How xibosignage/xibo-cms works
Purpose and entry points
Xibo CMS manages a digital-signage network: content, layouts/playlists/campaigns, scheduling, displays, player communication, administration, and reporting. HTTP entry points are web/index.php, web/api/index.php, web/xmds.php, and preview/PWA endpoints under web/preview/index.php and web/pwa/index.php. Route partitions are defined in lib/routes.php, lib/routes-react.php, lib/routes-spa.php, and lib/routes-web.php.
Web application boundary
The PHP application exposes browser/API controllers and applies cross-cutting middleware for authentication, authorization, state, storage, logging, CSP/CSRF, and feature gating. Controllers map domain operations such as displays, layouts, media, schedules, and reports to factories/entities/services. Key paths: lib/Controller/Base.php, lib/Middleware/ApiAuthentication.php, lib/Middleware/ApiAuthorization.php, lib/Entity/EntityTrait.php, lib/Factory/BaseFactory.php.
React management UI
The primary modern UI is a TypeScript React SPA, bootstrapped by frontend/src/main.tsx, rooted at frontend/src/app/App.tsx, and routed through frontend/src/routes/index.tsx. It has a separate login bundle at frontend/src/login/main.tsx. Pages call typed service clients, which form the frontend/backend contract; session and permission state gate routes and navigation. Key paths: frontend/src/lib/api.ts, frontend/src/services/displaysApi.ts, frontend/src/components/layout/ProtectedRoute.tsx.
Content design and library pipeline
Media, datasets, playlists, layouts/templates, and campaigns are the content model used to construct playback material. Layout design includes an editor host; legacy/editor-specific JavaScript remains separately bundled under ui/. Widget/module definitions are declarative XML plus rendering assets, with PHP providers/renderers supplying data and HTML. Key paths: frontend/src/pages/Design/Layouts/LayoutEditorHost.tsx, frontend/src/pages/Library/Media/Media.tsx, modules/canvas.xml, lib/Widget/Render/WidgetHtmlRenderer.php.
Scheduling and display control
Scheduling binds content/campaigns/layouts to displays or display groups, with dayparts, recurrence, criteria, and sync groups. The React calendar/event UI persists schedule entities through backend APIs. Display-management actions—including commands, screenshots, collection, layouts, and webhooks—are converted into XMR player actions/notifications. Key paths: frontend/src/pages/Schedule/Schedule/Events.tsx, lib/Controller/Schedule.php, lib/XMR/PlayerAction.php, lib/Service/PlayerActionService.php.
Player synchronization and external integrations
Players communicate with CMS through the XMDS SOAP endpoint and versioned SOAP implementations; this transfers registration/status, schedules, dependencies, logs, and statistics. Connectors integrate external content/data sources (weather, finance, dashboard, exchange, SSP), and HTTP safety includes SSRF protection. OAuth application entities/repositories support external application authorization. Key paths: lib/Xmds/Soap.php, lib/Xmds/Soap7.php, lib/Connector/ConnectorInterface.php, lib/Helper/Guzzle/SsrfProtectionMiddleware.php, lib/OAuth/AccessTokenRepository.php.
Persistence, asynchronous work, and reporting
The system uses database migrations for its large relational domain and supports MySQL plus optional MongoDB time-series storage for statistics. Configured tasks execute maintenance, media/image processing, remote dataset fetches, scheduler work, report delivery, and statistics archival. Reports read operational/statistical data and render report definitions/templates. Key paths: db/migrations/20180130073838_install_migration.php, lib/Storage/MySqlTimeSeriesStore.php, lib/Storage/MongoDbTimeSeriesStore.php, lib/XTR/TaskInterface.php, lib/Report/ProofOfPlay.php.
Runtime and deployment
The supported development/deployment model is Docker Compose with Apache/PHP web containers, Composer PHP dependencies, and Node-based frontend builds. Docker initialization generates API RSA/encryption material in library storage; persistent upload/cache/library locations are operational boundaries. CI builds containers and validates PRs. Key paths: docker-compose.yml, Dockerfile, docker/entrypoint.sh, docker/etc/apache2/sites-available/000-default.conf, .github/workflows/build-container.yaml.
Main entry points: BaseFactory.php Content and scheduling domain · App.tsx React management SPA · Base.php Domain controllers · Soap.php XMDS SOAP service
Components 20
Management UI
- Administrators
- React management SPA · Protected routes use session and permission state.
frontend/src/app/App.tsx - SPA routes
frontend/src/routes/index.tsx - Typed API clients
frontend/src/services/displaysApi.ts - Layout editor
frontend/src/pages/Design/Layouts/LayoutEditorHost.tsx
CMS Application
- HTTP entry points · Serves browser, API, player, preview, and PWA endpoints.
web/index.php - Route partitions
lib/routes.php - Security middleware · Applies authentication, authorization, CSRF/CSP, storage, logging, and feature gates.
lib/Middleware/ApiAuthentication.php - Domain controllers
lib/Controller/Base.php - Content and scheduling domain · Manages media, datasets, playlists, layouts, campaigns, schedules, and displays.
lib/Factory/BaseFactory.php - Widget rendering · Declarative modules are rendered through PHP providers and HTML renderers.
lib/Widget/Render/WidgetHtmlRenderer.php
Players & Integrations
- XMDS SOAP service · Versioned SOAP transfers registration, status, schedules, dependencies, logs, and statistics.
lib/Xmds/Soap.php - Player actions · Converts display commands and events into player actions.
lib/Service/PlayerActionService.php - External connectors · Connects weather, finance, dashboards, exchange, SSP, and other sources.
lib/Connector/ConnectorInterface.php - OAuth authorization
lib/OAuth/AccessTokenRepository.php
Data & Operations
- Relational domain database · Schema is established and evolved through migrations.
db/migrations/20180130073838_install_migration.php - Statistics time series · MongoDB is an optional statistics backend.
lib/Storage/MySqlTimeSeriesStore.php - Background tasks · Runs maintenance, processing, fetch, scheduler, delivery, and archival work.
lib/XTR/TaskInterface.php - Reporting · Reads operational and statistical data for rendered reports.
lib/Report/ProofOfPlay.php - Docker runtime · Compose deployment initializes keys and persistent library, upload, and cache storage.
docker-compose.yml
Connections 24
- Administrators → React management SPA: uses
- React management SPA → SPA routes: routes through
- SPA routes → Layout editor: opens
- React management SPA → Typed API clients: calls
- Typed API clients → HTTP entry points: HTTP API
- HTTP entry points → Route partitions: dispatches
- Route partitions → Security middleware: applies
- Security middleware → Domain controllers: guards
- Domain controllers → Content and scheduling domain: operates on
- Layout editor → Content and scheduling domain: edits layouts
- Content and scheduling domain → Widget rendering: renders modules
- Content and scheduling domain → Relational domain database: persists
- Domain controllers → Player actions: issues commands
- Player actions → XMDS SOAP service: notifies players
- XMDS SOAP service → Content and scheduling domain: syncs schedules and status
- XMDS SOAP service → Statistics time series: writes telemetry
- Content and scheduling domain → External connectors: uses external data
- OAuth authorization → Relational domain database: stores tokens
- Background tasks → Content and scheduling domain: maintains and processes
- Background tasks → Statistics time series: archives statistics
- Reporting → Relational domain database: reads operational data
- Reporting → Statistics time series: reads statistics
- Docker runtime → HTTP entry points: hosts
- Docker runtime → Background tasks: runs