oCMS

A lightweight content management system built with Go, featuring a modern admin interface, session-based authentication, SQLite storage, and extensible architecture with themes and modules.

Features

Content Management

Page Management: Create, edit, publish, and version pages with a rich content editor
Video Embedding: Embed YouTube, Vimeo, and Dailymotion videos in pages with responsive rendering
Scheduled Publishing: Schedule pages to publish at a future date/time
Media Library: Upload and manage images, documents, and videos with automatic image processing
- Automatic thumbnail and variant generation
- Folder organization
- Featured image support for pages
Menu Builder: Create navigation menus with drag-and-drop ordering
- Hierarchical menu structures
- Link to pages or external URLs
- Multiple menu locations
Full-Text Search: Built-in SQLite FTS5 search for fast content discovery

Taxonomy

Categories: Organize content with hierarchical categories
Tags: Add flat taxonomy tags to pages

Forms

Form Builder: Create contact forms, surveys, and data collection forms
- Multiple field types (text, email, textarea, select, checkbox, radio)
- Form submissions management
- Read/unread status tracking
- Email notifications

Theme System

Multiple Themes: Switch between different frontend themes
Theme Settings: Configurable theme options (colors, layout, etc.)
Template Override: Themes can customize page templates
Static Assets: Theme-specific CSS, JavaScript, and images

Module System

Extensible Architecture: Add custom functionality via modules
Module Lifecycle: Init, routes, admin routes, and shutdown hooks
Module Migrations: Modules can have their own database migrations
Template Functions: Modules can add custom template functions
Active Status Toggle: Enable/disable modules from admin UI without restart
Module Translations: Modules can embed their own i18n locale files

REST API

Full CRUD API: Complete REST API for pages, media, tags, and categories
API Key Authentication: Secure API access with bearer token authentication
Permission-Based Access: Fine-grained permissions (read/write per resource)
Rate Limiting: Per-key and global rate limiting
API Documentation: Built-in API documentation page

SEO

Meta Tags: Custom title, description, and keywords per page
Open Graph: Full Open Graph and Twitter Card support
Sitemap: Auto-generated sitemap.xml
Robots.txt: Configurable robots.txt generation
Canonical URLs: Set canonical URLs to avoid duplicate content
NoIndex/NoFollow: Control search engine indexing per page

Administration

User Management: Role-based access control (admin/editor)
Authentication: Secure session-based authentication with argon2id password hashing
Event Logging: Comprehensive audit trail for all actions
Admin Dashboard: Modern responsive UI with HTMX and Alpine.js
- Statistics overview
- Recent submissions widget
- Quick actions
- Collapsible sidebar with persistent state
Cache Management: View cache stats and clear cache
API Key Management: Create and manage API keys
Bulk List Actions: Multi-select and bulk delete/revoke on paged admin lists (pages, tags, users, API keys, media, and form submissions)
Per-Page Selector: Choose items per page on delete-capable admin lists (URL query per_page, current-page state in URL only)
List Sorting: Sort delete-capable admin lists by safe whitelisted columns with clear active sort highlighting (URL queries sort + dir)
SQLite Database: Zero-configuration embedded database with migrations

Multi-Language Support

Content Translation: Translate pages, categories, and tags into multiple languages
Language Management: Configure site languages with ISO 639-1 codes
Translation Linking: Link content across languages for seamless switching
Language Switcher: Built-in frontend component for language navigation
URL Prefixes: Language-prefixed URLs (e.g., /ru/about-us)
RTL Support: Right-to-left language support
Admin UI Localization: Translatable admin interface (English + Russian included)

Webhooks

Event System: Trigger webhooks on content events (create, update, delete, publish)
Delivery Tracking: Monitor delivery status and response codes
Retry Logic: Exponential backoff retry for failed deliveries
HMAC Signatures: Secure payloads with HMAC-SHA256 signatures
Custom Headers: Add custom headers to webhook requests
Dead Letter Queue: Track permanently failed deliveries
Event Debouncing: Coalesce rapid-fire events to reduce webhook noise

Import/Export

JSON Export: Export site content to portable JSON format
ZIP Export: Include media files in export archives
Selective Export: Choose which content types to include
JSON Import: Import content from JSON files
ZIP Import: Restore media files from archives
Conflict Resolution: Skip, overwrite, or rename on conflicts
Dry Run Mode: Preview import changes before applying

