Open source · MPL 2.0 · v0.9.x

AI-first
open-source CMS.

Editors chat with an agent that holds the full site model in context. The admin panel is the fallback, not the primary surface. Bring your own cloud account — Caelo provisions it in under twenty minutes.

bunx @caelo-cms/provisioning·GCP · Firebase · Self-host·~$13/mo floor
01

AI-first, by construction

The agent is the primary user of the admin. Every API is designed for it. The panel UI exists for Owner-only tasks the agent can't safely perform.

Agent-primary admin

Editors describe changes in chat. The agent rewrites HTML, edits modules, sets SEO, restructures templates. The panel is a fallback — most editing sessions never open it.

Bulk-op APIs everywhere

*.create_many, update_many, and composite tools like compose_page_from_spec collapse N+1 round-trips into a single call. The agent gets through more work per turn.

Context blocks, not list queries

The system prompt ships layouts, templates, pages, locales, and users inline. The agent plans without burning tool calls on list_*. Stale context is cheaper than wasted turns.

Skills system

Claude-style skills are the official path to teach the agent new behaviour. Auto-engaged per call by trigger keyword; user-overridable per chat. No hardcoded prompt scaffolding — skills compose.

Click-to-chat chips

Every entity in the panel has chips that append to the current chat instead of forking a new one. Context accumulates in one place; the agent stays oriented.

Snapshot + chat-keyed Undo

Every write emits a snapshot. Undo is scoped to the chat that produced the change — the primary history surface for editors, no diff-archaeology required.

Provider Abstraction Layer

Anthropic, OpenAI, and Gemini behind one interface. The brand never surfaces in the editor. Swap providers per environment; the agent's behaviour stays stable.

Branched edits

Every chat is its own write-branch. Stage merges; production publish gates per-kind. Two editors can work in parallel without stepping on each other's drafts.

02

Security & layered permissions

Twelve permission scopes. Two isolated Postgres roles. Plugin tiers with a hard sandbox boundary. Hard-to-revert ops are gated on human confirmation, not AI judgement.

Permission scopes

Roles compose from twelve named scopes — no monolithic admin flag.

ModuleTemplatePageContentSEORedirectPluginSkillMediai18nSecurityDeployment

Two-database split

Authoring data and visitor data live on separate Postgres roles. RLS is FORCEd — even owners go through policy.

cms_admin
Authoring. Layouts, templates, pages, modules, chats, snapshots. Locked to the admin service role.
cms_public
Plugin tables and visitor sessions. The gateway role has no read access to cms_admin — by Postgres grant, not application logic.

Plugin tiers

Two execution surfaces with different trust boundaries.

Tier 1 — In-process
Audited. Ships with Caelo. Runs in the same process as the gateway, full Postgres access via cms_public role.
Tier 2 — Deno sandbox
AI-authored. Spawned with --no-read --no-write --no-net. Owner click-to-activate. Rendered into Shadow DOM Web Components so plugin CSS can't leak.

Locked surfaces & confirmation gates

Auth and deploy logic are excluded from AI regeneration. Hard-to-revert ops require an explicit human click.

  • Locale add / delete — two-step propose + Owner Approve.
  • Layout delete — cascades to every page; gated.
  • Plugin activate — sandbox-escape risk; Owner-only.
  • site_defaults change — affects every future create; gated.
03

Hosting options

Same architectural shape across providers — Cloud Run-style container + managed Postgres + object storage + CDN + WAF + IAP. Bring your own cloud account; Caelo provisions in-place.

Available today

GCP

~$30/mo floor

Cloud Run · Cloud SQL · Cloud Storage · Cloud CDN · Load Balancer · Cloud Armor

LB-IAP gates the admin endpoint. Full WAF + DDoS protection. Production-grade default.

GCP-Firebase

~$13/mo floor

Cloud Run · Cloud SQL · Firebase Hosting (no LB)

Native clean URLs, preview channels per chat branch, atomic rollback. IAP-on-Cloud-Run gates the admin. Cheapest path to production.

Self-hosted

Hardware cost

Docker Compose · Postgres · Caddy · admin · gateway

One Linux box. Auto-Let's-Encrypt via Caddy. Same provisioning wizard, same lifecycle commands.

Planned

AWS

Lambda or Fargate · RDS · S3 · CloudFront · ALB · AWS WAF · Cognito

Cognito gates the admin. Same provisioning shape — single command, idempotent reruns.

Azure

Container Apps · Azure DB for Postgres · Blob · Front Door · WAF

Easy Auth via Entra ID gates the admin. Targeting v1.1.

04

Install in one command

The provisioning wizard auto-detects cloud auth, prompts for domain + owner email, shows a cost estimate, and provisions end-to-end on your own cloud account in under twenty minutes. Idempotent re-runs.

~/projects · zsh
$ bunx @caelo-cms/provisioning
✓ Detected gcloud auth (project: acme-prod, account: ops@acme.io)
✓ Caelo v0.9.4 · provider preset: gcp-firebase

? Domain                  › acme.dev
? Owner email             › ops@acme.io
? AI provider             › anthropic
? Region                  › europe-west1

Cost estimate (monthly, idle):
  Cloud Run (min-instances=0)     $0.00
  Cloud SQL (db-f1-micro)         $9.20
  Firebase Hosting + egress       $0.50
  Cloud Storage (media, 5 GB)     $0.13
  Secret Manager + logging        $3.00
  ─────────────────────────────────────
  Total floor                    ~$12.83 / mo

? Proceed? [y/N] › y

→ Enabling 11 APIs........................ 47s
→ Provisioning Cloud SQL.................. 4m 12s
→ Creating service accounts & IAM......... 18s
→ Building admin + gateway images......... 3m 41s
→ Deploying Cloud Run services............ 1m 06s
→ Configuring Firebase Hosting............ 22s
→ Seeding owner + writing site_defaults... 4s
→ Running smoke tests..................... ok

 Deployed in 14m 38s
  Admin   https://admin.acme.dev
  Public  https://acme.dev
  Owner login emailed to ops@acme.io

$ _
Lifecycle commands
caelo statuscaelo upgradecaelo backupcaelo restorecaelo rotate-secretcaelo destroy
View on GitHub MPL 2.0 · self-host or BYO cloud · no vendor account required