Configuration

Settings in the admin. Plain JSON underneath.

Every setting has a screen, and every screen saves to a readable file in config/. Back it up, compare it, put it in version control - there is no database of settings to export.

Site SettingsJSON filesSecrets kept apart

Site Settings

config/site.json - the title and address, email, SEO defaults, the footer, cookie consent, breadcrumbs and back-to-top.

Content > Theme

config/theme.json - the site and admin themes, day and night, fonts and region overrides.

Site menus

config/menus/ - one file per menu, and menu-locations.json for where each one goes.

Layouts

config/presets.json - the page layouts and what each one shows.

System > Search

config/search.json - the site search, where it opens and what it finds.

Marketplace and Tools

config/plugins.json and tools.json - which Tools are on, and their settings.

The whole site, one screen.

The site's name, tagline and address
Outgoing email, with a test send - and a warning while no mail server is set
Default page titles and descriptions for search engines
The footer: its layout, a blurb, copyright, social links and the Reduce motion control
Cookie consent, breadcrumbs and a back-to-top button
The screen the admin opens on
Your own CSS, loaded last so it always wins

Nine layouts, and every page can choose.

Default, landing, blank, with sidebar, minimal, article, product, dashboard and wide. A page picks its layout in its own settings, and can also have its own theme, width, breadcrumbs, page contents, status and visibility.

Visibility is per page. Public, private, a role and everyone above it, that role only, or a list of roles. The check happens on the server, so a hidden page is never sent.


How long a sign-in lasts is yours to set.

config/auth.json sets how long a sign-in, a session and a password-reset link last - 15 minutes, 7 days and an hour out of the box - and how hard passwords are hashed. The rest is on Users and security.

Port, uploads and who may call in.

config/server.json holds the port and host, the largest upload, cross-origin access (including public paths other sites may call) and whether only signed Tools may be installed. Switching a Tool on or off restarts the site for you under PM2 or the Manager.

Secrets stay out of the JSON. .env holds the signing secret (JWT_SECRET, required) and NODE_ENV, and optionally PORT, LOG_LEVEL and TRUST_PROXY (loopback behind a local proxy). Sites run by the Manager get theirs from it. Settings files can be shared; .env never is.

Files first. A database only if you ask.

Everything works on files. When a collection outgrows them, npm run pro enable connects MongoDB (stored in config/connections.json), and you choose which collections move - one at a time, from the collection's own settings. Actions need it; nothing else does.

The updater knows what is yours.

Updating Domma CMS adds new settings to the files it owns and leaves your choices alone. Your site settings, theme, menus and Tools are never overwritten.