Performance

Multi-Level Caching: In-memory and optional Redis caching
Redis Support: Distributed caching for multi-instance deployments
Response Compression: Gzip compression for HTML and JSON responses
Graceful Shutdown: Clean shutdown with request draining
Health Check: /health endpoint for monitoring

Prerequisites

Go 1.26 or later
Node.js (npm) for frontend dependencies
sqlc for SQL code generation
templ for type-safe HTML templates
goose for database migrations
Dart Sass for SCSS compilation
libvips for image processing (required for media library)

Installing libvips

macOS:

brew install vips

Ubuntu/Debian:

sudo apt-get install libvips-dev

Fedora:

sudo dnf install vips-devel

Installation

Clone the repository:

git clone https://github.com/olegiv/ocms-go.git
cd ocms-go

Install dependencies:
```
go mod download
```

Install required tools:

go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
go install github.com/a-h/templ/cmd/templ@latest
go install github.com/pressly/goose/v3/cmd/goose@latest

Generate code:
```
sqlc generate
templ generate
```
Build assets (installs npm dependencies and compiles SCSS):
```
make assets
```

Environment Variables

Variable	Description	Default	Required
`OCMS_SESSION_SECRET`	Secret key for session encryption (min 32 bytes)	-	Yes
`OCMS_DB_PATH`	Path to SQLite database file	`./data/ocms.db`	No
`OCMS_SERVER_HOST`	Server host address	`localhost`	No
`OCMS_SERVER_PORT`	Server port number	`8080`	No
`OCMS_ENV`	Environment mode (`development`/`production`)	`development`	No
`OCMS_LOG_LEVEL`	Log level (`debug`/`info`/`warn`/`error`)	`info`	No
`OCMS_CUSTOM_DIR`	Directory for custom themes and modules	`./custom`	No
`OCMS_ACTIVE_THEME`	Active theme (overrides DB/admin setting)	`default`	No
`OCMS_DO_SEED`	Seed database with default admin and config	`false`	No
`OCMS_CACHE_TTL`	Default cache TTL in seconds	`3600`	No
`OCMS_REDIS_URL`	Redis URL for distributed caching	-	No
`OCMS_CACHE_PREFIX`	Redis key prefix	`ocms:`	No
`OCMS_CACHE_MAX_SIZE`	Max entries for in-memory cache	`10000`	No
`OCMS_HCAPTCHA_SITE_KEY`	hCaptcha site key for login protection	-	No
`OCMS_HCAPTCHA_SECRET_KEY`	hCaptcha secret key for login protection	-	No
`OCMS_HCAPTCHA_DISABLED`	Force-disable hCaptcha regardless of database settings	`false`	No
`OCMS_GEOIP_DB_PATH`	Path to GeoLite2-Country.mmdb for country detection	-	No
`OCMS_UPLOADS_DIR`	Directory for uploaded media files	`./uploads`	No
`OCMS_TRUSTED_PROXIES`	Trusted reverse-proxy CIDRs/IPs; forwarding headers are ignored unless peer is trusted	-	No
`OCMS_REQUIRE_TRUSTED_PROXIES`	Fail startup in production if trusted proxy CIDRs/IPs are not configured	`false` (`true` in production when unset)	No
`OCMS_API_ALLOWED_CIDRS`	Global source CIDRs/IPs allowed to use API keys	-	No
`OCMS_REQUIRE_API_ALLOWED_CIDRS`	Fail API key auth when global API source CIDRs are not configured	`false` (`true` in production when unset)	No
`OCMS_REQUIRE_API_KEY_EXPIRY`	Require API keys to have expiration timestamps	`false` (`true` in production when unset)	No
`OCMS_REQUIRE_API_KEY_SOURCE_CIDRS`	Require API keys to have per-key source CIDR restrictions	`false` (`true` in production when unset)	No
`OCMS_REVOKE_API_KEY_ON_SOURCE_IP_CHANGE`	Deactivate API keys when source IP changes and the key has no per-key CIDRs	`false` (`true` in production when unset)	No
`OCMS_API_KEY_MAX_TTL_DAYS`	Maximum API key lifetime in days (`0` disables, max `365`)	`0` (`90` in production when unset)	No
`OCMS_EMBED_ALLOWED_ORIGINS`	Allowed browser origins for public embed proxy routes; required for working browser embed requests in production	-	No
`OCMS_EMBED_ALLOWED_UPSTREAM_HOSTS`	Allowed upstream hosts for embed provider API endpoints	-	No
`OCMS_REQUIRE_EMBED_ALLOWED_ORIGINS`	Fail startup in production if embed proxy is active without origin allowlist	`false` (`true` in production when unset)	No
`OCMS_REQUIRE_EMBED_ALLOWED_UPSTREAM_HOSTS`	Fail startup in production if embed proxy is active without upstream host allowlist	`false` (`true` in production when unset)	No
`OCMS_EMBED_PROXY_TOKEN`	Secret used to mint short-lived signed embed proxy tokens; required for active embed proxy in production	-	No
`OCMS_REQUIRE_EMBED_PROXY_TOKEN`	Enforce embed proxy token requirement in non-production too	`false`	No
`OCMS_REQUIRE_HTTPS_OUTBOUND`	Require HTTPS for outbound integration URLs	`false` (`true` in production when unset)	No
`OCMS_REQUIRE_FORM_CAPTCHA`	Require captcha on all public form submissions	`false` (`true` in production when unset)	No
`OCMS_WEBHOOK_FORM_DATA_MODE`	`form.submitted` payload data mode (`redacted`/`none`/`full`)	`redacted`	No
`OCMS_REQUIRE_WEBHOOK_FORM_DATA_MINIMIZATION`	Fail startup in production when form webhook payload mode is `full`	`false` (`true` in production when unset)	No
`OCMS_WEBHOOK_ALLOWED_HOSTS`	Allowed destination hosts for active webhook deliveries (exact hostname match)	-	No
`OCMS_REQUIRE_WEBHOOK_ALLOWED_HOSTS`	Fail startup in production when active webhooks exist without destination host allowlist	`false` (`true` in production when unset)	No
`OCMS_SANITIZE_PAGE_HTML`	Sanitize page HTML before rendering to visitors	`false` (`true` in production when unset)	No
`OCMS_REQUIRE_SANITIZE_PAGE_HTML`	Fail startup in production if page HTML sanitization is disabled	`false` (`true` in production when unset)	No
`OCMS_BLOCK_SUSPICIOUS_PAGE_HTML`	Reject page writes containing suspicious HTML patterns	`false` (`true` in production when unset)	No
`OCMS_REQUIRE_BLOCK_SUSPICIOUS_PAGE_HTML`	Fail startup in production when suspicious page markup blocking is disabled or existing pages contain suspicious markers	`false` (`true` in production when unset)	No
`OCMS_DEMO_MODE`	Enable demo content seeding (users, pages, media)	`false`	No

