@velora-cms/server

The Velora CMS server: a Fastify API, the admin UI (mounted at /velora), and a browser-based setup wizard for first-run configuration.

Quick start

npm i @velora-cms/server
npx velora-server

Then open http://localhost:3000/velora and finish setup in the browser. The wizard walks you through choosing a database (PostgreSQL, MySQL, or SQLite) and creating the first admin account — no config file required before you start it.

The wizard's first-run flow does not itself set JWT_SECRET, and the server refuses to boot in full (configured) mode without one. Before you restart the server after finishing the wizard, create (or extend) a .env file in the directory you run velora-server from — the env file is resolved relative to the process's current working directory — with at least:

JWT_SECRET=<64 hex characters, e.g. output of `openssl rand -hex 32`>

DATABASE_URL is written into the same file by the wizard automatically; you don't need to add it by hand.

Environment variables

| Variable | Required | Description | | ----------------- | ------------------- | ----------------------------------------------------------------------------------------- | | PORT | No (default 3000) | Port the server listens on. | | HOST | No (default 127.0.0.1) | Interface the server binds to. Set to 0.0.0.0 in containers/VPS deployments so the server is reachable from outside the container/host. | | DATABASE_URL | No, before wizard | Connection string for the content database. Can be set later via the wizard. | | JWT_SECRET | Yes | Secret used to sign admin session and preview tokens. | | VELORA_ADMIN | No (default on) | Set to off to disable the /velora admin UI entirely. | | VELORA_HEADLESS | No (default off) | Set to true/1 to additionally register the public /api/v1 content API namespace. Does not disable the admin UI — use VELORA_ADMIN=off for that. |

Embedding

@velora-cms/server also exports a createApp function that prepares the database exactly like the velora-server bin does — env file load, DATABASE_URL normalization, Prisma-client self-heal, core migrations — and returns the built Fastify instance. Listening is left to the caller:

import { createApp } from "@velora-cms/server";

const app = await createApp();
await app.listen({ port: 3000 });

The embedded app still needs JWT_SECRET set once you've configured a database (see above). Media uploads default to local disk storage (under MEDIA_DIR, ./media if unset) — no S3 endpoint required. Setting MEDIA_STORAGE=s3, or setting any of S3_ENDPOINT, S3_REGION, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, or S3_BUCKET, switches media storage to an S3-compatible bucket instead.

Docs

Full documentation, guides, and the API reference live at docs.velora-cms.com.

Source & support

Velora's source is not public. Questions and bug reports: velora-starter. Docs at https://docs.velora-cms.com. Licensed Apache-2.0.