Home
A production-ready ColdBox HMVC starter template for BoxLang - authentication, RBAC permissions, API tokens, dark mode, and an Alpine-powered admin panel, ready to build on.
A production-ready ColdBox HMVC starter template for BoxLang - the modern, dynamic JVM language. It ships with authentication, role-based permissions, API tokens, dark mode, and an Alpine-powered admin panel, so you spend your first day building features instead of scaffolding auth.
Install BoxLang, clone the template, run migrations, and be looking at the login screen in under ten minutes.
Application code lives in app/, fully separated from the public webroot in public/ - enhanced security by default.
Session auth via cbauth, @secured handler annotations, CSRF rotation, JWT support, and a resource:action permission model.
BaseEntity/BaseService conventions on top of cborm, migrations via cfmigrations, and qb for anything raw SQL does better.
Server-rendered BXM views, sprinkled with small Alpine components, compiled by Vite with hot module reload.
TestBox unit specs for every entity and service, plus integration specs that exercise real HTTP requests.
Environment variables for the essentials, DB-backed admin settings for everything else - no redeploy needed to change them.
A real go-live checklist, Docker support, and a choice of CommandBox or the BoxLang MiniServer.
See it, don't just read about it
CB Genesis's request lifecycle, from browser to database and back:
sequenceDiagram
Browser->>+public/Application.bx: HTTP Request
public/Application.bx->>+ColdBox Bootstrap: loadColdbox()
ColdBox Bootstrap->>+Main Handler: onRequestStart
Main Handler->>+Router: Match route
Router->>+Target Handler: Dispatch event
Target Handler->>+Service Layer: Business logic
Service Layer->>+ORM / qb: Data access
Target Handler->>+View / Layout: Render response
View / Layout-->>-Browser: HTML + Vite assets
Every admin handler extends BaseSecureHandler and carries a @secured( "resource:action,resource:admin" ) annotation. The firewall enforces it - no hand-rolled if checks scattered through your controllers. See Security & Permissions.
New CRUD module? New setting? New scheduled task? Extending CB Genesis walks through the exact files to touch, in the order the existing code already follows.
Where to go next
Install, configure, migrate, and run the app locally.
The modern app/public split, the full project tree, and the request lifecycle.
Every handler, every route, and the conventions tying them together.
cbsecurity, cbauth, CSRF, JWT, and the resource:action permission model.
Entities, services, migrations, and seed data.
Alpine.js components, SCSS structure, and the Vite pipeline.
Add a CRUD module, a permission, a setting, or a scheduled task.
Production build, Docker, BoxLang MiniServer, and a go-live checklist.
Built with BX Sites
This documentation site is generated with BX Sites - the official BoxLang static site generator - straight from the Markdown in this repository's docs/ folder, using the default bootstrap theme. See .github/workflows/docs.yml for how it's built and published on every push.