v1.0 live · Phases 0–5 shipped · MIT licensed

The headless CMS
with the raw power of SQL.

Self-host the MIT-licensed engine, free forever. Add a license key to activate the plugins you need — GraphQL, gRPC, S3, webhooks, SMTP, multi-tenant.
One ~45 MB image. Real SQL tables. No lock-in.

No credit card required · Free tier never expires · Cancel any time

Dockerfile
# One image. Free without a key, paid with one.
FROM ghcr.io/lyeve/cms:latest

# Optional — sets which plugins activate at boot
ENV CMS_LICENSE_KEY=cms_live_xxxxxxxxxxxx

That's the entire upgrade path. Rebuild and restart. Done.

~45 MB
Docker image
~80 MB
idle RAM on $5 VPS
<200 ms
cold start
6
paid plugins
MIT
open-source engine
Go
runtime
Product preview

A content layer your team will love using

Visual schema builder. Instant REST and GraphQL. A content editor that feels like the admin you'd build yourself — packed into one ~45 MB image.

cms.yourproject.com

Schema · Collections

Blog Posts

FieldTypeRequiredNotes
idUUIDauto-generated
titleText
slugTextunique index
bodyRich Text
published_atTimestamp
statusSelectdraft · published · archived
authorRelation→ authors (belongs_to)
tagsRelation→ tags (many_to_many)
+ Add another field

One ~45 MB image, all plugins compiled in

All six paid plugins compiled in. ~80 MB at idle. Cold starts under 200 ms. Runs comfortably on a $5 VPS — no cloud account needed.

Real SQL tables

Every collection becomes a real table — no JSONB blobs. Query with raw SQL, index anything, dump it with your database's native tools. Same schema on PostgreSQL, MySQL, or MSSQL.

MIT engine, always free

REST API, schema builder, RBAC, MFA, drafts, revisions, locales — all MIT licensed and complete. The free tier is a real CMS, not a teaser.

License-activated by one env var

Add CMS_LICENSE_KEY to your env. The JWT decides which compiled-in plugins activate. No sidecar, no CDN download, no operator.

MIT core · always free

Everything you need, included at $0

No trial period. No feature degradation. The core never expires. You get a production-grade CMS before spending a cent.

REST content API

Full CRUD, cursor pagination, filtering, full-text search. Auto-generated from your schema.

Visual schema builder

Drag-drop canvas with pan/zoom, all field types, belongs_to / has_many / many_to_many relations.

RBAC + ABAC permissions

Role-level and policy-level access control. Field-level masks per role.

Realtime SSE stream

Stream live content events per schema. Backpressure-safe, 1000 concurrent clients per replica.

Drafts + publish workflow

Per-record _status column, revision history, single-tenant or multi-tenant safe.

Localization (i18n)

Per-record _locale column, sys_locales table, content reads scoped by header or query param.

Local media + image proc.

Local filesystem driver out of the box. Stdlib JPEG/PNG resize. Add S3 plugin later if you need it.

OAuth 2.0 / OIDC + MFA

Google + GitHub PKCE, JWKS validation, TOTP with backup codes — all in the free engine.

PostgreSQL / MySQL / MSSQL

Single dialect adapter. One codebase, three databases. Pick the one you already run.

CLI toolchain

cms schema export / apply, migrations, seed, generate. Full schema-as-code workflow.

Audit log + observability

Every mutation in sys_audit_log. OpenTelemetry tracing, Prometheus metrics, JSON logging.

Cron + scheduled jobs

sys_jobs table + cron scheduler. POST any URL on a schedule with a JSON payload.

License-activated · one ENV var

Six plugins. One image. Stack to save up to 30%.

Every plugin is its own monthly subscription, priced by implementation complexity — starting at $0.25/mo. Stack two and save 10%, three saves 15%, four saves 20%, five saves 25%, six saves 30%. Same image ships them all — your license JWT decides what activates. 7-day offline grace, 7-day cancel grace, your data is never touched.

SMTP / Email
$0.25/mo
Webhooks
$0.50/mo
S3 Storage
$0.50/mo
gRPC API
$1.00/mo
GraphQL API
$1.50/mo
Multi-tenant
$3.00/mo
Browse the full catalog →
Dockerfile
FROM ghcr.io/lyeve/cms:latest

# Always required
ENV DATABASE_URL=postgres://...
ENV JWT_SECRET=change-me-32chars

# Add this to activate paid plugins
ENV CMS_LICENSE_KEY=cms_live_...
Security by default

Hardened on day zero

Argon2id, MFA, RBAC, audit log, signed webhooks, JWT rotation. None of these live behind a paid tier. They ship with the free engine.

Argon2id password hashing (OWASP-tuned params)
SHA-256 API key hashing — never stored in plaintext
JWT HS256 with ParseMulti key rotation support
RBAC + ABAC dual permission layers
TOTP / MFA with encrypted backup codes
Rate limiting — sliding window, per-IP
IP allowlist / blocklist (CIDR ranges)
Audit log — every mutation recorded
HMAC-SHA256 outbound webhook signatures
Ed25519-signed license JWTs
HTTP-only session cookies
Security headers on every response

Found a vulnerability? Email [email protected] — please don't open a public GitHub issue.

Side by side

How LyEve compares

Where we beat them. Where we tie. Where they still win. Decide on facts, not vibes.

