Architecture
Containers, auth, and storage
Two app containers plus data services. In production, a reverse proxy terminates TLS and routes to the apps.
Auth
| Path | Who |
|---|---|
| Session cookies | Admin UI (Better Auth). Same-site hosts like cms.example.com / api.example.com keep cookies on SameSite=Lax. |
| API keys | Consumer apps — scoped read/write. |
Browser session mutations check Origin/Referer against CORS_ORIGIN. Bearer API-key calls skip that.
Files
Stored in S3-compatible storage. New uploads are private until marked public.
Who owns what
| Concern | Where |
|---|---|
| TLS / certificates | Your proxy (Caddy, Traefik, cloud LB, …) |
| Secrets, cookies, CORS, rate limits, upload caps, readiness | cms-server |
| Admin → API URL | CMS_API_BASE on cms-client (no rebuild) |