toa://toacms
One CMS, four modules, one API key.
Overview
cms is the writing surface for the whole ecosystem. It began as toa://blog; in August 2026 toa://comments, toa://contact and toa://ratings moved in as modules of the same application — one login, one admin, one API key per site, and a database per module so they stay out of each other’s way. Content lives once and comes out over a clean, versioned REST API: markdown in, structured JSON out. Each site is its own tenant, Postgres row-level security keeps them isolated, and API keys carry per-module scopes — the key that accepts a comment cannot publish a news post. Sign-in is single sign-on via toa://auth.
Features
Four modules, one app
Blog, comments, contact and ratings share one login, one admin and one API key — they used to be four separate applications on four subdomains.
A database per module
Core tenancy plus one database each for blog, comments, contact and ratings. A module cannot read another's tables, so a fault stays where it started.
Headless via API
Every module reads and writes over the same versioned REST API, with a per-site RSS feed and sitemap.xml. Your site owns its layout; the CMS owns the data.
Module-scoped API keys
A key carries scopes like blog:read or contact:write, so the key a public form holds to accept a message cannot publish a post.
Multi-site, multi-editor
Owners invite editors per site; Postgres row-level security keeps each site's content fully isolated across all four modules.
Draft, schedule & publish
Draft → published in one flip, or schedule a post and a worker publishes it for you. Every edit is snapshotted and one-click restorable.
Media library
Per-site image library — upload, auto-convert to WebP, organise by category and reuse across posts.
Built for automation
n8n and external tools read and publish programmatically with their own narrowly-scoped keys; a deploy webhook rebuilds the consuming site on publish.
What's new
- changed toa://blog became toa://cms. toa://comments, toa://contact and toa://ratings were folded in as modules of one application and their stacks retired. One login, one admin, one API key per site, and a database per module so the four stay isolated. Now served at
cms.toaweb.com. - added Module-scoped API keys. The flat read/write pair became
blog:read,blog:write,comments:read,comments:write,contact:writeandratings:read. A key issued so a site can accept a visitor's comment can no longer publish a post — which the oldwritescope allowed. - added Security headers at the edge on every route: HSTS, a content security policy,
X-Frame-Options: DENY,X-Content-Type-Options: nosniff, a referrer policy, a permissions policy andX-Robots-Tag. - removed The embed and Turnstile surfaces the absorbed apps shipped with. Data leaves the CMS through the API, so each site designs its own comment thread and contact form rather than embedding someone else's.
- removed
blog.toaweb.com,comments.toaweb.com,contact.toaweb.comandratings.toaweb.com. All four are retired;cms.toaweb.comis the only host.
API
Self-hosted World of Warcraft character tracker. Manage your roster, item levels, and Best-in-Slot gear progress across every character.