{"id":48499737,"url":"https://github.com/sandeepkv93/everything-backend-starter-kit","last_synced_at":"2026-04-07T14:02:55.734Z","repository":{"id":337189917,"uuid":"1151861543","full_name":"sandeepkv93/everything-backend-starter-kit","owner":"sandeepkv93","description":"REST API service in Go with Google OAuth login, JWT auth, secure cookie sessions, RBAC authorization, and OpenTelemetry observability.","archived":false,"fork":false,"pushed_at":"2026-02-16T03:31:14.000Z","size":743,"stargazers_count":0,"open_issues_count":11,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-16T10:13:41.862Z","etag":null,"topics":["docker-compose","go-chi","golang","grafana","k8s","kustomize","loki","mimir","oauth2","opentelemetry","redis","rest-api","tempo"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sandeepkv93.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-07T02:01:07.000Z","updated_at":"2026-02-16T03:31:01.000Z","dependencies_parsed_at":null,"dependency_job_id":"2672fbbf-0a49-4918-b012-10ad17ae5a89","html_url":"https://github.com/sandeepkv93/everything-backend-starter-kit","commit_stats":null,"previous_names":["sandeepkv93/go-oauth-rbac-service","sandeepkv93/secure-observable-go-backend-starter-kit","sandeepkv93/everything-backend-starter-kit"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/sandeepkv93/everything-backend-starter-kit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandeepkv93%2Feverything-backend-starter-kit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandeepkv93%2Feverything-backend-starter-kit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandeepkv93%2Feverything-backend-starter-kit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandeepkv93%2Feverything-backend-starter-kit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sandeepkv93","download_url":"https://codeload.github.com/sandeepkv93/everything-backend-starter-kit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandeepkv93%2Feverything-backend-starter-kit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31515152,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-07T03:10:19.677Z","status":"ssl_error","status_checked_at":"2026-04-07T03:10:13.982Z","response_time":105,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker-compose","go-chi","golang","grafana","k8s","kustomize","loki","mimir","oauth2","opentelemetry","redis","rest-api","tempo"],"created_at":"2026-04-07T14:02:55.529Z","updated_at":"2026-04-07T14:02:55.723Z","avatar_url":"https://github.com/sandeepkv93.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Everything Backend Starter Kit\n\n[![CI](https://github.com/sandeepkv93/everything-backend-starter-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/sandeepkv93/everything-backend-starter-kit/actions/workflows/ci.yml)\n[![Fuzz Nightly](https://github.com/sandeepkv93/everything-backend-starter-kit/actions/workflows/fuzz-nightly.yml/badge.svg)](https://github.com/sandeepkv93/everything-backend-starter-kit/actions/workflows/fuzz-nightly.yml)\n[![K8s Kind Smoke](https://github.com/sandeepkv93/everything-backend-starter-kit/actions/workflows/k8s-kind-smoke.yml/badge.svg)](https://github.com/sandeepkv93/everything-backend-starter-kit/actions/workflows/k8s-kind-smoke.yml)\n[![Go Version](https://img.shields.io/badge/Go-1.26.0-00ADD8?style=flat\u0026logo=go)](https://go.dev/)\n[![Bazel Version](https://img.shields.io/badge/Bazel-9.0.0-43A047?style=flat\u0026logo=bazel)](https://bazel.build/)\n[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)\n\n## Table of Contents\n\n- [Overview](#overview)\n- [Tech Stack](#tech-stack)\n- [Architecture at a Glance](#architecture-at-a-glance)\n- [Quick Start](#quick-start)\n- [Documentation](#documentation)\n- [License](#license)\n\n## Overview\n\nThis repository is a production-oriented Go backend starter that brings together authentication, authorization, observability, and delivery tooling in one baseline:\n\n- Google OAuth login\n- Cookie-based JWT session flow (access + refresh)\n- Session/device management APIs (`/api/v1/me/sessions`)\n- RBAC authorization\n- Redis-backed caching for admin list, RBAC permission, and negative lookup flows\n- Redis-backed rate limiting and abuse-protection controls\n- OpenTelemetry metrics, traces, and logs\n- Local tri-signal stack (Grafana + Tempo + Loki + Mimir + OTel Collector)\n- Bazel + Gazelle + Task + Wire development