What is Xentium
What is Xentium
Section titled “What is Xentium”Why this exists
Section titled “Why this exists”Most community software people actually run today is old. A lot of it is solid, but it grew up as PHP in the 2000s and you notice it everywhere: templates you edit as strings, plugins that patch core and break on every update, permission systems nobody fully understands, and a frontend that was added later.
I kept wondering what a forum and CMS would look like if you started from zero today, with the tools we have now and none of that history. Xentium is my answer to that. TypeScript on both ends, Postgres, a React frontend, a typed plugin API, and themes that are data instead of code.
It’s a modular monolith on purpose. One codebase, one deploy, two processes (the API and a background worker). You don’t need Kubernetes to run a community of 200 people, and you shouldn’t have to learn it to contribute.
What’s in it
Section titled “What’s in it”Out of the box you get a CMS: articles with a TipTap editor, revisions, nested categories with access control, comments, tags and full-text search on Postgres. Around that sits what a community needs: profiles, follows, profile walls, notifications (in-app and email), and a progression system where levels are just groups.
A few parts I’m particularly happy with:
- Sign-in. Passwords, passkeys, sign-in links and OAuth all finish in the same function, so there’s exactly one place where sessions get created. Access tokens live in memory, refresh tokens are httpOnly cookies that rotate on every use.
- Moderation. Warnings and bans always come from templates you define, everything lands in an append-only log, and the abuse detection (login bursts, multi-accounts, ban evasion) only opens a case. A human decides.
- Theme Studio. Pages are block documents stored in the database. You drag blocks around in a live preview, it autosaves a draft, and you publish when you’re ready. A theme package is layouts plus design tokens, so installing a theme can’t run code on your server.
- Plugins. They get their own routes, migrations, permissions, admin pages and blocks through a typed SDK, without touching core. Disable one and your layouts keep its blocks, so turning it back on puts everything where it was.
It ships in English, German, Spanish, French and Portuguese. The API itself only speaks machine keys and error codes, so translations stay in the frontend.
Trying it
Section titled “Trying it”Installing should take a minute, not an afternoon. On a server it’s one command:
npm create xentium@latest my-communityIt checks the machine first (and tells you the exact fix for anything missing), sets up
Postgres and Redis, installs the app and hands you a URL. The rest happens in a browser
wizard: it tests your database, generates the secrets, writes .env, applies the schema
and creates your admin account. You never edit a config file and you never restart
anything. For working on the code itself, ./xentium.sh does the same thing locally
(see Quick start).
The framework underneath is on npm too, under @xentium:
errors, auth, settings, rate limiting, uploads, the plugin engine. Core runs on exactly
these packages, so you can use them in your own Express app without taking the CMS along.
Where it’s at
Section titled “Where it’s at”Alpha. It runs fine, and nothing merges without the full typecheck, lint, test and build passing. Still, APIs can change between alphas and you’ll hit rough edges. Please don’t move your 20,000-member forum onto it yet. If you want to try it with real data, there are importers for WordPress, phpBB, XenForo, vBulletin and WoltLab, and users keep their passwords where the source allows it.
About money, so it doesn’t come as a surprise later: core is MIT and complete on its own. We also sell a few official plugins (forum, messaging and others) through our marketplace. They’re ordinary plugins built on the same API anyone can use, and we don’t move core features into them.
Want to help?
Section titled “Want to help?”Good places to start: translations, importers for other platforms, accessibility, tests and docs. Or skip core entirely and build a plugin or a theme, that’s what the SDK is for. The Contributing section has the workflow, and issues and questions on GitHub are always welcome.
Tech stack
Section titled “Tech stack”| Layer | What we use |
|---|---|
| Backend | Node.js 24, Express 5, Prisma 7, PostgreSQL 17, Redis 7 + BullMQ, Zod, Pino, argon2, jose |
| Frontend | React 19, Vite, React Router 7, TanStack Query, React Hook Form + Zod, SCSS, TipTap |
| Tooling | pnpm workspaces, Turborepo, ESLint + Prettier, Vitest + Supertest, Playwright, Docker Compose |