Development

Quick Start

# Set required environment variable
export OCMS_SESSION_SECRET="your-secret-key-at-least-32-bytes"

# Install repository-managed git hooks (run once per clone)
make install-hooks

# Run with asset compilation
make dev

# Or run without rebuilding assets
make run

Available Make Commands

Command	Description
`make dev`	Build assets and run development server
`make run`	Run development server (no asset build)
`make stop`	Stop development server on port 8080
`make restart`	Stop and restart development server
`make build`	Build binary to `bin/ocms`
`make build-prod`	Build optimized binary (stripped, trimmed)
`make build-linux-amd64`	Cross-compile for Linux AMD64
`make build-darwin-arm64`	Cross-compile for macOS ARM64
`make build-all-platforms`	Build for Linux AMD64 and macOS ARM64
`make test`	Run all tests
`make clean`	Remove build artifacts
`make clean-db`	Remove database files
`make migrate-up`	Apply pending migrations
`make migrate-down`	Rollback last migration
`make migrate-status`	Show migration status
`make migrate-create`	Create new migration file
`make assets`	Install npm deps and compile SCSS
`make sqlc`	Regenerate sqlc code from SQL queries
`make templ`	Regenerate templ Go code from `.templ` files
`make deploy-binary`	Deploy binary to remote server (no custom content)
`make commit-prepare`	Proxy to Claude slash command `/commit-prepare`
`make commit-do`	Proxy to Claude slash command `/commit-do`
`make code-quality`	Proxy to Claude slash command `/code-quality`
`make security-audit`	Proxy to Claude slash command `/security-audit`
`make commit-prepare-local`	Run local commit-prepare shell script
`make commit-do-local`	Run local commit-do shell script
`make code-quality-local`	Run local code quality shell script (`golangci-lint`, `nilaway`, `go test`)
`make security-audit-local`	Run local security audit shell script (writes to `.audit/`)
`make install-hooks`	Configure git to use repository-managed hooks from `.githooks`
`make check-no-absolute-paths`	Fail if tracked files contain local absolute paths (`/Users/...`, `/home/...`, `C:\Users\...`)

