RoseDB is a lightweight, fast, and reliable key-value storage engine implemented in Go, based on the Bitcask storage model. It provides a simple embedded database library with operations like Put, Get, Delete, batch writes, TTL/expiry, key watching, and merge (compaction). The architecture uses a Write-Ahead Log (WAL) for persistence and an in-memory BTree index for fast lookups. The codebase is well-structured, with clean separation of concerns: the DB layer, index abstraction, record encoding, and utility functions. It demonstrates strong engineering practices including thread safety via sync.RWMutex, object pooling for performance, and a pluggable index interface. The repository includes comprehensive tests, benchmarks, and examples. It is actively maintained with recent commits and a responsive community.
terraform-docs is a CLI tool written in Go that automatically generates documentation from Terraform modules. It parses Terraform configuration files (variables, outputs, providers, resources, modules, requirements) using HashiCorp's terraform-config-inspect library, then renders the extracted metadata into multiple output formats including Markdown (table and document), AsciiDoc (table and document), JSON, YAML, TOML, XML, a colorized 'pretty' format, and tfvars (HCL and JSON). The tool supports extensive configuration via a YAML file or CLI flags, allowing users to control which sections are shown, sorting order, output file injection or replacement, recursive submodule processing, and custom headers/footers. It also features a plugin system based on go-plugin for extending formatters, and integrates with CI/CD pipelines, pre-commit hooks, and GitHub Actions. The architecture follows a clean separation of concerns: a cobra-based CLI dispatches to format-specific packages, which use Go templates for rendering. The codebase is well-tested with golden file tests covering edge cases like escape characters, code blocks, and multiline descriptions.
zrok is a production-grade, self-hostable secure resource sharing platform built on OpenZiti overlay networking. It enables users to share web services, files, TCP/UDP tunnels, and VPN connections through firewalls and NAT without requiring inbound connectivity. The system supports both public and private sharing modes, OAuth authentication (GitHub, Google, OIDC), and includes a full REST API (v2), a CLI tool (`zrok2`), a React web console, a background agent daemon with gRPC remote control, and SDKs in Go, Python, and Node.js. Architecturally, zrok follows a controller-agent pattern. The controller is a Go REST server that manages accounts, environments, shares, accesses, frontends, namespaces, organizations, and bandwidth limits. It uses SQLite3 or PostgreSQL for persistence with versioned migrations, and integrates with InfluxDB for usage metrics and RabbitMQ (AMQP) for dynamic proxy mapping updates. The agent runs as a background process on the user's machine, managing child processes for each share/access and exposing a gRPC API for remote management. Frontend proxies (public, dynamic, socks, Caddy) handle incoming traffic with OAuth, basic auth, and interstitial pages. Key entry points include the CLI commands under `cmd/zrok2/` (e.g., `share`, `access`, `enable`, `admin`), the controller REST handlers in `controller/`, the agent gRPC service in `agent/agentGrpc/`, and the SDK packages in `sdk/golang/sdk`, `sdk/python/src/zrok2`, and `sdk/nodejs/sdk`. The system also includes a canary testing framework for continuous health validation and a comprehensive metrics/limits engine for bandwidth enforcement. External dependencies include OpenZiti (overlay network), InfluxDB (metrics), RabbitMQ (messaging), Caddy (optional web server), and various OAuth providers. The project is actively maintained with frequent commits, automated CI/CD, and multi-platform release pipelines (Linux, macOS, Windows, Docker).
Render is a Go library that provides a flexible rendering layer for web applications, supporting multiple output formats including JSON, XML, HTML, text, and binary data. It abstracts away the complexities of marshaling data, setting appropriate content types and headers, and executing HTML templates with support for layouts, partials, and custom template functions. The library is designed to work with any Go web framework by accepting an http.ResponseWriter. The architecture centers around a Render struct that holds configuration and compiled templates, with different renderer types (JSON, XML, HTML, etc.) implementing a common Engine interface. Notable features include automatic template recompilation in development mode, buffer pooling for efficient HTML rendering, streaming JSON output options, and a lock-free implementation by default with optional mutex locking for thread safety. The library also provides filesystem abstraction to support loading templates from disk, embedded files, or custom asset functions.
