Zyvra CMS — a headless CMS for websites and apps
A headless CMS I built for my own projects. One installation serves several websites and apps: content types are defined in the admin, entries are filled in the needed languages and published, and the sites get what is published through a REST API with a key. This site runs on Zyvra: its cases, pages, section texts and contact form are managed there.
- Role
- Author, full-stack developer
- Timeline
- 2026, October
The challenge
Build a CMS where the content structure is described in the admin rather than in code, so that a new section of a site needs no changes to the CMS, and take it to production: permissions, security, tests, Docker and backups.
What the solution includes
- A content type builder: collections and single entries with text, long text, number, checkbox, choice, image, file, list and field group fields. The language versions of an entry share a slug.
- Drafts and publishing: the published version is stored apart from the working copy, and the public API reads only it. A draft opens on the site by a signed preview link.
- Pages and articles in a Tiptap visual editor, SEO fields and shared settings of each site.
- A media library in S3-compatible storage: file types are detected by content, and images get AVIF and WebP copies in several sizes.
- Forms from a builder: the site renders a form from its description in the CMS, and the CMS checks a submission against the same description. Attachments are kept private, submissions are emailed, and the admin has filters, statuses and replies through web mail.
- A REST API for websites and apps: keys with scopes for each app, CORS and rate limits. The contracts are written in Zod, and OpenAPI is generated from them.
- Administrator, editor and viewer roles, an audit log and the admin in Russian and English.
- A strict CSP and CSRF protection, a Docker image without root, a CLI for migrations and the first administrator, a tested restore from backup; unit, integration and end-to-end tests.
My own project: the architecture, backend, admin and deployment are mine. Screenshots are from a local copy with the data of this portfolio; the submissions in them are test data.