Open-Source CMS · uasoft-indonesia

badaso

Badaso is an open-source Laravel-based headless CMS and admin panel builder that generates REST/GraphQL APIs and CRUD interfaces via a Vue.js dashboard. It targets rapid low-code backend development for web, mobile, and IoT applications without requiring manual API coding.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/uasoft-indonesia/badaso

1.3k

GitHub stars

225

Forks

PHP

Primary language

MIT

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	uasoft-indonesia/badaso
Owner	uasoft-indonesia
Primary language	PHP
License	MIT — OSI-approved
Stars	1.3k
Forks	225
Open issues	4
Latest release	2.9.13 (2025-06-13)
Last updated	2025-06-13
Source	https://github.com/uasoft-indonesia/badaso

What badaso is

PHP/Laravel headless CMS with JWT auth, Vue.js PWA frontend, REST and GraphQL API generation, database migrations via UI, role-based access control, and offline-capable dashboard. Built as a modular Laravel package installable via Composer.

Quickstart

Get the badaso source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/uasoft-indonesia/badaso.git2cd badaso3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Rapid Backend Scaffolding for Mobile/Web Apps

Generate complete CRUD APIs and admin dashboards in minutes without writing boilerplate API code, ideal for teams needing quick MVP backends.

Multi-tenant SaaS Admin Panels

Leverage built-in user, role, permission, and menu management to manage complex admin access control across customers with minimal custom logic.

Content Management for Headless Architectures

Serve content and data via REST/GraphQL to decoupled frontends (React, Flutter, etc.) while maintaining a centralized, permission-gated admin interface.

Implementation considerations

Requires Laravel 8+ and PHP 7.4+ environment; hosting must support Composer and PHP-FPM or equivalent.
Database migrations are UI-driven but tied to Laravel's migration framework; teams must align on schema governance and version control practices.
JWT authentication is default; plan token lifecycle, refresh strategies, and integration with external identity providers (OAuth2/OIDC not explicitly mentioned).
Vue.js frontend is PWA-capable but offline sync logic is UI-centric; backend-heavy sync workflows may require custom implementation.
Modular architecture allows custom packages, but tight Laravel coupling means non-standard patterns may introduce maintenance debt.

When to avoid it — and what to weigh

Heavy Real-time Requirements — No mention of WebSocket, real-time sync, or live collaboration features; unsuitable for chat, collaborative editing, or live notifications without custom extension.
Non-PHP/Laravel Stack Requirement — Tightly coupled to Laravel and PHP; teams committed to Node.js, Python, or Go backends will face architectural friction and limited native support.
Enterprise Security Mandates — No formal security audits, compliance certifications (SOC2, ISO27001), or dedicated security team mentioned; requires thorough internal assessment before regulated use.
Complex Domain Logic — Low-code CRUD generators excel at straightforward data operations; systems requiring intricate business logic, workflows, or custom state management are better served by hand-written backends.

License & commercial use

MIT License (permissive, OSI-approved). Allows commercial use, modification, and distribution with attribution. No restrictions on proprietary derivative works.

MIT License explicitly permits commercial use without obligation to release source code or pay licensing fees. However, no SLA, indemnification, or professional support guarantees are mentioned; production deployments should contract separate support or conduct security/compliance review with legal counsel.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Adequate
License clarity	Clear
Deployment complexity	Moderate
DEV.co fit	Good
Assessment confidence	High

Security considerations

Laravel foundation provides mature CSRF, XSS, SQL injection mitigations. JWT used for auth; token handling and refresh logic merit review. No security audit, CVE disclosure process, or formal threat model mentioned. Database backup and activity logging are included but require proper encryption and access controls. Offline capability and media manager introduce surface area; file upload validation and storage permissions must be verified.

Alternatives to consider

Directus

Headless CMS with Node.js/TypeScript backend, database-agnostic, stronger real-time API, and explicit security framework. Better for non-PHP stacks and teams prioritizing API maturity over tight admin coupling.

Strapi

Node.js-based open-source CMS with plugin ecosystem and better cloud-native deployment. Preferred if you need JavaScript/TypeScript consistency or stronger enterprise support options.

Firebase / Supabase

Managed platforms with built-in authentication, real-time sync, and serverless scalability. Trade open-source control for reduced ops overhead; Supabase adds PostgreSQL + open ethos if vendor lock-in is a concern.

Software development agency

Build on badaso with DEV.co software developers

Explore Badaso for rapid CRUD and API generation, or contact us to evaluate whether it fits your security, compliance, and architectural needs.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

twill winter sharp

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source CMS Web App Development API Development Custom Software Talk to DEV.co

badaso FAQ

Can I use Badaso in production?

Technically yes (MIT license permits it), but production use requires: (1) security review of your specific threat model, (2) backup/DR strategy planning, (3) monitoring and logging setup, and (4) support contract or in-house expertise. No SLA or indemnification offered.

Does Badaso replace my API framework entirely?

For CRUD-heavy backends yes; it auto-generates REST/GraphQL. For complex domain logic, workflows, or bespoke integrations, you'll likely extend with custom Laravel code or external services.

How do I deploy Badaso?

As a Laravel package: Composer install, configure .env, run migrations. Deployment target is any PHP 7.4+ host (shared, VPS, Kubernetes, etc.). Official Dockerfile or Kubernetes manifests not mentioned; use standard Laravel deployment guides.

What if I need real-time features (chat, live notifications)?

Badaso does not include WebSocket or real-time sync out of the box. You'd integrate Laravel's Echo with Redis/Pusher or build custom handlers—standard Laravel patterns, but requires additional implementation.

Software development & web development with DEV.co

Need help beyond evaluating badaso? DEV.co is a software development agency offering software development services and web development for teams of every size. Our software developers and web developers build custom software, web applications, APIs, and open-source cms integrations — and maintain them long-term.

Ready to accelerate your backend development?

Explore Badaso for rapid CRUD and API generation, or contact us to evaluate whether it fits your security, compliance, and architectural needs.

Talk to DEV.co Schedule a Consultation