Servitor CMS 0.4.0

Servitor now manages cards: products, events or listings built from card types with the fields you define, written in the post editor with the same translations and review as posts, and served to your sites through the API with filters on any shared field. The editor also leaves room below the text while you write.

Added

• Card types under Content → Card types: staff define the fields of a type, such as text, numbers, prices with a currency, choices, yes or no, links and dates, and start from a ready-made product structure or from an empty one. Each field can be required, and text fields can have a separate value per language.
• Cards under Content → Cards: each card is created from a card type and written in the post editor, with the same translations, revisions, review, scheduling and moderation as posts. The new Card tab holds the fields of the type, with per-language values saved in the draft and shared values for all translations, and a gallery of up to 20 images. A card is published once it has a title and every required field. Cards stay out of the post list, the blog and the post API.
• Webhook events for cards: card.published, card.updated, card.unpublished, card.hidden, card.unhidden and card.deleted, with card_id and card_type in the body.
• Cards in the REST API: GET /api/v1/cards with filters for the type, category, tag and the values of shared fields, including ranges for numbers, prices and dates, and sorting by a field; GET /api/v1/cards/{id}, GET /api/v1/cards/by-slug/{lang}/{slug} and GET /api/v1/card-types. The OpenAPI document describes them.

Changed

• The post editor leaves room below the text and scrolls before the cursor reaches the bottom of the screen, so the line you write can stay near the middle.

Upgrading from 0.3.x

Take a backup first:

docker compose exec servitor node build/cli.js backup

Then set SERVITOR_VERSION=0.4 in your .env and pull the new image:

docker compose pull
docker compose up -d

Three migrations run on start. They add the card types, the card fields of posts and revisions and the gallery, and rebuild the webhook delivery table so that it accepts the card events; waiting and failed deliveries and their attempts are kept. Existing webhooks keep their events: subscribe a webhook to the card.* events to be notified about cards. The post endpoints of the API and the blog are unchanged and never return cards.

The image for linux/amd64 and linux/arm64 is ghcr.io/rua-systems/servitor-cms:0.4.0 (also 0.4 and latest). Verify it with the GitHub CLI:

gh attestation verify oci://ghcr.io/rua-systems/servitor-cms:0.4.0 --owner Rua-Systems

The full list is in CHANGELOG.md.

Servitor CMS 0.3.0

Servitor gives writers more room: a wider editor with a focus mode, the post fields in tabs, and a check that every post has a title, content, an excerpt and a meta description before it goes live. The project also moved to the Rua Systems organization.

Added

• Focus mode in the post editor: the last button of the toolbar spreads the title and the content over the whole window, and Esc returns to the full page.

Changed

• The post editor uses more of the screen width and starts taller, and its toolbar stays visible while you scroll through a long post.
• The publishing actions and the translation fields share one card next to the editor, with the fields in the Details, SEO and Settings tabs. The card stays in view while you scroll.
• Publishing and submitting for review need a title, content, an excerpt and a meta description. The editor lists what is missing and marks the tabs that hold it, and the server refuses the request otherwise. Live translations stay online, but publishing them again needs the same fields.
• The project moved to the Rua Systems organization on GitHub: the repository is github.com/Rua-Systems/servitor-cms, and the old address forwards there. Images are published at ghcr.io/rua-systems/servitor-cms; the former address ghcr.io/justhasanuknow/servitor-cms no longer exists.
• The Coolify guide deploys the published image from a Compose file pasted into Coolify, instead of a Compose resource from the repository that builds the image on the server.
• Troubleshooting explains the start failure caused by relative data paths such as DATABASE_PATH=./data/servitor.db in a container.

Upgrading from 0.2.x

0.3.0 has no migrations. If your Compose file still names ghcr.io/justhasanuknow/servitor-cms, change its image line to ghcr.io/rua-systems/servitor-cms first. Then set SERVITOR_VERSION=0.3 in your .env:

docker compose pull
docker compose up -d

Translations without an excerpt or a meta description stay online, but need both before they can be published again.

The image for linux/amd64 and linux/arm64 is ghcr.io/rua-systems/servitor-cms:0.3.0 (also 0.3 and latest). Verify it with the GitHub CLI:

gh attestation verify oci://ghcr.io/rua-systems/servitor-cms:0.3.0 --owner Rua-Systems

The full list is in CHANGELOG.md.

Servitor CMS 0.2.1

Servitor now shows its own icons, and every password field can show what was typed.

Added

• Every password and passphrase field in the panel has a button that shows what was typed. Sending the form hides the value again so that browsers do not remember it, and without JavaScript the button is left out.

Changed

• The app uses the Servitor icons: an adaptive SVG favicon with an ICO fallback, an Apple touch icon, and the mark next to the product name in the panel, on the sign-in pages and in the documentation.
• The README shows the logo in the light and dark themes of GitHub.

Fixed

• /favicon.ico is served with the image/x-icon type.

Upgrading from 0.2.0

0.2.1 has no migrations and no configuration changes. With SERVITOR_VERSION=0.2, pulling picks it up; if you pinned 0.2.0, change it to 0.2.1 first:

docker compose pull
docker compose up -d

The image for linux/amd64 and linux/arm64 is ghcr.io/justhasanuknow/servitor-cms:0.2.1 (also 0.2 and latest). Verify it with the GitHub CLI:

gh attestation verify oci://ghcr.io/justhasanuknow/servitor-cms:0.2.1 --owner justhasanuknow

The full list is in CHANGELOG.md.

