oxvcms

Headless CMS by OXVLO.

Features

• Admin app served by the CMS itself: sign in with email or username, collapsible sidebar, home with latest posts and shortcuts
• Posts with a rich-text editor and SEO tools: meta title and description with counters, search-result preview, live SEO checklist, Open Graph and Twitter fields, canonical URL, robots and structured-data type
• Review workflow: authors write and submit, moderators and super admins publish
• Categories (nested) and tags
• Flexible lists with a gear menu for columns, rows per page and density
• Account settings: profile, change password, sign out of all devices
• API on Fastify 5 with PostgreSQL and SQL migrations
• Authentication with server-side sessions (httpOnly, SameSite=Strict cookie) and scrypt password hashing
• Roles: author, moderator, super admin, with deny-by-default role guards
• Security: CSRF protection, login lockout with backoff, rate limits, security headers, strict content security policy for the admin, strict input validation, safe HTML rendering of post content, audit log
• CLI: dev, start, migrate, user:create
• Health check endpoint for deployments

How to Run

Requirements: Node.js >= 22.18, a PostgreSQL 16+ database.

The quickest way is the scaffolder: npm create oxvcms@latest my-site. To set it up by hand:

mkdir my-site && cd my-site
npm init -y && npm pkg set type=module
npm install oxvcms

Create .env:

DATABASE_URL=postgres://localhost:5432/my_site
OXV_SESSION_SECRET=            # at least 32 characters

Optionally create oxvcms.config.ts:

export default {
  siteName: "My Site",
  siteUrl: "http://localhost:3000",
  corsOrigins: ["http://localhost:3000"],
};

Then:

npx oxvcms migrate
npx oxvcms user:create          # first super admin (email, username, name, password)
npx oxvcms dev                  # then open http://localhost:7777 and sign in

The server listens on 127.0.0.1:7777 by default (HOST and PORT change that). GET /api/health is the health check.

License

MIT