Technical summary
Libeskop is the content management platform Liberyus builds for the sites and apps it designs. This page is a short summary for technical teams and decision makers.
Updated: 8 November 2026
Architecture
- Headless architecture: API, admin panel and site are separate parts; the same content serves your website and your mobile app.
- API: .NET 10 (LTS), Entity Framework Core 10, PostgreSQL 16.
- Panel: React 19, TypeScript, Mantine 8; drag-and-drop ordering and a rich text editor.
- Site: server-side rendered pages (SSR). Content is fetched on the server; forms work even with JavaScript turned off.
- Docker deployment; containers run as non-root users, health check endpoints, arm64 and amd64 support.
- Cache-friendly responses and CDN-ready cache headers.
- Modular: core modules plus optional modules you turn on when needed. Turning a module off never deletes data.
Content model
- Page-centred model: each page is an ordered list of sections from a catalogue (hero, slider, text and media, card list, FAQ, stats, video, form and more). The order on the site matches the panel.
- Collections and fields defined in the panel; more than 20 field types such as text, rich text, number, date, file, relation, list and nested group.
- Field rules: required, hidden, read-only, default value, validation and conditional display. Every field has a help line that says what it does.
- Draft, published and archived states; revision history and restore for every record.
- Scheduled publishing and updates; signed, time-limited draft preview links.
- Media library: folders, image resizing and format conversion, alt text.
- Forms: inbox, e-mail notification, CSV export, file attachments, consent checkbox and spam protection.
- Bulk import from Excel and CSV, one column per language.
- News, events, campaign pages, careers, pop-up and cookie banner modules.
Languages and multi-site
- The structure is built once; only the text changes per language. A field without a translation falls back to the default language.
- Each language has its own address; the sitemap carries language alternates (hreflang).
- With the multi-site module one panel manages several sites and subdomains.
Search engines and AI search
- SEO fields (title, description) per page and record.
- Automatic sitemap.xml and robots.txt managed in the panel; a no-index switch for pre-launch environments.
- llms.txt and structured data endpoints for AI search.
- IndexNow notifies search engines of new and changed pages.
- Rich text is sanitised; heading order is kept and images load lazily.
- Home page of the site starter kit, Lighthouse in our own test environment: performance 96, accessibility 100, best practices 100, SEO 100.
Security
- Short-lived session tokens kept in secure (httpOnly) cookies, not in browser storage. CSRF protection on write requests.
- Two-step sign-in, strong password rules, temporary lock after failed attempts. A new sign-in ends the old session.
- Roles and permissions: administrator, editor, author and custom roles; permissions per screen, collection, action, field and record. Nobody can raise their own rights.
- Actions taken in the panel are logged.
- Rate limits on sign-in and form endpoints; security headers (HSTS, CSP, nosniff, Referrer-Policy, Permissions-Policy).
- Dangerous file types are rejected on upload; files sent through forms are never public.
- Built-in security scan and speed report in the panel. A security check before launch is part of every delivery.
- No secrets in the source code; every installation gets its own random keys.
API and integrations
- Public REST API: collections, records, files, languages, forms, campaign pages, pop-ups and cookie settings. Only published content is returned.
- Google Analytics 4, Google Tag Manager and Bing fields; tracking code loads only after cookie consent.
- AI helpers: translation, SEO suggestions, summaries, writing, page drafts and image alt text. They run with your own OpenAI or Anthropic key, stored encrypted. Publishing is always your decision.
- E-mail (SMTP), CORS and custom code settings in the panel.
Mobile
- The panel works well on phones: stacked layout, large touch targets, touch-friendly ordering.
- For mobile apps: the same content API, app settings, device registration and push notification campaigns.
Hosting and delivery
- Two options: Liberyus hosts and updates it, or your site is delivered with its full source code to your own server.
- Delivery package: source code, Docker setup, database backup, uploaded files, restore script and setup guide. No secrets included.
- One-command installation and a first-run wizard in the panel (site, languages, modules, contact details).