Panel tour
CPalius has two separate admin panels. The split is deliberate: the person who produces content and the person who runs the system should not see the same options on the same screen.
| Studio | AACP | |
|---|---|---|
| Address | /admin |
/aacp |
| Audience | Editors, moderators, content teams | System administrators, developers |
| Subject | Posts, pages, media, menus, forum, module content | Modules, updates, security, users, languages, cache, backup, cron |
| Access capability | admin.dashboard.view |
system.aacp.access |
AACP stands for Admin Control Panel. AACP is rendered without depending on modules or themes: it opens even if all modules are quarantined. If the database is also down, the /aacp/recovery recovery console takes over (if a recovery token is defined in .env).
Menu grouping
In both panels the menu has two levels: a folder (hub) on top and items beneath it. In AACP, none of the drop-down menus links to a page; they only open their submenu, and each screen is a child item. Nobody builds the menu by hand; every controller method registers itself with the #[CpAdminMenu] attribute. Items are collected at build time; on every render, is the module active and does the user have the capability are filtered. A user without the capability never sees the menu item.
AACP menu
| Folder | Contents |
|---|---|
| Dashboard | System summary and the status of cache / performance services (Redis, Memcached, Varnish, Nginx PageSpeed) |
| System | Quarantine, system settings, updates, languages, email templates |
| Modules | Modules (active ones by default; enable, disable, delete), module store, module add-ons (switch sub-features on/off), module editor |
| Security Center | Overview, live threats, audit findings, security settings, telemetry settings, malware scanner |
| Users | All users, administrators, members, editors, pending registrations, identity changes |
| Appearance | Themes, theme options, Studio appearance, theme editor, fonts, theme store, home page setting |
| Structure | Fields (Field API), display modes, resources, vocabularies (taxonomy), text formats, URL aliases, path patterns |
| Automation | Cron, queue, hooks, webhooks, API keys |
| Maintenance | Backup, storage targets, performance, rebuild, logs, recycle bin |
| Tools | Tool items added by modules (e.g. visitor statistics, Yandex Metrica) |
A module cannot add a top-level menu item to AACP. Any module item with no parent given (or attached to another module's item) is automatically placed in the Tools folder at build time. A module that explicitly chooses one of the core's folders as its parent keeps that placement. The aim is to keep the AACP sidebar from sprawling as the number of modules grows.
Studio menu
The Studio menu is presented in groups (e.g. Content, Appearance). Items from the modules that ship with the core:
- Dashboard: content summary and shortcuts
- Blog: posts, comments, categories, tags, widgets, blog settings
- Pages: page list, page field groups, page settings
- Media: media library
- Menus: front-end menu management
- Forum: structure, moderation, people, permissions
- Widget: widget areas
- Import: data migration screen
- Modules such as Messages, Showcase, Portal, Docs add their own menus
These lists are not fixed; they change according to which modules are active and the user's capabilities.
Live search
Both panels have a live search in the top bar (results arrive as you type). Results are collected from three sources: content, users and pages in the panel menu. Modules can add their own search providers; see Search and SEO.
Which panel do I use for which job?
| Job | Panel |
|---|---|
| Writing a post, editing a page, uploading an image | Studio |
| Moderating comments or forum messages | Studio |
| Building a menu | Studio |
| Enabling a module, installing an add-on from the store | AACP |
| Updating the system, taking a backup | AACP |
| Editing roles and permissions | AACP |
| Adding a language, editing interface translations | AACP |
| Defining fields, setting up a vocabulary (category list) | AACP |
| Webhooks, API keys, cron | AACP |
Security in the panel
- AACP goes through a separate gate check; a Studio capability does not grant an AACP capability.
- Login is protected by rate limiting and optional CAPTCHA.
- Admin POST requests require a CSRF token.
- Important admin actions are written to the audit log.