Using Hugo as static site renderer is probably the most secure form for a WebSite. Unfortunately, the format of the Markdown files, the local storage and publishing process is far from usable for the average end-user.
With SveltiaCMS and a gitlab CI/CD-Pipeline, that renders the GitLab Repository with the content into a self-contained Caddy container-image, there is no longer any interpreted code on the server, that might be exploited.
backend:
name: gitlab
repo: wherever/name
branch: develop
auth_type: pkce # Required for pkce
app_id: b....9
api_root: https://..../api/v4
base_url: https://....
auth_endpoint: oauth/authorize
media_folder: static/images
public_folder: /assets/images
site_url: https://wolfgang-jung.net
collections:
- name: 'blog'
label: 'Blog'
folder: 'content/posts'
create: true
slug: '{{slug}}'
path: '{{year}}/{{year}}-{{month}}-{{day}}-{{slug}}/index'
summary: "{{title}} — {{date | date('YYYY-MM-DD')}} ({{dirname}}) {{draft}}"
preview_path: 'posts/{{year}}-{{month}}-{{day}}-{{slug}}/'
preview_path_date_field: 'date'
sortable_fields: [title, date]
media_folder: ''
public_folder: ''
editor:
preview: false
fields:
- { label: 'Title', name: 'title', widget: 'string' }
- { label: 'Draft', name: 'draft', widget: 'boolean' }
- { label: 'Publish Date', name: 'date', widget: 'datetime', format: 'YYYY-MM-DDTHH:mm:ssZ', picker_utc: false }
- { label: 'Body', name: 'body', widget: 'markdown' }
With the matching config.yaml for hugo, I can now edit the pages online, without fearing the next Wordpress attack.