Gophercloud is a comprehensive Go SDK for OpenStack cloud APIs. It provides typed client libraries for over 20 OpenStack services, including compute, networking, block storage, identity, load balancing, container orchestration, bare metal, DNS, key management, and more. The library handles authentication via Keystone (v2/v3), clouds.yaml, environment variables, or direct options, and includes a robust pagination framework (linked, marker, single page) used by all list operations. It follows consistent patterns: each resource has Create/Get/List/Update/Delete functions, builder interfaces for request options, and result types with Extract() methods. The codebase is heavily tested with both unit tests (HTTP mock fixtures) and acceptance tests (against real OpenStack deployments). While primarily a library for infrastructure management, it also exposes utilities like pointer helpers, JSON time parsing, and config file loading. The architecture is modular and extensible, with many reusable patterns.
chasquid is a production-grade SMTP (email) server written in Go, focusing on simplicity, security, and ease of operation. It handles incoming and outgoing email with full support for modern email security standards including STARTTLS, DKIM signing and verification, SPF checking, MTA-STS enforcement, and per-domain security level tracking. The server architecture is modular: the main daemon delegates SMTP protocol handling to the internal/smtpsrv package, manages a persistent email queue via internal/queue, performs alias resolution with hooks via internal/aliases, and delivers mail either locally through an LMTP-based MDA (cmd/mda-lmtp) or remotely via SMTP courier with TLS and MX fallback. Authentication integrates with Dovecot or a local user database using scrypt password hashing. Configuration is defined via protobuf text format, supporting hot reload of domains, users, and aliases without restart. The repository includes CLI tools for administration (chasquid-util), SMTP connectivity checking (smtp-check), and Dovecot authentication testing (dovecot-auth-cli). A comprehensive test suite covers unit, integration, and fuzz tests, with test data for DKIM, SPF, aliases, and various protocol edge cases. The repository also provides a Dockerfile for containerized deployment and extensive documentation in Markdown and man pages. While primarily an application, the codebase contains several well-designed internal packages that could be extracted for reuse, such as the network tracing library, safe I/O utilities, and OpenMetrics exporter.
ClickClack is a production-grade, self-hostable team chat platform built for people, bots, and agents. The backend is a single Go binary serving a REST API with WebSocket real-time events, supporting both SQLite and PostgreSQL as interchangeable storage backends. The frontend is a Svelte 5 single-page application embedded into the Go binary, with an optional Electron desktop client and a TypeScript SDK for bot development. The system provides workspaces, channels, threads, direct messages, file uploads, full-text search, reactions, pinned messages, slash commands, event subscriptions, and push notifications (Web Push and Pushover). Authentication supports magic links, passwords (Argon2id), GitHub OAuth, and Cloudflare Access JWT. The architecture emphasizes security with SSRF-safe callback dialers, strict cookie namespacing, rate limiting, and bot scope enforcement. The codebase is notable for its dual-database store pattern with shared contract tests, a real-time event hub with cursor-based recovery, and a comprehensive test suite including unit, integration, and Playwright end-to-end tests. It is not a data research project; it is a fully featured application designed for self-hosting or cloud deployment.
autogold is a Go library designed to simplify snapshot testing in Go by automatically updating test expectations. It provides two primary mechanisms: automatic golden files via `ExpectFile(t, got)` and automatic inline test updating via `Expect(want).Equal(t, got)`. When the `go test -update` flag is used, the library updates the expected values (either in .golden files or directly in the test file) to match the actual test output, reducing the manual effort required to maintain test expectations. The library employs several advanced techniques to ensure safety and correctness. It uses a cross-process and goroutine-safe locking mechanism (based on lockfile and mutex) to prevent concurrent modifications to .golden files by parallel test processes. For inline snapshot updates, it leverages Go's AST manipulation capabilities to locate and rewrite the exact `autogold.Expect(...)` call in the test file based on callstack information. Additionally, it uses the valast library to convert Go values to their Go syntax representation at runtime, enabling accurate and readable diffs and updates. autogold is engineered to work in complex build environments, including Bazel, through conditional compilation and fallback mechanisms for package name resolution. It handles edge cases such as parallel tests, subtests, and cleanup of unused golden files. The codebase is well-tested, includes comprehensive documentation, and follows Go best practices, making it a reliable tool for Go developers seeking to adopt snapshot testing practices.