Default Admin Credentials

On first run with OCMS_DO_SEED=true, the application seeds a default admin user:

Email: admin@example.com
Password: changeme1234

Change these credentials immediately after first login.

Demo Mode

With OCMS_DEMO_MODE=true (requires OCMS_DO_SEED=true), additional demo content is seeded including sample pages, categories, tags, media, and menu items. Two demo users are created:

Admin: demo@example.com / demo1234demo
Editor: editor@example.com / demo1234demo

See docs/demo-deployment.md for Fly.io deployment and demo configuration details.

Docker

Quick Start with Docker

# Clone the repository
git clone https://github.com/olegiv/ocms-go.git
cd ocms-go

# Start with Docker Compose (generates session secret automatically)
OCMS_SESSION_SECRET=$(openssl rand -base64 32) OCMS_DO_SEED=true docker compose up -d

# View logs
docker compose logs -f ocms

Access the admin panel at http://localhost:8080/admin with:

Email: admin@example.com
Password: changeme1234

Docker Commands

Command	Description
`docker compose up -d`	Start oCMS
`docker compose --profile redis up -d`	Start with Redis caching
`docker compose down`	Stop services
`docker compose logs -f ocms`	View logs
`docker compose pull && docker compose up -d`	Update to latest

Volume Mounts

Volume	Container Path	Purpose
`ocms_data`	`/app/data`	SQLite database
`ocms_uploads`	`/app/uploads`	Media uploads
`./custom`	`/app/custom`	Custom themes and modules

Building the Docker Image

# Build with version info
docker build \
  --build-arg VERSION=$(git describe --tags --always) \
  --build-arg GIT_COMMIT=$(git rev-parse --short HEAD) \
  --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
  -t ocms:latest .

Production Configuration

Create a .env file for production:

OCMS_SESSION_SECRET=your-secure-secret-key-at-least-32-bytes
OCMS_ENV=production
OCMS_DO_SEED=false
OCMS_ACTIVE_THEME=default
OCMS_TRUSTED_PROXIES=127.0.0.1/32,10.0.0.0/8
OCMS_API_ALLOWED_CIDRS=203.0.113.0/24

# Hardened embed proxy baseline (when embed module/provider is enabled)
# Origin matching is exact (scheme + host). Include all real hostnames.
OCMS_EMBED_ALLOWED_ORIGINS=https://example.com,https://www.example.com
OCMS_EMBED_ALLOWED_UPSTREAM_HOSTS=api.dify.ai
OCMS_REQUIRE_EMBED_ALLOWED_ORIGINS=true
OCMS_REQUIRE_EMBED_ALLOWED_UPSTREAM_HOSTS=true
OCMS_EMBED_PROXY_TOKEN=replace-with-embed-proxy-token
OCMS_WEBHOOK_ALLOWED_HOSTS=hooks.example.com,events.example.com

# Required when OCMS_REQUIRE_FORM_CAPTCHA is enabled (enabled by default in production)
OCMS_HCAPTCHA_SITE_KEY=your-site-key
OCMS_HCAPTCHA_SECRET_KEY=your-secret-key

