The GitHub CLI (gh) is a monolithic command-line application written in Go that provides a terminal interface for GitHub operations. It follows a modular structure using the Cobra framework for command parsing, with commands organized by function (e.g., issue, PR, repository). The application relies on a factory pattern for dependency injection, providing commands with access to HTTP clients, configuration, and I/O streams. Key features include authentication management, repository and issue/PR operations, workflow/run handling, codespace management, and extension support. The codebase demonstrates strong engineering practices through its use of abstractions like `internal/ghrepo` for repository handling, `internal/safeurl` for secure URL construction, and `pkg/iostreams` for cross-platform terminal I/O with coloring, paging, and progress indicators. These components are loosely coupled and could be extracted for reuse in other projects. The application also includes extensive testing with HTTP mocking and table-driven tests, ensuring reliability. Despite its size and dependency count, the project is actively maintained with frequent updates and a clear release process. Technical drift is low due to regular dependency updates and proactive feature flag management. The tool is widely used and serves as the official CLI for GitHub, making it a mature and reliable application for developers.
Headscale is an open-source, self-hosted implementation of the Tailscale control plane. It provides a complete VPN solution including user management, node registration, policy enforcement (ACLs, SSH rules, route approvals), API services (v1 and v2), DERP relay capabilities, MagicDNS, and OAuth/OIDC integration. The architecture follows a modular monolith pattern with clear separation between CLI, API, core application logic, state management, policy engine, database layer, and network mapping components. Key entry points include the main CLI command (cmd/headscale/headscale.go) and various subcommands for administration, along with HTTP API handlers for client and management interactions. The system manages the complete lifecycle of a tailnet: authenticating devices, assigning WireGuard keys and IP addresses, enforcing access policies, and distributing network map updates to connected clients.
Nuclei is a template-based vulnerability scanner written in Go. It allows users to define security checks using YAML or JSON templates, which can be executed against a wide range of targets via multiple protocols (HTTP, DNS, network, file, etc.). The scanner features a modular architecture with a core engine that orchestrates template execution, a template system for parsing and compiling checks, and protocol-specific implementations for sending requests and processing responses. Key features include workflow chaining for multi-step attacks, fuzzing capabilities for dynamic application security testing, JavaScript extensibility for custom logic in templates, and integrations with various issue trackers and cloud platforms for result reporting. The project emphasizes performance through optimizations like template clustering (deduplicating identical requests across templates) and connection pooling. The codebase demonstrates strong engineering practices in several areas: a self-contained template clustering system for request deduplication, a JavaScript binding generation system that automates the creation of Goja-compatible libraries, a workflow context propagation system for sharing data between template steps, and a cryptographic template signing mechanism to ensure integrity. These components are designed to be reusable and showcase non-obvious solutions to common problems in security tooling. Maintenance is active with recent commits and a vibrant community. The project keeps pace with its ecosystem, showing low technical drift through regular updates to dependencies and active maintenance of generated code. Its extensive test suite and CI/CD pipelines further indicate a healthy, well-maintained project.
gh-poi is a GitHub CLI extension that safely cleans up local branches by identifying those with merged or closed pull requests. The application features a layered architecture separating command-line parsing (cmd/), external command execution (conn/), and shared data models (shared/). Key functionality includes fetching branch information from git, checking PR status via GitHub CLI, evaluating branch deletability based on multiple factors (lock status, worktree state, uncommitted changes), and performing safe deletion with dry-run support. The tool handles complex scenarios like worktrees, detached HEAD states, and various remote configurations.
Gitleaks is a command-line secret detection tool written in Go that scans for sensitive information like API keys, tokens, and passwords in git repositories, directories, files, and stdin. It features a modular architecture with separate components for configuration loading, source abstraction (file/git/archive handling), detection logic with multi-layer decoding, rule-based matching, and flexible reporting. The tool uses a Cobra-based CLI interface with commands for different scan modes and supports output formats including JSON, CSV, JUnit, SARIF, and custom templates. Key strengths include its pluggable decoder pipeline for handling encoded secrets, configurable rule system with entropy checks and keyword filtering, and sophisticated allowlist mechanism for reducing false positives. While actively maintained for security patches, the project is feature-complete with ongoing dependency management challenges due to its extensive rule set and reliance on unstable packages like golang.org/x/exp.
