October publication has been published as an update.

compose.yml

@@ -31,7 +31,6 @@ services:
       - ./docker/nginx/ssl:/etc/nginx/ssl:ro
     ports:
       - "${NGINX_PORT}:80"
-      - "${NGINX_PORT_SSL}:443"
     restart: always
     networks:
       - webifycms-site

docker/nginx/nginx.caddy.conf

@@ -3,10 +3,6 @@ server {
     client_max_body_size 10M;
 
     listen 80;
-    listen 443 ssl;
-
-    ssl_certificate     /etc/nginx/ssl/server.crt;
-    ssl_certificate_key /etc/nginx/ssl/server.key;
 
     server_name _;
     root /var/www/html/public;

resources/posts/2026-10-three-pieces-moving-together.md

@@ -0,0 +1,173 @@
+---
+title: 'WebifyCMS October Update — Infrastructure Work Underway'
+slug: webifycms-october-update-infrastructure-underway
+date: '2026-10-25'
+category: 'Update'
+---
+
+# WebifyCMS October Update — Infrastructure Work Underway
+
+Since the [last update](/publishing/webifycms-alpha-what-you-can-do-right-now), development has continued on the three pieces that unlock the first beta: `ext-user` (infrastructure layer), `ext-admin` (slot-based admin panel), and `theme-canvas` (the official default theme). This post shares where each stands honestly — what's done, what's in progress, and what's next.
+
+## The Three Pieces, One Goal
+
+The first beta arrives when the user experience becomes real end-to-end. That experience spans:
+
+- **`ext-user` infrastructure** — concrete repositories, database schemas, HTTP endpoints, and DI wiring turning the completed domain layer into a running extension.
+- **`ext-admin`** — the slot-based administration panel where administrators manage users, roles, and permissions.
+- **`theme-canvas`** — the official default theme rendering the front-end: login, registration, profile, and account pages.
+
+None works in isolation. The admin panel will consume `ext-user` endpoints. The theme will consume the same endpoints. Both need the infrastructure layer. So they are being developed together, and will ship together.
+
+---
+
+## ext-user — Infrastructure Layer: Early Days
+
+The domain layer has been complete since the [August update](/publishing/webifycms-user-extension-update-domain-complete-infrastructure-next) — entities, value objects, domain services, guards, strategies, policies, and a full unit test suite with architectural boundary enforcement.
+
+The infrastructure layer is now the active focus. Here is the current state:
+
+### Done
+
+- **Repository interfaces** exist in the domain; concrete implementations are being written in `src/Infrastructure/Persistence/Eloquent/`.
+- **Migration stubs** created for the five core tables: `users`, `sessions`, `challenges`, `roles`, `role_assignments`. Columns are being finalized.
+- **Extension bootstrap** — `UserExtension` class registers the extension with `ext-base`, publishes console commands, and registers the migration directory.
+- **Route group** registered under `/user` with the `web` middleware stack.
+
+### In Progress
+
+- **Eloquent models & repositories** — wiring `UserRepository`, `SessionRepository`, `ChallengeRepository`, `RoleRepository`, `RoleAssignmentRepository` to the database.
+- **HTTP controllers** — thin controllers for register, login, verify-challenge, refresh, logout, profile, password change. Each delegates to an application service.
+- **Validation & rate limiting** — using standalone `illuminate/validation` and a cache-backed rate limiter (filesystem default, Redis optional).
+- **Console commands** — `user:create-role`, `user:assign-role`, `user:list` scaffolding done; logic being filled in.
+
+### Not Started
+
+- Email queue integration (verification, password reset)
+- Session concurrency limits, remember-me token rotation
+- Admin audit log for user/role changes
+- End-to-end browser tests for critical auth flows
+
+### Architectural Discipline Maintained
+
+Every infrastructure class lives in `src/Infrastructure/`. The domain remains pure — zero framework references, zero database calls. `phpat` architectural tests run in CI and will fail if boundaries are crossed. The same discipline that hardened `ext-base` is enforced here.
+
+---
+
+## ext-admin — Slot System: Design Complete, Implementation Started
+
+`ext-admin` has a clear architectural pattern: **slots** — named insertion points in the layout (top navigation, sidebar, dashboard grid, settings tabs). Extensions register *slot items* through a provider API. This means `ext-user` will contribute its own sidebar entry, dashboard widget, and settings tabs without `ext-admin` knowing `ext-user` exists.
+
+### Done
+
+- **Slot infrastructure** — `SlotRegistry`, `SlotItem` value object, provider registration mechanism.
+- **Base layout** — server-rendered PHP templates with a dashboard grid, sidebar, top navigation.
+- **Alpine.js integration** — lightweight interactions (modals, confirmations, tab switching) without a build step.
+- **Auth middleware** — `AdminAuth` middleware checking for authenticated session + `admin.access` permission (via role assignment from `ext-user`).
+
+### In Progress
+
+- **Dashboard widgets** — composable grid where extensions register widgets.
+- **Users index page** — paginated, searchable table (backend query + frontend template).
+- **User detail page** — tabbed layout (Profile, Sessions, Roles, Activity) with slots for extension contributions.
+- **Roles & Permissions CRUD** — role management, visual permission matrix, assignment UI.
