Templates & the gallery

Templates are curated starter sites — small, self-contained static pages you can clone into your own subdomain and then make your own in the studio. They are the fastest way to go from an empty subdomain to a real page.

Using a template (for site owners)

1. Open Gallery in the Console (or Browse templates from the dashboard).
2. Browse the grid; filter by category with the chips at the top.
3. Click a card's thumbnail (or Preview) to see the starter running live in a sandboxed window. The preview is isolated — it runs in its own origin and can never touch your Console session.
4. Click Use this template, pick a subdomain and domain, and Create site.
5. You're redirected to your dashboard, where the new site appears while it's built. Once it's live, open Manage files / the studio to edit it.

Applying a template to an existing site

You can also drop a template's files into a site you already own. If the site already has files you'll be asked to confirm before they're overwritten. A clone that wouldn't fit your storage quota is rejected before anything is written, so a failed clone never leaves your site half-changed.

What happens under the hood

A template is just static files. Cloning copies them into your webroot through the exact same path as a normal upload: every file is confined to your site root (no path traversal), screened against the upload allowlist (so only static assets are ever copied — never anything executable), written atomically, and charged to your storage quota. The starter's template.json manifest and its preview image are metadata and are not copied into your site.

Contributing a starter (for instance maintainers)

Starters live in the repository under templates/. Each subdirectory is one starter. See templates/README.md for the full contract; the essentials:

• Layout — one directory per starter, named with its slug (lowercase letters, digits, hyphens). It holds template.json (the manifest), an index.html entry page, a preview.svg/preview.png thumbnail, plus any other static assets.
• Manifest — template.json carries slug, name, description, category, and preview (the thumbnail's path). php artisan db:seed --class=TemplateSeeder reads every manifest and upserts a published row; re-running is idempotent.
• Static-only rule — a starter may contain only files whose extension is on the upload allowlist. No PHP, no scripts, no dotfiles, no symlinks. This is enforced in CI by tests/Security/TemplateStaticContentTest, so a starter that smuggles in executable content fails the build. User content is always served inert regardless, but starters are held to the rule directly.

Admins can also create and manage templates through Admin → Templates in the Console; the source_path there is confined to the configured templates root.