# Optional: Redis caching
OCMS_REDIS_URL=redis://redis:6379/0

Then start with:

docker compose --profile redis up -d

Project Structure

ocms-go/
├── cmd/ocms/             # Application entry point
├── docs/                 # Documentation
│   ├── multi-language.md # Multi-language guide
│   ├── webhooks.md       # Webhooks configuration
│   ├── import-export.md  # Import/export guide
│   └── reverse-proxy.md  # Nginx/Apache/NPM setup
├── internal/
│   ├── auth/             # Password hashing utilities
│   ├── cache/            # Caching layer (memory + Redis)
│   ├── config/           # Configuration loading
│   ├── handler/          # HTTP handlers
│   │   └── api/          # REST API handlers
│   ├── i18n/             # Internationalization (admin UI)
│   ├── imaging/          # Image processing (thumbnails, variants)
│   ├── middleware/       # HTTP middleware (auth, API, rate limiting)
│   ├── model/            # Domain models
│   ├── module/           # Module system (registry, hooks)
│   ├── render/           # Template rendering
│   ├── scheduler/        # Cron-based task scheduler
│   ├── seo/              # SEO utilities (sitemap, robots.txt, meta)
│   ├── service/          # Business logic (media, menus, forms)
│   ├── session/          # Session management
│   ├── store/            # Database layer (sqlc generated)
│   │   ├── migrations/   # Goose SQL migrations
│   │   └── queries/      # sqlc query definitions
│   ├── theme/            # Theme loading and management
│   ├── themes/           # Embedded core themes (default, developer)
│   ├── transfer/         # Import/export functionality
│   ├── util/             # Utility functions (slug generation)
│   └── webhook/          # Webhook system
├── modules/              # Custom modules directory
│   └── example/          # Example module implementation
├── custom/               # User content directory (gitignored)
│   ├── themes/           # Custom themes (override or extend core)
│   └── modules/          # Custom modules (future use)
├── web/
│   ├── static/           # Static assets (CSS, JS)
│   │   └── scss/         # SCSS source files
│   └── templates/        # HTML templates
│       ├── admin/        # Admin panel templates
│       ├── api/          # API documentation templates
│       ├── auth/         # Login/logout templates
│       ├── errors/       # Error pages (404, 403, 500)
│       ├── layouts/      # Base layouts
│       └── partials/     # Reusable components
├── uploads/              # Media uploads directory
├── scripts/              # Build scripts
├── Makefile              # Development commands
├── package.json          # npm dependencies (htmx, alpine.js)
└── sqlc.yaml             # sqlc configuration

REST API

The CMS provides a RESTful API for programmatic access to content.

Authentication

API requests require a Bearer token in the Authorization header:

curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/v2/pages

Create API keys in the admin panel under Settings > API Keys.

The REST surface is /api/v2. The OpenAPI 3.1 spec is generated from Go types via huma and served live at /api/v2/openapi.json (or .yaml). Swagger UI is available at /api/v2/docs.

Endpoints

Method	Endpoint	Description	Auth
GET	`/api/v2/status`	API status	Public
GET	`/api/v2/auth`	Inspect the calling API key	Required
GET	`/api/v2/pages`	List pages	Optional
GET	`/api/v2/pages/{id}`	Get page by ID	Optional
GET	`/api/v2/pages/slug/{slug}`	Get page by slug	Optional
POST	`/api/v2/pages`	Create page	Required
PUT	`/api/v2/pages/{id}`	Update page	Required
DELETE	`/api/v2/pages/{id}`	Delete page	Required
GET	`/api/v2/media`	List media	Optional
GET	`/api/v2/media/{id}`	Get media by ID	Optional
POST	`/api/v2/media`	Upload a single file	Required
POST	`/api/v2/media/batch`	Upload multiple files	Required
PUT	`/api/v2/media/{id}`	Update media metadata	Required
DELETE	`/api/v2/media/{id}`	Delete media	Required
GET	`/api/v2/tags`	List tags	Public
POST	`/api/v2/tags`	Create tag	Required
PUT	`/api/v2/tags/{id}`	Update tag	Required
DELETE	`/api/v2/tags/{id}`	Delete tag	Required
GET	`/api/v2/categories`	List categories (tree or flat)	Public
POST	`/api/v2/categories`	Create category	Required
PUT	`/api/v2/categories/{id}`	Update category	Required
DELETE	`/api/v2/categories/{id}`	Delete category	Required
GET	`/api/v2/openapi.json`	OpenAPI 3.1 spec (JSON)	Public
GET	`/api/v2/openapi.yaml`	OpenAPI 3.1 spec (YAML)	Public
GET	`/api/v2/docs`	Swagger UI	Public
GET	`/health`	Health check	Public

