Carrying on from our previous post where we got Decap working locally as a standalone local content manager, I decided to write a bit more with some Inputs from other 11ty users, and I got noticed on 11tybundle!
Security
People do have their /admins/'s public, and update from smartphones (which requires a CSS change to have the UI usable), which is nice but considering my phone has to charge every day when hardly used, maybe not yet.
Using .eleventyignore instead of .gitignore allows the files to go to your private repo, but not get built. This could be better if you sync between machines and still want /admin to be in your local repos.
11ty also has an internal API to do the same without using .files.
Excluding the folder in Robots.txt was mentioned, from experience, the bad bots read that and use those as targets. there is a specification for LLM/AI to ignore files, but I’m unsure if they’ll take notice.
I am also looking at integrating DecapCMS on a few client sites to allow them to adjust things themselves, so a bit more security is key (and these people haven’t heard of Github let alone be brave enough to navigate a project’s repository), Maybe I can put it on a subdomain then set user access on that via CloudFlare?
Or maybe the security of the repositories through Github is enough?
If you are looking at having /admin/ on your site, you’ll need to scrub local settings from your config. Also your config file will be exposed on Cloudflare pages due to lack of easily accessible access controls.
Issues
I opened a GitHub issue for the preview image URL issue, It seems like something to do with Strega(?) adding ZeroWidthBreak several times into the image’s source URL (I have no idea how/what/why). As I’m finding the editor is providing a better preview than the preview panel, I’m no longer using the preview panel and would look into a custom Preview to match the post to site.
Additional
I wanted to start having drafts synced into the repo, but my starter didn’t support posts marked as draft inside /posts/ folder. So I added this drafts filter to my .eleventy.js from the documentation.
eleventyConfig.addGlobalData("eleventyComputed.permalink", function() {
return (data) => {
// Always skip during non-watch/serve builds
if(data.draft && !process.env.BUILD_DRAFTS) {
return false;
}
return data.permalink;
}
});
Had to also rewrite how file dates are read by my Eleventy setup as Decap’s NOW made it the filename date and added lots of bits on (day, time, seconds and timezone).