slacrawl is a local-first Slack archiving CLI tool written in Go. It ingests messages, files, users, and channels from multiple sources—Slack API (bot/user tokens), Slack Desktop local cache (LevelDB + IndexedDB), MCP (Model Context Protocol) adapters, and external provider subprocesses—and stores them in a local SQLite database with full-text search (FTS5). The tool provides a rich command surface including sync, search, TUI browsing, analytics reports (digest, trends, quiet channels), retention purging, and Git-based archive sharing (publish/subscribe). It is designed for privacy-conscious users who want offline access to their Slack history without cloud dependency. The architecture follows a clean internal package separation: `cmd/slacrawl` is the entry point, `internal/cli` handles command routing via Kong, `internal/store` provides the SQLite persistence layer with schema migrations and batch writes, `internal/syncer` orchestrates multi-source synchronization, and `internal/slackapi`, `internal/slackdesktop`, `internal/slackmcp`, and `internal/provider` implement source-specific adapters. The codebase is well-tested with extensive Go tests, CI/CD via GitHub Actions, and cross-platform releases (Linux, macOS, Docker). While primarily an application, slacrawl exhibits data pipeline characteristics: it ingests raw Slack data, transforms it into a normalized relational schema with FTS indexing, and exposes analytical outputs (reports, digests). The embedding_jobs table hints at future ML integration. The Git archive sharing module is a novel pattern for distributed data replication. Overall, the codebase demonstrates strong engineering practices with reusable components like the generic MCP client, platform-specific file locking, and the external provider protocol.
The Moby project is the upstream open-source project for Docker Engine, implementing a container platform with daemon/client architecture. It provides container lifecycle management, image handling, networking, storage, and orchestration capabilities through a highly modular design with swappable components for storage drivers, network drivers, logging drivers, and authorization plugins. The codebase demonstrates strong engineering practices including context propagation, consistent error handling, plugin architecture, and functional options patterns. The system uses containerd as the underlying container runtime and exposes both HTTP and gRPC APIs for client interaction.
Infisical is an open-source end-to-end encrypted secrets management platform used to centralize, secure, and sync secrets across teams and infrastructure. The codebase is structured as a multi-service application with a primary Node.js/TypeScript backend (REST API using Fastify) and a newer Go backend implementing core platform services (authentication, permission evaluation, KMS, audit logging, secret manager). The frontend is a React SPA built with Vite and TanStack Router. The system supports self-hosted (Docker, Helm) and cloud-deployed modes. It provides a rich set of capabilities including dynamic secrets, secret rotation, approval workflows, machine identity federation (AWS, Azure, GCP, Kubernetes, OIDC), PKI management (internal and external CAs), privileged access management (PAM), secret scanning, audit logging, and extensive integration syncs. The architecture follows a modular service-oriented pattern with clear separation of concerns, extensive use of dependency injection and factory patterns for extensibility.
Fyne is a cross-platform GUI toolkit for the Go programming language, designed to build native desktop, mobile, and web applications from a single codebase. The repository contains the core framework including window management, event handling, a rich set of widgets (button, label, entry, list, table, tree, etc.), canvas primitives (lines, rectangles, arcs, text), layout managers, data binding, theming, storage abstraction, and platform-specific drivers (GLFW for desktop, mobile for Android/iOS, WebAssembly, and an embedded/no-OS driver). It also provides a command-line tool (`cmd/fyne`) for packaging, bundling resources, and releasing applications. The architecture is modular with clear interfaces (`fyne.App`, `fyne.Window`, `fyne.Widget`, `fyne.Canvas`) and extensive use of build tags for platform adaptation. The codebase is production-grade, well-tested with both unit and visual regression tests, and actively maintained by the Fyne community.
