en
Español
Slovenčina
Deutsch
Français
Italiano
Português
Polski
Čeština
Nederlands
Română
Magyar
Svenska
Ελληνικά
БългарскиInstall the Total.js CMS and sign in the first time
Run it
The CMS needs Node.js and nothing else: no database, no external service.
git clone https://github.com/totaljs/cms.git
cd cms
npm install
npm run startnpm run start runs node index.js 8000; the port is optional and the default is 8000. With Docker:
docker pull totalplatform/cms
docker run -p 8000:8000 totalplatform/cmsThe first sign-in
At the first start the CMS creates its only administrator with a random login and password. Open http://localhost:8000/admin/: until the first successful sign-in the page shows them in a box with a button that fills in the form. After that the plain copy of the password is deleted from the preferences and the box no longer appears, so use the profile of the admin right away to set a login and password of your own, and do the first sign-in as soon as you start a new installation.
Until you create the first page, the address / redirects to /admin/ while the password is still the generated one; once a page with the address / exists, / serves your site.
Three ways to authenticate the admin
The admin lives under the address of the line $api : /admin/ of the file config. The function AUTH of definitions/auth.js decides for the requests of that path:
| Mode | When | How |
|---|---|---|
| Session | the default | a cookie encrypted with the salt of the account; the login and password are checked with SHA-256 and that salt |
| Token | the line token : <value> exists in config | send it in the header x-token: the request runs as a built-in user called Bot, an administrator (sa). Ten wrong attempts block the address, and a wrong token gets no answer at all (the request ends with a timeout) |
| OpenPlatform | the settings hold op_reqtoken and op_restoken | people sign in with OpenPlatform and its groups decide the permissions pages, layouts, widgets, navigation, posts, files, redirects, variables, settings and admin |
The public pages use the function FUNC.auth if your code defines it (see pages, layouts and navigation); without it every visitor is anonymous.
Where the data lives
| Place | What it holds |
|---|---|
databases/config.json | generated values of the installation |
databases/memorize_account.json | the administrator: name, login, password hash, cookie name and salt |
databases/fs-db/ | the file storage: the metadata of the site (pages, layouts, widgets, navigation, redirects, variables, configuration) and the HTML of every page and layout, the uploaded files and the posts |
To move the site, copy the databases/ folder, or use the backup of the admin (the admin API).