Skip to content

Showcase Mode

Jump to bottom
BobWs edited this page Nov 1, 2026 · 3 revisions

🖼️ Showcase Mode (Public Read-Only)

Showcase Mode turns a Flatnotes-Enhanced instance into a clean, read-only viewer for a public audience. It is intended for sharing curated notes, documentation, or blog-style content.

Warning

It is not a security control. It is a UI-level restriction that hides editing, search, and administrative features.

Enabling Showcase Mode

Set the following environment variable:

FLATNOTES_SEARCH_DISABLED=true

Recommended for public instances:

FLATNOTES_AUTH_TYPE=read_only
FLATNOTES_SEARCH_DISABLED=true

Pairing Showcase Mode with read_only authentication ensures that, even if someone guesses an API route, state-changing requests are rejected at the API level.

FLATNOTES_QUICK_ACCESS_HIDE=true is sometimes mentioned as an optional extra to keep the home page minimal. Confirm in the README’s Showcase Mode section before relying on it.

What Changes

Feature Normal mode Showcase mode
Search ✅ Available ❌ Disabled — /api/search returns empty results
Tags sidebar ✅ Available ❌ Hidden; /api/tags gated
Edit / Create / Delete ✅ Available ❌ Hidden (UI-level)
New Note button ✅ Available ❌ Hidden
Settings / Trash / Archive ✅ Available ❌ Hidden
Bookmarks ✅ Available ❌ Hidden
Templates ✅ Available ❌ Hidden
Attachments ✅ Available ❌ Hidden
Shared Links ✅ Available ❌ Hidden
Note viewer ✅ Full ✅ Read-only (navigation only)
Folder sidebar ✅ Full ✅ Navigation only (expand, collapse)
Direct note URLs (/note/title) ✅ Available ✅ Still work
Folder breadcrumbs ✅ Clickable ✅ Plain text (no search navigation)

The home page shows a read-only banner instead of quick-access notes.

How It Works

  • The backend sets a search_disabled flag in /api/config.
  • The /api/search and /api/tags endpoints are gated and return empty results.
  • The frontend router blocks the affected routes and redirects to the home page.
  • UI elements across the navigation bar, home page, note view, folder sidebar, and menus are hidden.

All other API endpoints remain functional: note retrieval and folder listing continue to work, so direct links and folder navigation still function.

⚠️ Security Notes

Showcase Mode is a UI restriction, not a security control.

  • API endpoints remain reachable. Anyone who knows or guesses the URL structure can retrieve notes, attachments, and folder contents.
  • Notes can be guessed by title. Note retrieval is by title; if a title is guessable, the note is retrievable.
  • Attachments are not protected.
  • Search being disabled does not hide content — it only removes the search UI and the search endpoint.

Recommendations for Public Instances

  1. Always combine with FLATNOTES_AUTH_TYPE=read_only so state-changing requests return 403.
  2. Do not rely on Showcase Mode alone for sensitive content.
  3. For genuinely sensitive material, use network-level controls — reverse-proxy authentication, VPN, or IP allowlisting.
  4. Use HTTPS. Secure contexts are required for some browser features, and SSO callbacks expect HTTPS.

Typical Use Cases

Use case Notes
Public documentation site Curated notes intended for anonymous readers
Read-only knowledge base Reference material shared within an organisation
Blog-style publishing Notes written in Markdown, published as-is
Demo instance Show off features without exposing editing

For content that must remain private, use normal authenticated mode with a strong password or TOTP, or restrict access at the network layer.

Verifying Showcase Mode

After enabling and restarting:

  1. Open the home page — you should see the read-only banner.
  2. Confirm the navigation bar no longer shows Search, New Note, or the tag sidebar toggle.
  3. Try opening a note directly via /note/SomeTitle — it should still load.
  4. Open the browser DevTools → Network tab and call /api/search directly — it should return empty results.

If search still works, check the container logs to confirm FLATNOTES_SEARCH_DISABLED was read. The variable must be set to the string true (lowercase).

Disabling Showcase Mode

Remove the environment variable (or set it to false) and restart the container:

docker compose up -d --force-recreate

The full UI returns and search becomes available again.

Troubleshooting

Search Still Works

  • Confirm FLATNOTES_SEARCH_DISABLED=true (lowercase true).
  • Confirm the container was recreated, not just restarted.
  • Check the /api/config response in DevTools — search_disabled should be true.

Editing Still Possible

  • Showcase Mode hides editing in the UI, but does not itself block API writes.
  • Set FLATNOTES_AUTH_TYPE=read_only as well.

Direct Note URLs Return 404

  • Note titles are matched exactly, including case and folder path.
  • Confirm the note exists and is not in Trash or Archive.

See Also

Clone this wiki locally