TruffleHog is a comprehensive, actively maintained secret scanning tool written in Go. It detects exposed credentials, API keys, tokens, and other sensitive information across a wide range of sources including Git repositories, cloud storage (S3, GCS), Docker images, CI/CD systems (Jenkins, Travis CI, CircleCI), and many third-party services. The architecture is modular: a core engine orchestrates scanning from various sources, a large library of over 700 detectors (each implementing a standard interface) identifies secrets using regex patterns and Aho-Corasick pre-filtering, and optional HTTP-based verification confirms whether discovered secrets are still valid. The tool also includes a terminal UI (Bubble Tea), a permissions analyzer for deeper credential assessment, and output formats like JSON, SARIF, and GitHub Actions annotations. External dependencies include cloud SDKs, database drivers, and numerous third-party API clients, but the core scanning logic is self-contained and well-structured.
This repository is an educational book/course titled 'Learn Go with Tests' by Chris James. It teaches the Go programming language through test-driven development (TDD), building small but complete example applications incrementally. The code is organized by chapter with progressive versions (v1, v2, ...) that demonstrate the TDD red-green-refactor cycle. The primary example application is a poker/league scoring system with an HTTP server, JSON file persistence, a CLI interface, and WebSocket support for real-time games. Other examples include an SVG analog clock generator, a blog post renderer using HTML templates, a dictionary with CRUD operations, and various standalone concept demonstrations (concurrency, context, reflection, generics). The repository is not a single production application but a collection of well-tested, pedagogical code that illustrates idiomatic Go patterns, interface-based design, dependency injection, and testing strategies (unit tests, acceptance tests, property-based tests, and test doubles).
This is a Kubernetes operator that manages the lifecycle of Prometheus, Alertmanager, and related monitoring components (Thanos Ruler, Prometheus Agent) as Kubernetes native resources. It provides Custom Resource Definitions (CRDs) for declarative configuration and automates deployment, scaling, configuration generation, TLS management, and reconciliation. The operator ensures that Prometheus and Alertmanager instances are correctly configured, updated, and monitored within a Kubernetes cluster, handling tasks such as secret injection, config reloading, and pod repair. The architecture is a monolithic Go binary using the controller-runtime pattern. It includes multiple sub-components: an admission webhook for validation and mutation of CRDs, a prometheus-config-reloader sidecar for dynamic config reload, and a kubelet controller for node endpoint management. The codebase is heavily generated (client-go, apply configurations, informers) and relies on Kubernetes APIs, Prometheus/Alertmanager container images, and optional cloud SDKs (AWS, Azure) for service discovery. Key entry points are `cmd/operator/main.go` (main operator binary), `cmd/admission-webhook/main.go` (webhook server), and `cmd/prometheus-config-reloader/main.go` (config reloader). Data flows: users define CRDs → operator reconciles into StatefulSets/DaemonSets, generates Prometheus/Alertmanager config files with TLS/auth, and manages config reloads. External dependencies include a Kubernetes cluster, Prometheus/Alertmanager container images, and optional cloud services for scrape config discovery.
Gorse is a production-grade, open-source recommender system engine written in Go. It implements a master/server/worker distributed architecture: the master coordinates training and cluster state, workers generate offline recommendations, and servers expose a REST API, dashboard, and gRPC endpoints. The system supports collaborative filtering via BPR and ALS matrix factorization, click-through rate prediction via an Attentional Factorization Machine, item-to-item/user-to-user similarity based on embeddings, non-personalized leaderboards, external script recommenders, and LLM-based reranking/chat recommenders. It includes a complete data model for users, items, feedback, and labels, with storage backends for SQL databases, MongoDB, Redis, and vector stores (xvec, Qdrant, Weaviate, Milvus), plus blob storage for model artifacts. The codebase is organized around strong abstractions: storage interfaces, protobuf-based services, a recommendation logic layer, model training/evaluation packages, and a common utility layer containing an autograd tensor library, SIMD-optimized float kernels, HNSW vector search, and concurrency helpers. It exposes admin/client CLIs, JSONL import/export, hyperparameter optimization with Optuna, monitoring metrics, and OpenTelemetry tracing. Although this repository contains ML training, benchmarks, and data-loading code, it is fundamentally an application platform rather than a data-research repository. The engineering is strong but carries complexity from supporting many storage backends, architecture-specific SIMD generated code, and a large monolithic master task file; some deprecated APIs and generated-code drift are present.