Servitor CMS 0.2.0

Backups and restores are now part of the panel.

Added

• Backups in the panel under Administration → Backups, for the founder with two-factor authentication: create backups in the background, download them, optionally encrypted with a passphrase, upload archives of any size in chunks, delete them, and restore one through a controlled restart that applies it before the database is opened.
• Scheduled backups every day or every Monday at a UTC hour. Servitor keeps a chosen number of scheduled archives and emails the founder when one fails.
• decrypt-backup on the command line for archives downloaded with a passphrase.
• A guide to backups and restores, also served at /docs/backups.

Changed

• Backups leave out sessions and verification tokens, so restoring one signs everybody out; restores also remove sessions from older archives.
• Restores compare the database with the schema of its migration history and refuse archives from newer versions or with extra tables, triggers or views.
• The backup manifest records the app version and whether the panel, the schedule or the command line made it.
• The systemd example restarts the app always, which a restore from the panel needs.

Downloading, restoring and deleting backups and changing the schedule require the password and a current authenticator code, every backup action is written to the audit log, and a download sends the founder an email notice.

Upgrading from 0.1.x

Take a backup, then check out the new tag:

docker compose exec servitor node build/cli.js backup
git fetch --tags
git checkout v0.2.0

Set SERVITOR_VERSION=0.2 in your .env (add the line if you came from 0.1.0), then pull and start the image:

docker compose pull
docker compose up -d

A migration adds the backup_schedule table; it runs on start. If you run Servitor without Docker, set your service manager to always restart it, for example Restart=always in systemd.

The image for linux/amd64 and linux/arm64 is ghcr.io/justhasanuknow/servitor-cms:0.2.0 (also 0.2 and latest). Verify it with the GitHub CLI:

gh attestation verify oci://ghcr.io/justhasanuknow/servitor-cms:0.2.0 --owner justhasanuknow

The full list is in CHANGELOG.md.

Servitor CMS 0.1.1

Servitor CMS now ships as a prebuilt image, so installations pull it instead of building on the server.

Added

• Every release is published as a prebuilt image for linux/amd64 and linux/arm64 at ghcr.io/justhasanuknow/servitor-cms, tagged with the version, the minor line and latest, and with a signed build provenance attestation.

Changed

• docker-compose.yml runs the prebuilt image in the version set by the new SERVITOR_VERSION variable. docker compose up -d --build still builds from the source.
• The installation and update guides describe the prebuilt image and pinning a version.
• The project website is servitor.rua.systems.

Fixed

• An end-to-end test of the public pages could fail when it ran at the same time as the headless mode test.

Updating from 0.1.0

Take a backup, then check out the new tag, add SERVITOR_VERSION to your .env and start the image:

docker compose exec servitor node build/cli.js backup
git fetch --tags
git checkout v0.1.1
echo "SERVITOR_VERSION=0.1" >> .env
docker compose pull
docker compose up -d

0.1 follows the newest 0.1.x release; use 0.1.1 to pin exactly this one. There are no database or configuration changes besides SERVITOR_VERSION.

Verify the image with the GitHub CLI:

gh attestation verify oci://ghcr.io/justhasanuknow/servitor-cms:0.1.1 --owner justhasanuknow

The full list is in CHANGELOG.md, and the update guide has the details.

Servitor CMS 0.1.0

The first public release of Servitor CMS: a self-hostable, multilingual CMS for blog posts and articles that runs as a single container with SQLite.

Highlights

• Writing: a block editor with tables, highlighted code, math, images and video embeds; automatic saving, revision history and previews; a media library that re-encodes uploads to WebP and strips metadata.
• Many languages: one translation per content language for every post, any number of content languages, and a panel in English, Turkish, French, German, Japanese and Simplified Chinese.
• Editorial workflow: founder, admin and author roles, direct publishing for trusted authors, a review queue, scheduling, moderation and an append-only audit log.
• Delivery: server-rendered public pages without JavaScript, with SEO metadata, RSS and sitemaps, or headless mode; a read-only REST API with scoped keys and an OpenAPI description; signed webhooks with retries.
• Security and operations: reviewed against OWASP ASVS 5.0 levels 1 and 2; automatic migrations, a health check, backup and restore commands and a software bill of materials in the image.

Install

git clone https://github.com/justhasanuknow/servitor-cms.git
cd servitor-cms
git checkout v0.1.0
cp .env.example .env

Fill in .env, then run docker compose up -d --build to build the image from this release.

The prebuilt image for amd64 and arm64 is also available as ghcr.io/justhasanuknow/servitor-cms:0.1.0 (and 0.1), with a signed build provenance attestation:

docker pull ghcr.io/justhasanuknow/servitor-cms:0.1.0
gh attestation verify oci://ghcr.io/justhasanuknow/servitor-cms:0.1.0 --owner justhasanuknow

The docker-compose.yml of this release still builds locally; from the next release on, it pulls the prebuilt image by default. The installation guide and the deployment guide cover a production setup behind a TLS proxy. Every installation also serves the documentation at /docs.

Notes

• Servitor runs as a single instance per data directory.
• Before 1.0.0, a minor version may change configuration, the API or the data in incompatible ways; the notes of each release say so.
• Report vulnerabilities privately as described in SECURITY.md.

The full list is in CHANGELOG.md.