LessHeadCMS Files

LessHeadCMS v0.1.0 — Initial public release

The headless CMS for the rest of us

LessHeadCMS turns a PlantUML class diagram into a working headless CMS: a PHP/SQLite backend (FlightPHP) with a REST API, plus a Preact-based editorial UI — built to run on cheap PHP shared hosting with no server-side build step required at runtime.

It's designed to be small, powerful.

This is the first public release. Versioning starts at 0.1.0 rather than 1.0.0: the project is functionally complete but hasn't yet been exercised by outside users, so the API and data format may still see breaking changes before a 1.0.0 stability commitment.

Highlights

• Diagram-driven schema: define entities, fields, and relationships in a .puml file; the CMS generates the SQLite schema and a tailored editorial UI automatically.
• Edit schema without resetting the database: apply changes to an already-populated installation — new fields, renamed fields/classes, type changes, and table restructuring — with diff preview, data-loss warnings, required backfill values, and full transaction safety (all-or-nothing rollback).
• Roles & permissions: additive, "deny always wins" model with entity/field/action/system-table scopes, roles, groups, and per-user overrides, plus a full admin UI (not just the API).
• Workflows: define approval states and transitions in a separate workflow file (draft → review → published, etc.), enforced server-side — state can only change through a dedicated transition endpoint, never a plain field edit — with a "My Tasks" view for assigned users.
• API users & API keys: a dedicated, passwordless API role with bearer-token authentication, per-user read-only override, and an admin-configurable setting to require authentication even for public GET reads.
• Server-side pagination & indexing: all list endpoints are paginated by default, with automatic indexing of foreign keys and junction tables for performance on larger datasets.
• Security hardening: fixed CSP/X-Frame-Options/Referrer-Policy headers, sanitized upload metadata, and a full audit (including a fix for an HTTP method-override authentication bypass).
• Multilingual content: languages and translations managed from a unified "Localization" section.

License

LessHeadCMS is free software, licensed under the GNU Affero General Public License, version 3 or (at your option) any later version (AGPL-3.0-or-later). See LICENSE. Third-party licenses are documented in third-party-licenses/.

Getting started

See README.md for a 4-step quickstart, and docs/ for details on deployment, the PlantUML syntax, the REST API, roles & permissions, workflows, and API users.

Known limitations

• No visual (drag-and-drop) schema editor yet — schema changes go through a text editor.
• Workflow actions currently support set_visibility only; file-based extensions for custom actions are planned for a future release.