Mutamad Standard Site

A complete government site from one recipe: Arabic and English, separation of duties, Drupal Canvas pages and the content of a government site, applied in the order that makes every control hold.

Brought to you by iSpectra.

Mutamad Standard Site is the site template behind every Mutamad site: a Drupal recipe of type Site that turns a fresh Drupal 11.4 install into a ready-to-use government website. It applies 29 recipes (2 from Drupal core, 3 contributed and 24 from Mutamad) in one carefully tested order.

Documentation · Issue queue · Mutamad

What you get

✔ The security baseline, before anything else

The three job roles come first, then password policies, lockout, idle logout, security headers, a Content Security Policy, private uploads by default, and multi-factor authentication for privileged roles, with its keys kept outside the database. Every later recipe builds on them.

✔ Arabic and English from the first field

The site is installed in Arabic or English, and the other language is added before any content type or field exists, so every field is translatable from the start. Both languages sit behind their own address prefix (/ar, /en).

✔ Separation of duties

An editor drafts and an approver publishes, never the same person, with content locking, notifications, a reason for every edit and an audit trail. It covers every content type and every Drupal Canvas page.

✔ Pages built in Drupal Canvas

The Mutamad theme, right to left and after DGA's Unified Design System, with page templates, an editable header and footer, and ready-made sections that editors arrange in Drupal Canvas.

✔ The content of a government site

Services after DGA's Service Page Template, FAQ after DGA's FAQ Template, News, Events, Publications, Leadership and a newsletter, each with its own list page. Site search understands Arabic however a word is spelled, and a dashboard shows each person what waits for them.

✔ Starting pages, in Arabic and English

The home page; About us after DGA's About the Entity template, with Who we are, Strategy, Organizational structure, Budget and expenditure, and Tenders and procurement; e-Participation and its policy; the privacy policy, terms of use and accessibility statement; and DGA's help pages: Page not found, the site map and Help and support. The main menu comes with them. Apart from the home page they are templates, with [bracketed] placeholders for the entity to complete.

✔ A modern administration area

Gin and core Navigation in Mutamad's branding, HTML email for everything the site sends, sign-in with a username or an email address, accessibility checks while editing, structured logs for a SIEM, and scheduled tasks that run on time.

The order is part of the design

Drupal drops a permission granted to a role, module or content type that does not exist yet, logs one line, and still reports success. So the order below is what makes every control hold: each recipe is applied only after everything it relies on.

1. Roles: Mutamad Roles, before anything grants a permission to them.
2. Security and keys: Mutamad Security, Mutamad Crypto.
3. The second language: Mutamad Multilingual, before any field is created.
4. Foundations: core's Tags, Mutamad Media, then core's Standard.
5. Email, sign-in and accessibility checks: Easy Email Express, Drupal CMS Authentication, Drupal CMS Accessibility Tools.
6. Forms, pages and editing: Mutamad Forms, Mutamad Canvas, Mutamad Editor.
7. Administration and logging: Mutamad Admin, Mutamad Logging.
8. Approval: Mutamad Workflow.
9. Theme, search engines and privacy: Mutamad Theme Setup, Mutamad SEO, Mutamad Privacy.
10. Content: Content Base, Services, FAQ, News, Events, Resources, People, Newsletter.
11. Search and the dashboard: Mutamad Search, Mutamad Dashboard, last.

Life Journeys and e-Consultations are in the code base but not applied: only some entities need them, and they can be applied on their own.

Get started

A new site (recommended)

composer create-project drupal/mutamad_project my-site
cd my-site
ddev start
ddev install-mutamad
ddev mutamad-verify

The Mutamad installer applies this recipe, adds the starting pages, and mutamad-verify checks every control on the running site.

A fresh Drupal 11.4 site

First set a private file path in settings.php, outside the web root, and create the key that encrypts the multi-factor secrets (see "Keys are not configuration" in Mutamad Crypto):

$settings['file_private_path'] = '../private';

Then add the recipe and apply it, once, to a fresh install:

composer require drupal/mutamad_starter \
  'drupal/canvas_translate:^1.0@alpha' \
  'drupal/entityqueue_form_order:^1.0@alpha' \
  'drupal/tfa:^2.0@alpha'
drush recipe ../recipes/mutamad_starter

The three alpha modules have no stable release yet, so Composer needs them named. Sites started from the Mutamad project template already allow them.

Requirements

• Drupal 11.4 and PHP 8.4
• A private files directory outside the web root
• The key file described in Mutamad Crypto

Documentation and support

• The README explains every recipe in the order and why it is there; the changelog lists what changed in each release.
• Report bugs and ask questions in the issue queue; report security issues to the Drupal Security Team, not in public.