Response Format

{
  "data": { ... },
  "meta": {
    "total": 100,
    "page": 1,
    "per_page": 20
  }
}

Error Format

{
  "error": {
    "code": "validation_error",
    "message": "Validation failed",
    "details": { "title": "Title is required" }
  }
}

Theme Development

Core themes (default, developer) are embedded in the binary. To create a custom theme, add a directory in custom/themes/:

custom/themes/my-theme/
├── theme.json          # Theme configuration
├── templates/
│   ├── layouts/
│   │   └── base.html   # Base layout
│   ├── pages/
│   │   ├── home.html   # Homepage template
│   │   ├── page.html   # Single page template
│   │   └── 404.html    # Not found page
│   └── partials/
│       ├── header.html
│       └── footer.html
└── static/
    ├── css/
    └── js/

To override an embedded theme, create a custom theme with the same name:

custom/themes/default/    # Overrides the embedded 'default' theme

Custom themes with the same name as core themes take priority.

theme.json

{
  "name": "My Theme",
  "version": "1.0.0",
  "author": "Your Name",
  "description": "A custom theme",
  "settings": [
    {
      "key": "primary_color",
      "label": "Primary Color",
      "type": "color",
      "default": "#3b82f6"
    }
  ]
}

Module Development

Create custom modules to extend functionality:

package mymodule

import (
    "database/sql"
    "embed"

    "github.com/olegiv/ocms-go/internal/module"
    "github.com/go-chi/chi/v5"
)

//go:embed locales
var localesFS embed.FS

type MyModule struct {
    module.BaseModule
}

func New() *MyModule {
    return &MyModule{
        BaseModule: module.NewBaseModule("mymodule", "1.0.0", "My custom module"),
    }
}

func (m *MyModule) RegisterRoutes(r chi.Router) {
    r.Get("/my-endpoint", m.handleEndpoint)
}

func (m *MyModule) Migrations() []module.Migration {
    return []module.Migration{
        {
            Version:     1,
            Description: "Create my_table",
            Up: func(db *sql.DB) error {
                _, err := db.Exec("CREATE TABLE my_table (...)")
                return err
            },
        },
    }
}

// TranslationsFS returns embedded locale files for i18n support
func (m *MyModule) TranslationsFS() embed.FS {
    return localesFS
}

Add self-registration in register.go:

package mymodule

import "github.com/olegiv/ocms-go/internal/module"

func init() {
    module.RegisterCustomModule(New())
}

Then add a blank import to custom/modules/imports.go:

_ "github.com/olegiv/ocms-go/custom/modules/mymodule"

See docs/custom-modules.md for the full guide and custom/modules/bookmarks/ for a working example.

Module Translations

Modules can embed their own translation files:

mymodule/
├── module.go
├── handlers.go
└── locales/
    ├── en/
    │   └── messages.json
    └── ru/
        └── messages.json

Translation keys should be prefixed with the module name (e.g., mymodule.title).

Module Active Status

Modules can be enabled/disabled from the admin UI at Admin > Modules. When a module is disabled:

Public routes return 404
Admin routes redirect to the modules list
Template functions are not registered
The module remains initialized but inactive

Testing

Run all tests:

OCMS_SESSION_SECRET=test-secret-key-32-bytes-long!! go test ./...

Run tests with verbose output:

OCMS_SESSION_SECRET=test-secret-key-32-bytes-long!! go test -v ./...

Run tests for a specific package:

OCMS_SESSION_SECRET=test-secret-key-32-bytes-long!! go test -v ./internal/store/...

Check for vulnerabilities:

govulncheck ./...

Wiki

Project documentation is published at the GitHub Wiki and managed as a git submodule at wiki/.

