Go Headless CMS

A minimalist headless CMS built in Go, designed for managing markdown content for static site generators like Zola.

Features

• Authentication: Secure session-based authentication with bcrypt password hashing
• Markdown Support: Edit markdown files with TOML or YAML frontmatter
• Dual Editors: Markdown text editor and frontmatter JSON editor
• File Management: Browse and manage markdown files organized by sections/folders
• Configuration: Flexible configuration via CLI flags, config file, or web interface
• Minimalist UI: Clean, minimal interface with no JavaScript dependencies
• Security: Path traversal protection, HTTP-only cookies, CSRF protection

Quick Start

Using Just (recommended)

# Run with hot reload (recommended for development)
just dev

# Run without hot reload
just run

# Build the binary
just build

# See all available commands
just

Manual Usage

# Run directly
go run cmd/server/main.go

# Build
go build -o bin/cms cmd/server/main.go

# Run the binary
./bin/cms

Configuration

CLI Flags

-port         HTTP server port (default: 8080)
-content      Content directory path (default: ./content)
-config       Config file path (default: config.json)
-admin-user   Admin username
-admin-pass   Admin password
-session-key  Session encryption key

Config File

The CMS can be configured via a config.json file:

{
  "port": 8080,
  "content_dir": "/path/to/content",
  "admin_user": "admin",
  "admin_pass": "yourpassword"
}

Default Credentials

• Username: admin
• Password: changeme

⚠️ Change these immediately in production!

Usage

1. Start the server:

   just run
   

2. Open your browser to http://localhost:8080

3. Login with the default credentials

4. Browse your markdown files and click "Edit" to modify them

5. Edit frontmatter (as JSON) and content (as Markdown)

6. Click "Save" to write changes back to disk

Project Structure

.
├── cmd/
│   └── server/          # Main application entry point
│       └── main.go
├── internal/
│   ├── auth/            # Authentication and session management
│   ├── config/          # Configuration handling
│   ├── content/         # Markdown and frontmatter parsing
│   └── handlers/        # HTTP handlers
├── templates/           # HTML templates
│   ├── base.html
│   ├── login.html
│   ├── dashboard.html
│   ├── editor.html
│   └── settings.html
├── static/
│   └── css/
│       └── style.css    # Minimalist styling
├── content/             # Your markdown content (default)
└── justfile             # Build automation

Security Features

• Bcrypt password hashing
• Session-based authentication with secure cookies
• HTTP-only and SameSite cookie flags
• Path traversal attack prevention
• Session expiration and cleanup
• Secure session key generation

Frontmatter Support

TOML (Zola style)

+++
title = "My Post"
date = 2024-01-15
draft = false
+++

Your content here...

YAML

---
title: My Post
date: 2024-01-15
draft: false
---

Your content here...

Development

The project uses Air for hot reloading during development.

# Run with hot reload (automatically restarts on file changes)
just dev

# Install dependencies
just deps

# Format code
just fmt

# Run linter
just lint

# Run tests
just test

Building for Production

# Build optimized binary
just release

# Build for multiple platforms
just build-all

License

MIT