Atlas is a database schema management tool that supports both declarative and versioned workflows. It provides a CLI interface for inspecting, diffing, and applying schema changes across multiple databases (MySQL, PostgreSQL, SQLite, SQL Server, CockroachDB, etc.). The architecture is modular, with core packages for database drivers (sqlclient), migration planning/execution (migrate), HCL-based schema definition (schemahcl), and safety checking (sqlcheck). Key entry points are in cmd/atlas/internal/cmdapi for schema, migrate, and version commands. The system uses Ent ORM for migration state tracking and includes advanced features like drift detection, cloud integration, and a scripting engine for conditional migrations.
Anteon (formerly Ddosify) is an open-source platform for Kubernetes monitoring and performance testing. It provides a CLI-based load testing tool (Ddosify) that supports scenario-based testing with dynamic variable injection, extraction from responses, and assertions. Additionally, it includes an eBPF-based agent (Alaz, in a separate repository) for Kubernetes service map creation and real-time metrics collection without sidecars. The self-hosted deployment (in the selfhosted directory) orchestrates the platform using Docker Compose. The core engine is written in Go with a modular architecture, featuring pluggable components for requesters, reporting, and scripting.
Pomerium is an identity-aware access proxy that provides zero-trust security for internal web applications and services. It acts as a reverse proxy that authenticates users via OIDC/OAuth2 providers, authorizes access based on policy rules (Pomerium Policy Language evaluated via OPA/Rego), and proxies HTTP, gRPC, WebSocket, and SSH traffic. The system is built as a multi-service architecture with gRPC-based inter-service communication, using Envoy as the underlying proxy engine. Key components include an authentication service, authorization service with policy evaluator, a distributed databroker for session/config storage (with Raft consensus), and a control plane that generates Envoy configuration dynamically. It supports multiple identity providers (Google, Okta, Azure, Auth0, etc.), mTLS client certificates, WebAuthn, and SSH tunneling with a TUI client. The codebase also includes a Model Context Protocol (MCP) implementation for AI tool access control, and a 'Zero' cloud-managed mode for enterprise deployments. External dependencies include Envoy, PostgreSQL, Pebble (RocksDB), and cloud blob storage (S3, GCS, Azure Blob). Architecturally, Pomerium follows a modular design with clear separation of concerns: configuration management (layered sources, validation, envoy config builders), policy engine (parser, generator, criteria matchers), storage abstraction (in-memory, file, postgres, blob with caching and querier patterns), telemetry (OpenTelemetry, Prometheus, health checks), and utility packages (cryptography, HTTP, gRPC, protobuf, retry, fanout). The system is highly configurable with runtime flags and supports hot-reload via config diffing. The codebase demonstrates strong engineering practices with extensive unit, integration, and end-to-end tests (Playwright-based acceptance suites). Data flows: Incoming requests are intercepted by Envoy, which forwards them to the Pomerium proxy service. The proxy authenticates the user via the authenticate service (OIDC/OAuth2 flows), then authorizes via the authorize service (policy evaluation with OPA/Rego). Session and user data are stored in the databroker (distributed key-value store with Raft replication). Configuration is managed centrally and distributed to all services via gRPC streams. Telemetry data (traces, metrics, logs) is exported via OpenTelemetry and Prometheus.
This is the OpenTelemetry Collector Contrib repository, a large monorepo of optional components extending the OpenTelemetry Collector. It provides receivers, processors, exporters, extensions, and connectors for collecting, processing, and exporting telemetry data (traces, metrics, logs, profiles). The codebase is written in Go and follows a consistent component factory pattern with metadata-driven code generation. It integrates with dozens of external systems (AWS, Azure, GCP, Kafka, Elasticsearch, Prometheus, Kubernetes, databases, etc.) and includes a domain-specific transformation language (OTTL) and a log pipeline framework (Stanza). The architecture is modular, with each component self-contained in its own package. The repository is actively maintained with frequent commits, extensive CI, and a well-structured build system.