OC-CORE-CATALOGcore
Catalog
Products, categories, prices, stock and images — the base every shop module builds on.
- Prices in the currency’s smallest unit — no float errors
- Compare-at (sale) price
- Title and description per language
OCMS · version 0.1
Your store,
part by part.
On your own server: a small, secure core — and every capability is a separate module: catalog, cart, payment gateways, SMS. Install only what you need, and arrange every page with the page builder, no code.
The demo admin is read-only: open any screen, nothing can break. Sign in to the demo admin: demo@ocms.ir / demo-ocms-readonly
18languages, with full right-to-left for Persian, Arabic, Hebrew
3ready themes with editable design tokens
5screen sizes in the page builder, phone to desktop
0lines of server-side Next.js
01 / after install
What you get, exactly, after installing
Every image on this page is captured from OCMS itself, not a mock-up. Open the same screens in the demo.
02 / modules
Every capability is a part
The module is the unit of sale: each has a part number, a list of permissions shown to you before install, and its own settings. A module you haven’t installed doesn’t even have an API route.
OC-CORE-CARTcore
Cart
Server-side cart: the price is always recomputed from the catalog — the browser never sends one.
- Abandoned carts are cleaned up automatically
- Refuses to mix currencies
OC-CORE-CHECKOUTcore
Checkout & orders
Orders, stock reserved at checkout, and the full order lifecycle from paid to delivered and returned.
- The last item is never sold twice
- Unpaid orders expire and restock
- Payments verified server-to-server
OC-PAY-MANUALfree
Bank transfer & cash on delivery
Offline methods; the order waits until staff confirm the money arrived.
- Configurable holding time
PAY-ZARINPALpaid
Zarinpal gateway
Iranian (Shetab) card payments via Zarinpal REST v4. Amount from the order record, verified server-to-server.
- Sandbox only when explicitly turned on
- An unclear answer keeps the payment open, never fails it
PAY-STRIPEpaid
Stripe Checkout
International cards and wallets on Stripe’s hosted page — card data never touches your server (PCI SAQ A).
- Signed webhook
- Stripe’s currency rules (JPY, ISK, KWD…) applied exactly
OC-NEXTComing
Coming
Built on the same contracts:
- SMS (OTP and notifications)
- Shipping
- Discounts and coupons
- Blog
- Advanced search
- Customer accounts
03 / features
Under the hood
A 100% arrangeable page builder
Every page — home, product, category, cart, checkout — is made of blocks. Drag, reorder, tune per screen size and per language. Draft and publish are separate and every revision is kept.
- 5 sizes: phone to wide desktop
- Per-language text on the same block
- Undo/redo, revision history
Multilingual from day one
Not a plug-in on top: language is in the data model. Calendars, digits and currency follow each language, and right-to-left works without a second stylesheet.
PWA
The storefront installs on a phone and shows a decent page offline. Money paths are never cached.
Themes made of tokens
A theme is a set of colour, spacing, font and shadow tokens you edit in the admin. Tokens are validated before saving, so no CSS can be injected.
Self-hosted, one command
Any Linux server with Docker. PostgreSQL database. Your data and keys stay on your server.
04 / security
Security is the default, not an add-on
These aren’t conventions someone might forget; the core enforces them.
No server-side Next.js or RSC
Fastify + zod API; a route without a schema or a declared permission is refused at boot.
Two-factor sign-in
6-digit codes from a phone, single-use recovery codes, account lock after 10 failed attempts.
Tamper-evident audit log
Every admin change is recorded; rows cannot be edited or deleted, even by the database owner, and a hash chain shows any tampering.
Strict CSP
No unsafe-inline; the admin runs with Trusted Types. HTML output is escaped by default.
Money stays on the server
Amounts come from the order record, payments are verified server-to-server, webhooks are signed. No number is taken from the browser.
Signed modules
Paid modules activate with a signed licence and only get the permissions they declared.
05 / languages
18 languages, admin and storefront
- فارسیfa
- العربيةar
- עבריתhe
- Englishen
- Deutschde
- Françaisfr
- Españoles
- Italianoit
- Portuguêspt
- Русскийru
- Türkçetr
- Azərbaycanaz
- 中文zh
- 日本語ja
- 한국어ko
- हिन्दीhi
- Kiswahilisw
- Hausaha
06 / themes
Three themes, one system
Atelier for refined brands, Bazaar for large catalogues, Kiln for single-brand direct sales.
Each theme installs its own signature home page and ships its own stylesheet; both are made of blocks, so everything is editable in the page builder. The images use the installer’s sample products.
07 / install
From an empty server to a store in four steps
Prepare a server
Any Linux with Docker and Docker Compose. At least 2 GB RAM and 10 GB disk.
$ docker compose versionGet the package and run it
Unpack the install package and run the script with your domain. The database password is generated for you.
$ cd ocms/deploy $ ./install.sh shop.example.com
Take the setup code
At the end the script prints a one-time code. It proves you own the server.
$ docker compose exec ocms ocms setup-codeFinish in the browser
Go to https://your-domain/install: store name, languages, currency, theme and the admin account. Sample products are optional.
08 / buy
Get the core, buy only the modules you need
Prices are being finalised and will be published here.
Core
Soon
- Catalog, cart, checkout and orders
- Bank transfer and cash on delivery
- Page builder, 3 themes, 18 languages, PWA
- Security updates
Paid modules
À la carte per module
- Zarinpal gateway
- Stripe gateway
- and the modules on the way
Install & support
Soon
- Installation on your server
- Domain and SSL
- Gateway setup
A way to contact us and buy will be placed here soon. Meanwhile, try the demo. Open the demo