Mailpit is an email testing tool that functions as an SMTP server with a web interface and API for inspecting and testing emails. The architecture is a monolithic Go application that includes an SMTP server (port 1025), POP3 server (port 1110), HTTP server for web UI and API (port 8025), WebSocket server for real-time updates, and an embedded Vue.js frontend. Key entry points are main.go (application entry), cmd/* (CLI commands), and sendmail/main.go (sendmail replacement). Primary data flows involve email ingestion via SMTP/storage, parsing with enmime, storage in SQLite/rqlite, indexing for search/tagging, and retrieval via HTTP/WebSocket for UI/API consumption. External dependencies include Go modules (enmime, sqlf, goquery, etc.) and npm packages (Vue.js, Bootstrap, axios) for the frontend.
chasquid is a production-grade SMTP (email) server written in Go, focusing on simplicity, security, and ease of operation. It handles incoming and outgoing email with full support for modern email security standards including STARTTLS, DKIM signing and verification, SPF checking, MTA-STS enforcement, and per-domain security level tracking. The server architecture is modular: the main daemon delegates SMTP protocol handling to the internal/smtpsrv package, manages a persistent email queue via internal/queue, performs alias resolution with hooks via internal/aliases, and delivers mail either locally through an LMTP-based MDA (cmd/mda-lmtp) or remotely via SMTP courier with TLS and MX fallback. Authentication integrates with Dovecot or a local user database using scrypt password hashing. Configuration is defined via protobuf text format, supporting hot reload of domains, users, and aliases without restart. The repository includes CLI tools for administration (chasquid-util), SMTP connectivity checking (smtp-check), and Dovecot authentication testing (dovecot-auth-cli). A comprehensive test suite covers unit, integration, and fuzz tests, with test data for DKIM, SPF, aliases, and various protocol edge cases. The repository also provides a Dockerfile for containerized deployment and extensive documentation in Markdown and man pages. While primarily an application, the codebase contains several well-designed internal packages that could be extracted for reuse, such as the network tracing library, safe I/O utilities, and OpenMetrics exporter.
TrafficGuard is a Go-based CLI utility for network security that blocks known port scanners by configuring iptables/ip6tables and ipset. It downloads lists of malicious IP subnets, creates ipset sets, and configures firewall rules to drop traffic from these addresses. The tool includes optional logging with aggregation, automatic persistence of firewall rules across reboots via systemd services, and a comprehensive uninstall mechanism. It features intelligent integration with UFW (Uncomplicated Firewall) when present, with safeguards to prevent SSH lockout.
JVMS (JDK Version Manager) is a Windows-specific CLI tool for managing multiple JDK installations. It allows users to install, switch between, and manage different JDK versions from various distributions (Oracle, Amazon Corretto, Adoptium, Azul Zulu). The application features both command-line and text-based user interfaces, modifies system environment variables (JAVA_HOME, PATH) to make JDKs available, and uses a symlink mechanism for persistent JDK switching across console sessions and reboots. Built in Go with a modular architecture, it separates concerns into command handling, data models, UI components, and utility packages for file operations, web downloads, and JDK provider management.
HyprMon is a TUI (Terminal User Interface) tool for configuring monitors on Arch Linux running Wayland with Hyprland. It provides a visual 'desk map' where users can arrange monitors using keyboard and mouse controls, with real-time application to Hyprland. The application reads monitor configuration via hyprctl, allows live adjustments, and persists configurations to Hyprland's config files. It features profile management, advanced display settings (HDR, VRR, color depth), monitor mirroring with circular dependency prevention, and automatic workspace migration when monitors are added/removed. Built with Go using the Bubble Tea framework for the TUI and Lip Gloss for styling.
wp2hugo is a Go-based CLI tool for migrating WordPress XML exports to Hugo static sites. It processes WordPress content (posts, pages, custom post types) converting them to Hugo Markdown with appropriate front matter, handles media downloads, converts WordPress shortcodes and Gutenberg blocks to Hugo shortcodes, preserves metadata like GUID and taxonomies, and generates Hugo configuration files. The tool also includes a companion utility 'hugomanager' for site management tasks like backlink analysis, image optimization, and URL suggestions. The architecture is modular with clear separation between WordPress parsing, Hugo generation, media handling, and utility functions.
Custom Pod Autoscaler is a Kubernetes operator that provides custom autoscaling functionality. It runs as a pod in a Kubernetes cluster, periodically gathering metrics (via custom scripts or Kubernetes metrics server), evaluating those metrics to determine desired replica count, and scaling target resources accordingly. The application features a REST API for manual interaction, supports hooks for custom logic at various points in the process, and is designed to work with any language or framework through shell commands or HTTP requests. The architecture follows clean separation of concerns with distinct packages for configuration loading, execution abstraction, metric gathering, evaluation, and scaling logic.
