Skip to content

v0.1.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 16:31
· 4 commits to main since this release
v0.1.0
3ed2f6e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.1.0 is the first release of TachyonCMS: a headless CMS in one Rust binary, backed by one Postgres database, with an API generated from the content types you define. It's pre-alpha. The content API, sign-in and access rules work; the admin screen, rich text, drafts and media don't exist yet, so keep it off public networks for now.

Get it

  • Binaries for Linux (x86_64, arm64, static) and macOS (Intel, Apple silicon) are attached below.
  • Docker: docker pull ghcr.io/tachyon-cms/tachyoncms:v0.1.0. Set TACHYON_DATABASE_URL and TACHYON_PUBLIC_URL, and it serves on port 3000.

What's in it

  • Content types over the API, or in a file. Collections and globals with text, number, date, email, URL, select, radio, slug, code, JSON and map-point fields, plus relationships, groups, arrays, rows, collapsible sections and tabs. tachyon schema export, diff and apply keep them in version control, and renames keep your data.
  • Queries that reach where your content does. Filter through relationships (where[author.name][equals]=Ann) and into list rows, sort, page with cursors, and find map points by distance. Populate linked documents to any depth you allow.
  • Ask for only what you need. select and populate trim responses, virtual fields show a linked value without storing it, and join fields list the documents that link to this one.
  • Sign-in, roles and API keys. Sessions or bearer tokens, Argon2id passwords checked against known breaches, lockout after repeated failures, and scoped keys you can rotate. Admin, Editor, Author and Viewer roles, plus your own.
  • Access rules down to a field. Published posts for everyone, drafts for their authors, a salary field for HR. Rules compile to SQL per caller, so a hidden document can't be found by filtering for it, and GET /api/access tells each caller what they can do.
  • Errors that point at the problem. Every error is RFC 9457 problem+json, names the exact field (seo.title, links.0.url) and carries a request ID you can find in the logs.

Supply chain

Every binary records its dependency tree, and each archive has an SPDX SBOM. The checksums are signed with cosign, the archives and the image carry build provenance, and the image is signed. Scorecard runs weekly, and every commit is signed off under the DCO.

Thanks

To everyone who starred, watched and opened the repo before there was anything to download. Ten issues are ready for a first contribution, and the next release notes have room for your name.

Verify a download

cosign verify-blob \
  --certificate-identity 'https://github.com/tachyon-cms/tachyoncms/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt

Full changes: https://github.com/tachyon-cms/tachyoncms/commits/v0.1.0

Assets 12
Loading