Deploy

Production layout: terminate TLS in front of the apps (any reverse proxy or load balancer), keep Postgres and object storage on the private Docker network, and point the admin UI at the public API origin. WaferCMS does not require a specific proxy.

Recommended hostnames on one site (cookies stay SameSite=Lax):

Example overlay (Caddy)

Optional sample only — swap for Traefik, nginx, Cloudflare, a cloud LB, etc. The deploy/expose-caddy/ overlay publishes only 80/443, unpublishes app ports, enables CMS_TRUST_PROXY, and sets production cookie/HTTPS env.

cp deploy/expose-caddy/.env.example deploy/expose-caddy/.env
# hostnames, HTTPS URLs, secrets, strong RUSTFS_* credentials
docker compose -f docker-compose.yml -f deploy/expose-caddy/docker-compose.yml \
  --env-file deploy/expose-caddy/.env up -d

Set CMS_API_BASE=https://api.example.com. After bootstrap, drop CMS_BOOTSTRAP_ADMIN_* and recreate cms-server.

Your own proxy

Put any TLS terminator in front of cms-client:80 and cms-server:3001 on the Compose network. Forward X-Forwarded-* and set:

• API: CMS_TRUST_PROXY=true, COOKIE_SECURE=true, HTTPS CMS_PUBLIC_BASE_URL / CORS_ORIGIN
• Client: CMS_API_BASE to the browser-reachable API origin

Images

Current release tags (0.1.1):

docker pull ghcr.io/ashutoshbind15/wafercms-server:0.1.1
docker pull ghcr.io/ashutoshbind15/wafercms-client:0.1.1

Packages: wafercms-server, wafercms-client. Also tagged {sha-…}, VERSION, and latest.

Built by .github/workflows/container-images.yml (workflow_dispatch).

Licenses & SBOMs

WaferCMS is MIT. Each image includes /licenses/LICENSE and /licenses/THIRD_PARTY_NOTICES:

CID=$(docker create ghcr.io/ashutoshbind15/wafercms-server:0.1.1)
docker cp "$CID:/licenses/." ./licenses-server
docker rm "$CID"

The same workflow run uploads CycloneDX / SPDX SBOMs (wafercms-{server,client}.cdx.json, .spdx.json) and a wafercms-{name}-licenses artifact — download them from that Actions run.

Working on the codebase? Use Local Compose instead.