Every feature
Everything in the box.
The launch week tells the story. This page is the inventory: 78 things Manablox does today, grouped by what you are trying to get done.
Install and run
One command writes the project. One process serves the API and the admin.
Read it in the story: Mondaymanablox createAn interactive CLI that writes a ready project, with fresh secrets in a gitignored
.env. Pass--yesto take every default.Local or Docker preset
Run the CMS on your machine with
pnpm dev, or get a production stack with a Dockerfile, a compose file and backup and restore scripts.HTTPS on day one
The Docker preset puts Caddy in front with automatic Let’s Encrypt certificates, or nginx with your own, or nothing at all.
API and admin in one process
The admin is served from the same origin as the API, so the session cookie just works. No proxy, no CORS settings.
Postgres or SQLite
Postgres 18 with ltree, JSONB and full text search, or SQLite in one file with nothing to run. libSQL and Turso work too.
No migrations for content
Adding or changing a content type never needs a database migration.
manablox migrateonly runs when you update Manablox.A setup assistant
The first account becomes the administrator, creates the first space, and registration closes behind it.
Content modelling
Describe what your content is made of, in code or by clicking. Both end up as the same thing.
Read it in the story: MondayCode or admin, same shape
Define types with
defineContentTypeinmanablox.config.tsor build them in the admin. Types you build in the admin can be exported as code.Content and block types
Content types are pages, articles and products. Block types are reusable pieces like teasers and galleries, and blocks can hold blocks.
13 field types
Text, rich text, number, boolean, date, select, link, asset, content and user references, a single block, a block list and a template.
A block grid of 12 columns
Each page lays its blocks out on up to 12 columns, with separate arrangements for tablets and phones.
Templates
Build a block layout once and point pages at it. Edit the template and every page using it changes.
A tree that writes the URLs
Pages nest, and their addresses follow:
about/team. Move a page and everything under it moves too. Folders group pages without adding to the URL.Standing queries
A reference field can be a rule instead of a list, like the five newest articles, so it is never out of date.
Required and unique
Checked by the server on every save, drafts included, with the problem shown next to the field.
Starter content
A new space can start with page and article types, a teaser block, a few published pages and a main menu.
Editing
A calm editor for people who write for a living, with the actual website right beside it.
Read it in the story: TuesdayVisual editor
Your real frontend in a frame, updated on every keystroke before saving. Click anything to edit it, click text twice to type in place.
Block board
Draw on empty cells to add a block, drag to move, pull an edge to resize. Switch between desktop, tablet and mobile.
Translations side by side
Each language is a linked copy with its own slug, its own status and its own history. Fields you mark as shared stay in sync.
Versions
Every save is a snapshot. The history shows who changed what and when, and a restore can itself be undone.
No silent overwrites
If someone saved since you opened a page, your save stops and tells you. If they delete it, you see who did.
Scheduling
Set a time to publish and a time to unpublish. The change goes out on its own, with the same checks as a click.
Approval before publishing
Authors ask, reviewers see it on the dashboard and in the bell, then approve and publish or send it back with a note.
Menus
Build main, footer or legal navigation by drag and drop, nested as deep as you like, from pages and plain links.
Keyboard first
Save, publish, undo and jump between sections without the mouse. Press ? anywhere for the full list.
Live across tabs
Trees, lists and members refresh in every open admin tab as others work, without a reload.
Images and files
Upload once, crop with intent, and let every page ask for the size it needs.
Read it in the story: TuesdayAsset library
Grid or table, drop files in to upload them, alt text and titles. Files are checked by their content, not by what they claim to be.
Crop and focal point
Lock a ratio, set the point that matters, adjust brightness or colour. The original file is never changed.
Named sizes
Define thumb, card and hero sizes in AVIF, WebP, JPEG or PNG. A field can ask for its own size, too.
Signed image URLs
Images are resized on request by sharp. URLs are signed so nobody can abuse the resizer, and cached forever because an edit changes the URL.
Availability windows
Give a file a start and an end date. Outside it the public website cannot load it.
Shared between spaces
One file can belong to several sites, with the same alt text and crop everywhere.
Local disk or S3
Store files on disk or in any bucket that speaks S3: AWS, R2, MinIO, DigitalOcean Spaces.
AI
Models you choose, keys you own, and nothing that happens without a person saying yes.
Read it in the story: WednesdayYour providers
Claude and ChatGPT for text. Google’s Nano Banana and Imagen for images, Veo for video. All with your own keys.
Models you host yourself
Connect Ollama, LM Studio, vLLM, LocalAI, llama.cpp or any server that speaks the OpenAI API. Several per space if you like.
The magic wand
Beside every text, rich text and image field. Choose a style, a tone and a length, then edit the answer before you use it.
It reads the room
The model is told the content type, the field, the language, the title and what the other fields already say.
Whole documents
Generate fills every field and every block list, and lays the blocks out on the grid. You review it on the real board first.
Design by describing
Describe a content model, a template, a workflow or a whole new site in a sentence or two. Preview it, then create it in one go.
Ready for agents
Each instance publishes
/llms.txtand/openapi.json, written from what is installed, so an AI agent can work with a scoped API key.Keys kept safe
Keys are per space, encrypted, and never sent back to the browser. Every generation is logged, keys never are.