+- **Settings tabs** — tabbed layout where each extension registers its configuration section.
+
+### Not Started
+
+- Frontend asset pipeline (Vite config for admin-specific assets)
+- Responsive sidebar, dark mode, accessibility audit
+- Widget persistence (user preferences for dashboard layout)
+
+---
+
+## theme-canvas — Default Theme: Repository Created, Pages Planned
+
+`theme-canvas` is the official default theme. It will ship with the first beta and power the front-end unless replaced.
+
+### Done
+
+- **Repository initialized** — `webifycms/theme-canvas` exists with base structure.
+- **Theme extension bootstrap** — registers template namespace, asset manifest, view composers.
+- **Base layout inheritance** — extends `ext-base` layout (HTML skeleton, CSP headers, asset helpers).
+
+### In Progress
+
+- **Vite + Tailwind setup** — minimal build, utility classes, custom components (forms, buttons, cards, badges).
+- **Page templates** — login, register, password reset (request/challenge/reset), email verification, profile/account, active sessions list.
+
+### Not Started
+
+- Fingerprinted production asset serving
+- Theme configuration (colors, typography, logo) via admin settings
+- Accessibility audit, RTL support
+
+---
+
+## How They Will Click Together
+
+The integration points are designed to be minimal and contract-based:
+
+1. **`ext-user` exposes contracts** — repository interfaces, DTOs, route names. No implementation details leak.
+2. **`ext-admin` consumes contracts** — injects `UserRepository`, `RoleRepository`, calls route helpers by name.
+3. **`theme-canvas` consumes contracts** — uses the same route names, DTOs for form binding, validation rules.
+4. **Shared middleware stack** — all three use the `web` middleware group (CSRF, session, rate limit, encryption) from `ext-base`.
+
+This is Clean Architecture in practice: the domain defines *what* happens, the infrastructure defines *how*, and the presentation layers (admin, theme) define *how it looks* — each replaceable without rewriting the others.
+
+---
+
+## What You Can Try Today
+
+The application repository wires all three extensions together, but the infrastructure layer is still incomplete. You can explore the code and run the test suites:
+
+```bash
+git clone https://github.com/webifycms/app.git
+cd app
+composer install
+npm install
+npm run build
+# Migrations will run once ext-user infrastructure lands
+php bin/console migrate
+php -S localhost:8000 -t public
+```
+
+Currently this gives you the `ext-base` foundation (routing, DI container, console, logging) and the skeleton of `ext-admin` and `theme-canvas`. The user endpoints return 501 Not Implemented until the repositories and controllers are wired.
+
+> **Note:** This is alpha. Schemas will change, APIs will shift, UI will evolve. The architecture is stable, the domain test suite passes, and the integration plan is solid.
+
+---
+
+## What Comes Next (Next 4–6 Weeks)
+
+The remaining work is finishing, not starting:
+
+| Area | Focus |
+|------|-------|
+| **ext-user infra** | Complete Eloquent repositories, controllers, validation, rate limiting, console commands |
+| **ext-admin** | Dashboard widgets, users index/detail, roles CRUD, settings tabs, asset pipeline |
+| **theme-canvas** | Page templates, Vite/Tailwind build, asset fingerprinting |
+| **Cross-cutting** | Email queue integration, session concurrency, remember-me, audit log |
+| **Testing** | E2E browser tests for registration → verification → login → profile → logout |
+| **Documentation** | Extension authoring guide, theme development guide, admin slot API reference |
+| **Installer** | Visual installer scaffolds `ext-user`, `ext-admin`, `theme-canvas` together |
+
+Once those land, we will tag `0.2.0-beta` — the first time WebifyCMS has a complete, manageable user experience.
+
+---
+
+## How to Get Involved
+
+WebifyCMS is fully open source under the MIT license. All repositories are active and welcome contributions:
+
+- **ext-base:** <https://github.com/webifycms/ext-base>
+- **ext-user:** <https://github.com/webifycms/ext-user>
+- **ext-admin:** <https://github.com/webifycms/ext-admin>
+- **theme-canvas:** <https://github.com/webifycms/theme-canvas>
+- **Application (starter):** <https://github.com/webifycms/app>
+- **Documentation:** <https://webifycms.com/docs>
+- **Contributing:** <https://webifycms.com/contributing>
+
+Open an issue, submit a PR, or just clone and explore. The architecture is transparent — every layer, every boundary, every decision is open for discussion.
+
+Stay tuned as the pieces click into place, and thank you for following the WebifyCMS journey.

resources/posts/posts.json

@@ -1,4 +1,13 @@
 [
+    {
+        "title": "WebifyCMS October Update — Infrastructure Work Underway",
+        "slug": "webifycms-october-update-infrastructure-underway",
+        "date": "2026-10-25",
+        "updated": "2026-10-25",
+        "category": "Update",
+        "excerpt": "Development continues on the three pieces that unlock the first beta: ext-user infrastructure, the slot-based ext-admin panel, and the theme-canvas default theme. An honest look at what's done, what's in progress, and what's next.",
+        "file": "2026-10-three-pieces-moving-together.md"
+    },
     {
         "title": "WebifyCMS Alpha — What You Can Do Right Now",
         "slug": "webifycms-alpha-what-you-can-do-right-now",