dCMS — Distributed P2P CMS on GenosDB

A complete, serverless Content Management System in three files and zero build steps — built on the GenosDB ecosystem. Posts are written in Markdown, synchronized in real time between peers over WebRTC, and protected by a full zero-trust security model: roles are earned through public governance rules, never granted by a server.

What this example demonstrates

GenosDB capability	Where you see it
Zero-trust security	Everyone starts as a read-only guest — writing must be earned
Governance	Public rules promote users automatically while a superadmin is online
Custom RBAC roles	guest → author → editor → admin → superadmin, each tier inheriting the last
ACLs (node ownership)	Every post belongs to its creator — no other peer can rewrite it
Graph data model	A post is two linked nodes: lightweight postMeta ↔ heavy postContent
Real-time queries	One live db.map subscription renders every local and remote change
Identity (SM)	Mnemonic identities with optional passkey (WebAuthn) protection

The role ladder

Roles are defined in the app and advertised openly — the governance engine applies them consistently, signing each promotion with the superadmin's key:

Role	Capabilities	How it is earned
guest	read, sync	You start here
author	+ write own posts (drafts)	10 seconds after joining
editor	+ publish posts	2 posts written
admin	+ delete (moderation)	5 posts written
superadmin	signs role promotions	Configured at initialization

Thresholds are intentionally low so a visitor can watch the full climb in minutes. Losing a condition demotes automatically (last-match-wins evaluation).

Try it

1. Serve the folder with any static server and open it in a browser:

   python3 -m http.server 8080

2. Press 🛡️ Demo superadmin in one browser — this runs the governance engine that signs promotions for everyone else.
3. In a second browser (or private window), press Generate identity, save the phrase, and Login with mnemonic. Watch your role badge climb from guest to author in ~10 seconds — then create posts and keep climbing.
4. Everything syncs live between both browsers: posts, edits, promotions.

The demo superadmin mnemonic is public for showcase purposes only. For a real deployment, replace DEMO_SUPERADMIN in app.js with your own address and keep the phrase private.

Architecture

index.html   UI skeleton (list · post view · editor · identity panel)
styles.css   Plain CSS, no framework
app.js       Everything else, in ~400 commented lines:
             config → db init → identity → posts (ACLs) → live rendering → router

• GenosDB is loaded from a CDN (genosdb@latest) — the database, P2P transport, identity and security layers are the single dependency. Showdown renders Markdown; DOMPurify sanitizes it (posts come from untrusted peers).
• A post's meta and content live in separate graph nodes joined with db.link, so list views stay light — a pattern worth copying in any GenosDB app.
• Governance metrics (postCount) are aggregated into the user's own user:<address> node, where the rules read them.

Author

Esteban Fuster Pozzi (@estebanrfp) - Full Stack JavaScript Developer

License

MIT