gocryptfs is a production-grade, FUSE-based encrypted overlay filesystem written in Go. It transparently encrypts file contents and filenames on the fly, supporting both forward mode (encrypting a plaintext directory) and reverse mode (presenting an encrypted view of a plaintext directory). The system uses multiple cryptographic backends (AES-GCM, AES-SIV, XChaCha20-Poly1305) with optional OpenSSL hardware acceleration, HKDF key derivation, and scrypt-based password hashing. It provides a rich CLI with subcommands for mounting, initializing filesystems, changing passwords, filesystem checking, and benchmarking. The architecture is a monolithic CLI tool that mounts a FUSE filesystem, with internal packages for content encryption, filename encryption (EME), safe syscall wrappers, and a control socket for path encryption/decryption. The codebase demonstrates strong security practices (O_NOFOLLOW, *at syscalls, memory wiping) and includes an extensive test suite with backward compatibility testing against multiple filesystem versions.
Gorush is a push notification microserver written in Go that delivers notifications to iOS (APNS), Android (FCM), and Huawei (HMS) devices. It exposes both an HTTP REST API (built with Gin) and a gRPC interface for high-performance integration. The system is designed for production use with configurable queue backends (local in-memory, NSQ, NATS, Redis), multiple workers, and pluggable statistics storage (memory, Redis, BoltDB, BuntDB, LevelDB, BadgerDB). It supports concurrent iOS push limiting, automatic retry on failure, feedback webhooks for asynchronous error reporting, and Prometheus metrics for monitoring. The architecture follows a clean producer-consumer pattern: incoming push requests are validated and enqueued, then processed asynchronously by workers that dispatch to platform-specific push services. The codebase is well-structured with clear separation of concerns across packages (app/, config/, core/, notify/, router/, rpc/, storage/, logx/, metric/, status/). It includes comprehensive test coverage, CI/CD pipelines, Docker/Kubernetes/AWS Lambda deployment support, and security scanning. The configuration system uses Viper with YAML files and environment variable overrides, with built-in validation and sensitive field redaction for safe API exposure.