Module: Demo Mode

Module: Demo Mode

Demo mode provides security restrictions for public demo deployments, preventing abuse while allowing visitors to explore oCMS functionality.

Overview

When OCMS_DEMO_MODE=true, destructive and sensitive operations are blocked:

Feature	Normal Mode	Demo Mode
Create/Edit pages	Allowed	Blocked
Publish/unpublish pages	Allowed	Blocked
Delete pages	Allowed	Blocked
Upload/Edit media	Allowed	Blocked
Delete media	Allowed	Blocked
Create/Edit tags, categories, menus, forms, widgets, redirects	Allowed	Blocked
User management	Full access	Blocked
Site configuration	Full access	Blocked
Language management	Full access	Blocked
API key management	Full access	Blocked
Webhook management	Full access	Blocked
Module management (toggle, module settings)	Full access	Blocked
Theme settings	Editor access	Blocked
Theme import/deletion	Admin access	Blocked
Cache clearing	Full access	Blocked
Scheduler management	Full access	Blocked
Two-factor authentication (setup, reset)	Full access	Off (shared demo accounts)
SQL execution (DB Manager)	Full access	Blocked
Data export/import	Full access	Blocked
Delete tags/categories	Allowed	Blocked
Delete menus/items	Allowed	Blocked
Delete forms/widgets	Allowed	Blocked

Theme import and delete controls are hidden in demo mode, and requests to their endpoints are blocked. Themes remain available for browsing. See Theme System.

Enabling Demo Mode

export OCMS_DEMO_MODE=true

Requires OCMS_DO_SEED=true for demo content seeding.

Allowed Actions

Demo mode still allows users to:

• Browse all admin pages
• View all settings and configurations
• Switch the active theme
• Use the REST API for read operations

Content is read-only: pages, media, tags, categories, menus, forms, widgets and redirects cannot be created, edited, published or deleted. Media uploads are blocked entirely; the seeded demo content is the only media.

User Experience

When a blocked action is attempted:

• Web UI: Redirected back with a flash message explaining the restriction
• API: Returns HTTP 403 Forbidden with explanation

Demo Credentials

With OCMS_DEMO_MODE=true and OCMS_DO_SEED=true:

• Admin: demo@example.com — the password is rotated to a random value on every startup and shown in the informer bar at the top of the site (see Module: Informer)
• Editor: editor@example.com / demo1234demo

Security

Demo mode prevents:

• Data deletion
• Configuration tampering
• User privilege escalation
• External service abuse (webhooks)
• Data exfiltration (export)
• Storage exhaustion (media uploads are blocked)

It does not prevent junk arriving through public forms and other visitor traffic; the scheduled reset clears it.

Fly.io Deployment

See Deploy: Fly.io for complete demo deployment instructions.

Scheduled Reset

The application resets itself in demo mode: a scheduler job demo_reset runs daily at 01:00 server time, UTC on Fly.io (no manual trigger), deleting the database and uploads and sending SIGTERM so the process restarts and re-seeds. At startup, if more than 24 hours have passed since the last reset, the same reset runs before the database is opened.

Scheduler Restrictions

When demo mode is active, Scheduler modifications are disabled — users can view jobs but cannot edit schedules, reset, or trigger jobs manually.