How it works

Justflows is one Express app. It serves three surfaces from the same process: the admin at /admin (server-rendered React that hydrates in the browser), the public HTML site (theme templates), and JSON APIs under /api.

Admin rendering#

Every admin route is rendered on the server and hydrates in the browser. Shared shell data and each route's first reads are embedded as escaped, request-scoped state, so the first paint does not wait on duplicate Fetch/XHR. Later clicks still use the API. Production archives ship both admin-ui/dist/client and admin-ui/dist/server — site owners never run a frontend build. Admin documents send X-Robots-Tag: noindex, nofollow, noarchive.

A request, compared#

On PHP-FPM, nginx hands the request to a worker that starts a fresh application context, autoloads hundreds of files, registers every plugin, renders, then throws the context away. On Justflows the process is already running.

1. 1

   The request reaches the warm process

   No per-request boot. Gzip, security headers, sessions, and cache middleware are already in place.

2. 2

   Cached public pages return immediately

   A full-page HTML hit (page:html:) never touches the database or the block renderer. Preview mode and logged-in editors bypass this layer.

3. 3

   Otherwise the router resolves content

   Published pages and posts are loaded (often from the object cache), blocks render, menus and theme mods are applied, and the response goes out. The process stays warm.

What boots once#

• Active plugins — loaded by the plugin runtime before deferred routes register.
• Hooks — actions, gates, and filters stay registered for the life of the process.
• Block registry — 24 core.* blocks, the built-in Post List block, plus any active plugin blocks.
• jf-cache — one cache singleton per process (memory or filesystem).

Install vs running#

Until the browser wizard finishes, mutating APIs and the public site are blocked. /install walks through database, site identity, and the first administrator. It writes STATE=INSTALLED, runs migrations, and creates default settings (active_theme=justflows.default, site_public=false). After that, unauthenticated visitors see under-construction unless an admin publishes the site.