Workflows and webhooks
The things you would otherwise do by hand after publishing, drawn once on a canvas.
Read it in the story: ThursdayA canvas of nodes
Connect steps with lines, snap them to a grid, tidy the layout with one click. Each step can use what the ones before it produced.
Triggers
Start on a change to content, on a schedule down to cron with a timezone, or when another system calls in.
Steps
Send email, call an API, reshape data, read a website, write or draw with AI, create a document, send a push notification.
Conditions, loops, waits
Continue only if a rule holds, run once per item, or wait minutes to days. Waits survive a restart.
Every run recorded
See each run’s status, what every step received, and paint the result back onto the canvas.
Credential vault
API keys, tokens, passwords and mail accounts, encrypted, never shown again and removed from logs.
Safe by default
Private network addresses are refused, every redirect is checked again, and credentials never follow a redirect elsewhere.
Webhooks in and out
Outgoing calls retry with backoff and can be resent from the log. Signatures work the way GitHub and Stripe sign theirs.
Frontends and delivery
Build the website in whatever you like. Manablox hands it the content, fast and typed.
Read it in the story: Thursdaymanablox frontendWrites a starter site in Astro, Vue with server rendering, React with server rendering, or plain Vite, with the preview already wired.
REST and GraphQL
Ask for a page by its URL, list content with filters, fetch a menu. Pull related content and blocks in the same request.
Real GraphQL types
Each content type becomes its own GraphQL type, so your queries are checked against your content model.
The SDK
One client for browsers, the edge and Node, with zero dependencies. Identical requests are merged, answers cached, failures retried.
Generated types
One command writes a TypeScript interface for every content type in your space.
Nuxt module
Composables for pages and content, a blocks component that respects the grid, and preview support.
Going live
The part that faces the internet is small, it only ever reads, and it is hard to talk into anything else.
Read it in the story: FridayA separate public API
A process that only reads, and serves the published content of one space. Draft reading is not built into it at all.
Hardened
Introspection off, errors masked, query depth and cost limited, and it will not start if a plugin adds a way to write.
Precise caching
Responses are cached by what they contain. Publishing a page clears exactly the responses that used it.
CDN friendly
ETags, s-maxage and stale-while-revalidate headers out of the box, and a hook to purge your CDN on publish.
Persisted queries
Optionally allow only the GraphQL queries your site actually sends.
Teams and security
Give people exactly the access they need, and keep a record nobody can edit.
Read it in the story: FridaySpaces
One instance runs many sites, each with its own pages, languages, files, menus and members.
Roles
Owner, admin, editor, author and viewer out of the box, plus roles of your own per space.
Permissions down to the field
Grant read, write, delete and publish for all content types or one at a time. Hide single fields from roles.
Scoped API keys
A key acts as the person who made it, narrowed to some spaces and some permissions, with an expiry date if you want one.
An activity log you can prove
Every change with before and after values, who made it and from where. Entries are chained by hash and can be verified with one click.
Notifications
A bell and an inbox in the admin, plus email and browser push, with preferences per kind and channel.
Careful with passwords
Argon2id hashing, login throttling that backs off to 15 minutes, and sessions on as many devices as you use.
Operations
Boring in the best way: backups, exports, logs and mail that simply work.
Read it in the story: FridayBackups
manablox backupcopies a running SQLite database safely. The Docker preset ships backup and restore scripts for database and uploads.Space export and import
Move a whole site, or just some of it, as JSON or as a zip with its files. Also the way to move between Postgres and SQLite.
Background jobs
Webhooks, image sizes, workflows and AI media run in a queue on Valkey, or in the process when there is no Valkey.
Structured logs
JSON logs to the console, a file or an HTTP endpoint, with secrets redacted by default.
Mail your way
SMTP, Gmail, Microsoft 365, Resend, SendGrid, Postmark or Mailgun.
Health checks
A Docker image that runs as an ordinary user, with
/healthzand/readyz, sized to run comfortably on a 4 GB server.
Extending
When the pieces that ship with Manablox are not enough, add your own without forking anything.
Read it in the story: ThursdayPlugins
One package can add field types, content types, fields on other types, hooks, workflow steps and admin screens.
Hooks
About thirty moments, like before a page is saved or after it is published, to observe, change or refuse.
Custom field types
A single object describes how a value is checked, stored, searched, served over GraphQL and edited.
Workflow steps
A new step appears in the canvas palette with its settings form generated for you, no admin rebuild needed.
Resources in code
Declare workflows, webhooks, credentials and templates in code and sync them into any instance. The environment fills in the secrets.
Not in the box
What Manablox does not do.
Better to hear it here than to find out in week three. These are not built and not planned for now.
- Live collaborative editing
- Personalisation
- A plugin marketplace
- GraphQL subscriptions
Under the hood
Built on parts you know.
| Server | Hono 4 on Node 24 |
|---|---|
| Database | Postgres 18 or SQLite, through Drizzle |
| Management API | oRPC, typed end to end, with OpenAPI |
| Delivery API | GraphQL with Pothos and Yoga, plus REST |
| Accounts | better-auth with Argon2id |
| Admin | Vue 3.5, Vite 8, Reka UI, Tailwind 4 |
| Images | sharp, resizing on request |
| Queue and cache | Valkey and BullMQ, optional |