with SiYuan ❤️
Welcome to join us and contribute code to SiYuan together.
| 日期 | 榜单 | 排名 | 周期新增 | 总 STAR |
|---|