Keydd is an HTTP(s) proxy tool that performs sensitive information detection and AI-driven API business logic analysis. It acts as a MITM proxy to intercept traffic, matches content against 30+ regex patterns for credentials/API keys, and optionally uses LLMs to analyze API endpoints for business purpose, sensitivity, and penetration priority. The architecture features separate layers for proxy handling, rule-based detection, AI analysis (with rate limiting, token tracking, and metrics), database persistence (SQLite/MySQL/PostgreSQL), and notifications. Key entry points include main.go for startup, proxy/handler.go for traffic processing, and cmd/match_rules.go for sensitive pattern matching.
This is a Home Assistant add-on that provides automated backup functionality using rclone. The system consists of a Go-based scheduler that runs configured backup jobs (sync, copy, move, delete) against local paths and remote storage services. It features dual services: a scheduler for executing backup jobs and an rclone web GUI for remote configuration. The addon integrates with Home Assistant's event system to report job success/failure and handles backup file naming conventions specific to Home Assistant's backup format. Configuration is managed through Home Assistant's add-on system with options stored in /data/options.json.
androidqf is a Go-based Android forensic data acquisition tool designed to collect various types of data from an Android device via ADB. The tool automates the gathering of device properties, system logs, running processes, services, settings, diagnostic information, installed applications (with optional APK extraction), and device backups. It stores the collected data in a timestamped directory and optionally encrypts and compresses the archive using age encryption if a public key is provided. The application follows a modular architecture where each data collection task is implemented as a separate module adhering to a common interface. The core components include a cross-platform ADB wrapper that automatically deploys platform-specific binaries, an asset embedding mechanism for distributing native dependencies, and an acquisition manager that handles the lifecycle of data collection and secure storage. The tool interacts with the device through ADB commands, collects data into structured files and directories, and provides user prompts for configurable options such as backup scope and APK selection. Despite the README indicating the project is not maintained, the repository shows recent commit activity and the codebase demonstrates solid engineering practices. Dependencies are up to date, and the tool is built for cross-platform use (Windows, macOS, Linux) with automated build and release workflows. The modular design allows for extensibility, and the reusable components (such as the ADB wrapper and asset deployment) could be adapted for other projects requiring Android device interaction.
spank is a macOS CLI tool that detects physical hits/slaps on Apple Silicon MacBooks via the accelerometer and plays audio responses. It requires sudo for IOKit HID access to the accelerometer and is built as a single-file Go application. The tool reads raw accelerometer data, runs vibration detection algorithms (STA/LTA, CUSUM, kurtosis, peak/MAD), and triggers audio playback when impacts exceed a configurable amplitude threshold. It offers multiple modes: pain (random 'ow!' sounds), sexy (escalating responses based on slap frequency), halo (Halo death sounds), lizard (similar to sexy but with lizard sounds), and custom (user-specified MP3 directory). Audio playback uses the beep package with resampling to a fixed sample rate, optional volume scaling based on impact force, and adjustable playback speed. The application uses Cobra for CLI parsing and Fang for command execution, with audio assets embedded via go:embed. Key reusable components include the audio resampling function that handles sample rate conversion and speed adjustment, and the amplitude-to-volume mapping function that applies a logarithmic curve for natural volume scaling.
wego is a terminal weather client that fetches data from multiple weather APIs and displays it in various formats. It features a plugin architecture that allows easy addition of new backends (weather data sources) and frontends (output formats). The application handles configuration via environment variables, config files, and command-line flags, with caching to reduce API calls.
Open-Pomodoro CLI is a command-line Pomodoro technique tracker built with Go and Cobra. It implements the Open Pomodoro Format for data storage, allowing users to start work sessions, take breaks, track completed pomodoros, view history, configure settings, and execute hooks at state transitions. The application features a modular architecture with separate packages for command handling (cmd/), output formatting (format/), and hook execution (hook/). It stores data in ~/.pomodoro/ as text files and supports multiple output formats including human-readable, JSON, and iCal. The tool integrates with tmux for status display and provides a comprehensive set of subcommands for managing the Pomodoro workflow.
goploader is a self-hosted file sharing system consisting of a Go-based command-line client and web server. The server provides both a web interface and REST API for file uploads/downloads, featuring optional client-side encryption (where encryption keys are never stored server-side), automatic expiration-based cleanup, and metadata storage via BoltDB. The client supports terminal-based uploads with features like progress bars, screenshot capture, and clipboard integration. Architecture follows a layered design with separation between HTTP handlers (views), data models, and utility components. While the core functionality is well-implemented, the codebase shows signs of technical debt including outdated frontend dependencies (Font Awesome 4.7.0), inconsistent Go version references, and a cryptographic concern (static IV in AES encryption mode). The maintainer explicitly notes the technology is outdated but maintains the repository in a working state.