Make a site public or private

A private site needs every reader to sign in. A public site also serves anonymous visitors, filtered for a set of public entitlements you choose.

About this task

The access mode belongs to the registered repository and is kept in the database. Staff change it in the admin console or the admin API, unless the docs repository declares it in the site block of its opend.config.yaml (access and publicEntitlements): then the build that goes live on the newest release line applies it, and the console shows it read-only (Set the site up from opend.config.yaml). Either way, switching to public opens exactly the public set, and every cached page is dropped at once. New repositories are private.

Who	Private site	Public site
Anonymous visitor	Sent to the sign-in page	The public entitlements
Signed-in reader	Their organization's entitlements	Their entitlements together with the public ones, when both are for the same release line; otherwise only their own
Reader whose organization has no entitlements	"No access yet"	The public entitlements
Staff reader	Everything, conditions marked	Everything, conditions marked

Decide what anonymous visitors may see, as an entitlement set: products, features and the version whose docs they get.

Without a public set, a public site is fail-closed: anonymous visitors see only content with no product, feature or release condition, on the newest release line.

The version may be the keyword latest: the newest live release line at the time of each request, such as 0.23 with release lines by minor version. When 0.24 goes live it becomes the default at once, with no admin call, and when the newest line is retired the next one takes over. The line's name is used as the version, so content conditioned on release is filtered for 0.23 (that is, 0.23.0). With nothing live yet, latest serves nothing. Only the public set takes latest; organizations name a real version.

Switch the repository to public through the admin API.

H="authorization: Bearer $OPEND_ADMIN_TOKEN"
curl "$PUBLIC_URL/admin/api/repos" -H "$H"          # find the repository's id
curl -X PUT "$PUBLIC_URL/admin/api/repos/1/access" -H "$H" -H 'content-type: application/json' \
  -d '{"access":"public","publicEntitlements":{"products":["core"],"features":[],"version":"0.1"}}'
# or "version":"latest" to follow the newest live release line

Every replica drops its cached pages at once. The next anonymous request gets the public view instead of the sign-in page.

To go back, send {"access":"private"}.
The public set is kept for next time; send "publicEntitlements": null to clear it.

Or set the mode in a seed file, next to the repository.

repos:
  - fullName: acme/docs
    sourceUrl: https://github.com/acme/docs.git
    access: public
    publicEntitlements: { products: [core], features: [], version: '0.1' }

A seed without access leaves the mode as it is.

Or set both in the admin console, under Access on the Site & access page.
Type latest in Release version to follow the newest live line. See Run your site from the admin console.

Results

Everything follows the same rules. Pages, navigation, search, images under /_assets/, the logo, the theme and PDFs are all filtered for the viewer's set. Hidden topics look missing.
Caching. Pages are cached per entitlement set. Anonymous visitors share their own cache entries, apart from readers', and staff have theirs. The account controls, edit links and feedback form are added to each response after the cache.
Why the union only on the same line. The public set opens one release line. A reader on another line keeps their own entitlements, so the public set never opens gated content of a line it was not meant for.
Feedback needs sign-in. Anonymous page views and searches are counted without an organization. The embedded help panel is unchanged: it always uses the reader from the host app's signed token.
The help JSON API answers anonymous requests on a public site with exactly this public view, with no token and no embedding set up. See Help JSON API reference.
Anonymous visitors see Sign in in the header (and in the menu on narrow screens), which returns them to the same page. See Set up reader sign-in with OIDC and Let readers sign in with GitHub.