Feature LyEve ← youStrapiDirectusPayload
RuntimeGoNode.jsNode.jsNode.js
Engine licenseMITMITBSL 1.1 ⚠MIT
REST API✓ free✓ free✓ free✓ free
GraphQL$1.50 /mo✓ plugin✓ free✓ free
gRPC$1.00 /mo
Multi-tenant$3.00 /momanualmanualmanual
Per-plugin pricing
Volume discountup to −30%
Indie / OSS discount✓ program
MFA / TOTP✓ freecloud only
Audit log✓ freeenterprisepartial
Idle RAM (est.)(Approximate at idle)~80 MB~500 MB~400 MB~400 MB
Container size~45 MB~320 MB~220 MB~180 MB
License activationENV vardashboarddashboardN/A

⚠ BSL 1.1 = Business Source License. Not OSI open source; converts to MIT after 4 years.

Container size and RAM estimates are approximate at idle with a minimal schema. Actual usage varies.

Full plugin-by-plugin feature comparison →
Performance

Built for a $5 VPS.

Side by side with Strapi, Directus, and Payload. Click any bar to read the methodology behind it.

Idle RAM

Empty database, no traffic, default config.

6.3× lighter than the heaviest competitor
  • LyEve
    LyEve
    80MB
  • Strapi
    500MB
  • Directus
    400MB
  • Payload
    400MB

~80 MB

idle RAM

on a $5 VPS

< 50 ms

p99 REST + GraphQL

at 1000 RPS

< 100 ms

plugin activation

in-process, no subprocess

Full methodology + per-endpoint targets →
Six gateways · one cart

Pay your way — wherever you are.

Stripe blocks Indonesia, so we don't make it the default. Xendit, Midtrans, and DOKU run the local rail. Stripe and PayPal cover international cards. Coinbase covers crypto.

X

Xendit

Primary

Indonesia · primary

Bank VAQRISOVODANAGoPayShopeePay

Invoice-renewal flow with callback-token verified webhooks.

M

Midtrans

Indonesia · secondary

Bank VAGoPayShopeePayCredit card

Backup gateway for Indonesian customers.

D

DOKU

Indonesia · retail

AlfamartIndomaretBank VAQRIS

Cash-at-counter for buyers without cards or e-wallets.

S

Stripe

International

VisaMastercardApple PayGoogle PaySEPA

Auto-recurring subscriptions for non-Indonesian buyers.

P

PayPal

International

PayPal balanceCards via PayPal

Auto-recurring subscriptions, secondary international.

Coinbase Commerce

Global · crypto

BTCETHUSDCUSDT

Settles to USD; license issued on confirmation.

Transparent progress

What's done. What's next.

Phases 0–5 are live. Billing, licensing, and the customer portal are in production. Below is the unedited list of what's done and what's next.

Shipped and live

  • Core CMS — 140+ features (phases 0–5 live)
  • Stripe billing + full subscription lifecycle
  • Ed25519 license key issuance + activation
  • GraphQL gateway (Starter tier)
  • gRPC server with auth interceptor (Pro tier)
  • Customer portal — billing, keys, instances
  • Internal ops dashboard — MRR, churn, signups
  • 7-day cancel grace + 7-day offline grace
  • Docker-ready deploy config for every service
  • 79 Go unit tests + vitest customer-ui suite

Coming next

  • Extension marketplace (Phase 6)
  • OAuth social login — Google + GitHub
  • S3 / Cloudflare R2 storage plugin
  • AI content generation extension
  • Backup Vault — daily S3 snapshots
  • SSO / SAML (Team tier)
  • Algolia Sync extension (free)
  • Analytics Pro — usage charts, slow endpoints
  • Public beta launch (Phase 7)
  • goreleaser single-binary distribution

Known limitations — written down before you ask

No managed cloud hosting — you must self-host
Extension marketplace not live yet (Phase 6)
OAuth social login still in progress
No Cloudflare Workers / edge runtime support
No collaborative editing (CRDT required)
Admin UI dark mode polish still pending
Pure à la carte · stack to save up to 30%

Three carts to start from. Edit any of them.

Indie maker, multi-tenant SaaS, or all-in. Each preset is just a plugin cart underneath — change one click, change the price.

Free

$0forever
  • Full REST + admin UI + RBAC
  • All system features (drafts, MFA, locales)
  • PostgreSQL / MySQL / MSSQL
  • Self-host on any VPS, K8s, or laptop
Pull the image

Indie maker

$1.75/mo · 2 plugins · −10%
  • GraphQL + SMTP
  • Cart discount applied
  • Apply for community discount
  • Lightest paid bundle
Use this cart
Most popular

Multi-tenant SaaS

$4.46/mo · 4 plugins · −20%
  • GraphQL + Multi-tenant + S3 + SMTP
  • Resell CMS-as-a-service
  • Email support (48 h)
  • Most common cart at scale
Use this cart

All in

$4.73/mo · all 6 plugins · −30%
  • Every plugin we ship
  • Maximum cart discount
  • Priority support (24 h)
  • Best $/feature ratio
Use this cart

Open the live cart with volume discount →

Own your content stack.

Self-hosted. MIT core. Written in Go. Stored in real SQL tables. Your data, your infrastructure, your rules.

Get started free → Star on GitHub

No credit card required · v1.0 live · Phases 0–5 shipped