Editing Wiki Pages

# Edit a page
vim wiki/Getting-Started.md

# Publish changes
/update-wiki

# Or manually:
cd wiki
git add -A && git commit -m "Update page" && git push
cd ..
git add wiki
git commit -m "Update wiki submodule"

Cloning with Wiki

git clone --recurse-submodules https://github.com/olegiv/ocms-go.git

Claude Code Support Tools

This project uses a shared submodule at .claude/shared containing reusable Claude Code extensions:

Agents: security-auditor, project-architect, code-quality-auditor
Commands: commit-prepare, commit-do, security-audit, setup-project-tools
Global config: CLAUDE.md rules and settings.json templates

Updating the Submodule

To update the shared Claude Code tools to the latest version:

# Using the slash command (recommended)
/update-submodule

# Or manually
git submodule update --remote --merge

If you are using Codex, Claude slash commands are not registered in the Codex UI and may show No commands. Use shell/make commands directly, or ask Codex in chat to run them.

You can run slash-command equivalents through Claude CLI:

claude -p "/commit-prepare" --dangerously-skip-permissions
claude -p "/commit-do" --dangerously-skip-permissions
claude -p "/code-quality" --dangerously-skip-permissions
claude -p "/security-audit" --dangerously-skip-permissions

Codex wrapper commands (Claude proxy by default):

./scripts/codex-commands code-quality
./scripts/codex-commands security-audit
./scripts/codex-commands commit-prepare
./scripts/codex-commands commit-do

# Explicit local fallback scripts
./scripts/codex-commands code-quality-local
./scripts/codex-commands security-audit-local
./scripts/codex-commands commit-prepare-local
./scripts/codex-commands commit-do-local

After updating, stage and commit the submodule change if you want to keep it:

git add .claude/shared
git commit -m "Update Claude Code shared submodule"

Technology Stack

Backend: Go 1.26+
Database: SQLite with goose migrations
SQL: Type-safe queries with sqlc
Templates: templ for type-safe HTML
Frontend: HTMX + Alpine.js
Rich Text Editor: TinyMCE for content editing
Styling: Custom SCSS framework
Authentication: Secure sessions with argon2id password hashing
Containerization: Docker with multi-stage builds

License

GNU General Public License v3.0 - see LICENSE file for details.

Name		Name	Last commit message	Last commit date
Latest commit History 1,247 Commits
.claude		.claude
.fly		.fly
.githooks		.githooks
.github/workflows		.github/workflows
.schema		.schema
cmd/ocms		cmd/ocms
custom		custom
docs		docs
internal		internal
modules		modules
scripts		scripts
web		web
wiki @ 5ad0ffd		wiki @ 5ad0ffd
.codexignore		.codexignore
.dockerignore		.dockerignore
.env.example		.env.example
.env.example.prod		.env.example.prod
.gitignore		.gitignore
.gitmodules		.gitmodules
.golangci.yml		.golangci.yml
.htmlvalidate.json		.htmlvalidate.json
.templui.json		.templui.json
AGENTS.md		AGENTS.md
CHANGELOG.md		CHANGELOG.md
CLAUDE.md		CLAUDE.md
CONTRIBUTING.md		CONTRIBUTING.md
Dockerfile		Dockerfile
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
SECURITY.md		SECURITY.md
docker-compose.yml		docker-compose.yml
docker-entrypoint.sh		docker-entrypoint.sh
fly.toml		fly.toml
go.mod		go.mod
go.sum		go.sum
package-lock.json		package-lock.json
package.json		package.json
sqlc.yaml		sqlc.yaml

Folders and files

Latest commit

History

Repository files navigation

oCMS

Features

Content Management

Taxonomy

Forms

Theme System

Module System

REST API

SEO

Administration

Multi-Language Support

Webhooks

Import/Export

Performance

Prerequisites

Installing libvips

Installation

Environment Variables

Development

Quick Start

Available Make Commands

Default Admin Credentials

Demo Mode

Docker

Quick Start with Docker

Docker Commands

Volume Mounts

Building the Docker Image

Production Configuration

Project Structure

REST API

Authentication

Endpoints

Response Format

Error Format

Theme Development

theme.json

Module Development

Module Translations

Module Active Status

Testing

Wiki

Editing Wiki Pages

Cloning with Wiki

Claude Code Support Tools

Updating the Submodule

Technology Stack

License

About

Topics

Resources

License

Contributing

Security policy

Uh oh!

Stars

Watchers

Forks

Releases 23

Uh oh!

Contributors

Uh oh!

Languages