your cms is a folder.
A headless CMS where your content lives as plain JSON in a bucket you own. The admin runs in your perimeter. Your frontend reads the same files directly. Clear never sees what's inside.
- ▸_demo/
- about.json
- hello-world.json
- why-files.json
-
{
"id": "about",
"title": "About clear",
"kind": "page",
"sections": [
{
"kind": "hero",
"heading": "your cms is a folder."
},
{
"kind": "intro",
"body": "A small project building a CMS that respects your portability and your perimeter."
},
{
"kind": "links",
"items": [
"github",
"docs",
"npm"
]
}
]
} three primitives. one perimeter.
The bucket is the source of truth.
Every entry is a JSON file at a deterministic path. Backup with rsync. Diff with git. Import existing Astro content collections in one command.
/data/storage/collections/posts/*.json The database is a projection.
libSQL indexes the bucket for fast queries and operational state. It sits off the read path, so losing it never loses content.
/data/clear.db · libsql The frontend reads the bucket directly.
Skip the admin entirely. The SDK speaks JSON-over-HTTP — anything that can fetch can be a client. Deploy to Vercel, Cloudflare, your laptop.
await getCollection('posts') The bucket layout is the API contract.
You don't learn a clear-specific protocol. You learn the file system you already know. Everything you can do with files, you can do with your content.
- Migrate by copying a folder.
- Audit history with
git log. - Edit in production with
vim, if you must. - Mirror to a second region with
aws s3 sync.
// fetch a collection — same API everywhere import { getCollection } from 'astro:content'; const posts = await getCollection('posts'); // no proxy. no plugin. just JSON over HTTP.
your perimeter stays your perimeter.
The admin runs where you do.
VPC, on-prem, your laptop — clear is a binary you control. There is no clear cloud to authenticate against, no shared backend, no telemetry on your content.
docker run clearcms/clear We have no credentials to your bucket.
Storage credentials live with you. Your IAM, your KMS, your audit log. A compromise of clear is not a compromise of your content — we never had it.
CLEAR_BUCKET_ROLE=arn:aws:iam::… Frontends read scoped paths only.
The SDK uses credentials you scope to read-only paths in production. No proxy layer, no shared service account, no surface to compromise on our side.
s3:GetObject on /collections/* It really is just a folder.
Open the docs, clone the repo, and have a working CMS pointing at a local bucket in under five minutes.