workflow\n- API server in `cmd/api`\n- Operational CLIs in `cmd/migrate`, `cmd/seed`, `cmd/loadgen`, `cmd/obscheck`\n- Layered internal packages (`internal/*`) with DI composition through Wire\n- Docker Compose local stack for DB + observability\n- CI + local hooks enforcing build/test/generation hygiene\n\n## Tech Stack\n\n- Language/runtime: [![Go](https://img.shields.io/badge/Go-1.26.0-00ADD8?style=flat\u0026logo=go\u0026logoColor=white)](https://go.dev/)\n- HTTP framework: [![Chi](https://img.shields.io/badge/Chi-v5-1f6feb?style=flat)](https://github.com/go-chi/chi)\n- Persistence: [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-16-336791?style=flat\u0026logo=postgresql\u0026logoColor=white)](https://www.postgresql.org/) [![GORM](https://img.shields.io/badge/GORM-v2-00ADD8?style=flat\u0026logo=go\u0026logoColor=white)](https://gorm.io/)\n- Cache/rate limiting/idempotency backend: [![Redis](https://img.shields.io/badge/Redis-7-DC382D?style=flat\u0026logo=redis\u0026logoColor=white)](https://redis.io/)\n- Object storage: [![MinIO](https://img.shields.io/badge/MinIO-S3%20Compatible-C72E49?style=flat)](https://min.io/)\n- Auth: [![Google OAuth](https://img.shields.io/badge/Google%20OAuth-Enabled-4285F4?style=flat\u0026logo=google\u0026logoColor=white)](https://developers.google.com/identity/protocols/oauth2) [![JWT](https://img.shields.io/badge/JWT-Access%20%2B%20Refresh-000000?style=flat\u0026logo=jsonwebtokens\u0026logoColor=white)](https://jwt.io/)\n- Observability: [![OpenTelemetry](https://img.shields.io/badge/OpenTelemetry-Enabled-6929C4?style=flat\u0026logo=opentelemetry\u0026logoColor=white)](https://opentelemetry.io/) [![OTel Collector](https://img.shields.io/badge/OTel%20Collector-Included-425CC7?style=flat)](https://opentelemetry.io/docs/collector/) [![Grafana](https://img.shields.io/badge/Grafana-Stack-F46800?style=flat\u0026logo=grafana\u0026logoColor=white)](https://grafana.com/) [![Tempo](https://img.shields.io/badge/Tempo-Traces-F46800?style=flat)](https://grafana.com/oss/tempo/) [![Loki](https://img.shields.io/badge/Loki-Logs-F46800?style=flat)](https://grafana.com/oss/loki/) [![Mimir](https://img.shields.io/badge/Mimir-Metrics-F46800?style=flat)](https://grafana.com/oss/mimir/)\n- Tooling: [![Task](https://img.shields.io/badge/Task-Runner-4A90E2?style=flat)](https://taskfile.dev/) [![Bazelisk](https://img.shields.io/badge/Bazelisk-Bazel%209.0.0-43A047?style=flat\u0026logo=bazel\u0026logoColor=white)](https://github.com/bazelbuild/bazelisk) [![Gazelle](https://img.shields.io/badge/Gazelle-Build%20files-76D275?style=flat)](https://github.com/bazelbuild/bazel-gazelle) [![Wire](https://img.shields.io/badge/Wire-DI-00ADD8?style=flat\u0026logo=go\u0026logoColor=white)](https://github.com/google/wire) [![golangci-lint](https://img.shields.io/badge/golangci--lint-Enabled-00ADD8?style=flat)](https://golangci-lint.run/) [![gosec](https://img.shields.io/badge/gosec-Enabled-5C2D91?style=flat)](https://github.com/securego/gosec) [![govulncheck](https://img.shields.io/badge/govulncheck-Enabled-007D9C?style=flat)](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck) [![gitleaks](https://img.shields.io/badge/gitleaks-Enabled-121212?style=flat)](https://github.com/gitleaks/gitleaks)\n\n## Architecture at a Glance\n\n- Request path: `internal/http` ==\u003e `internal/service` ==\u003e `internal/repository` ==\u003e `internal/database`\n- Cross-cutting concerns: `internal/security`, `internal/observability`, middleware, and Redis-backed controls\n- Dependency injection: `internal/di` (Wire-generated injectors validated in CI)\n\n```mermaid\nflowchart LR\n    User[Web or API Client] --\u003e Router[Chi Router + Middleware]\n    Router --\u003e Handlers[HTTP Handlers]\n    Handlers --\u003e Services[Service Layer]\n    Services --\u003e Repos[Repository Layer]\n    Repos --\u003e DB[(PostgreSQL)]\n    Services --\u003e Redis[(Redis)]\n    Services --\u003e MinIO[(MinIO/S3)]\n\n    Handlers --\u003e OAuth[Google OAuth Provider]\n    OAuth --\u003e Handlers\n\n    Router -. request logs, metrics, traces .-\u003e OTelSDK[OTel SDK]\n    Services -. cache and auth metrics .-\u003e OTelSDK\n    Repos -. db telemetry .-\u003e OTelSDK\n\n    OTelSDK --\u003e Collector[OTel Collector]\n    Collector --\u003e Tempo[Tempo Traces]\n    Collector --\u003e Loki[Loki Logs]\n    Collector --\u003e Mimir[Mimir Metrics]\n\n    Grafana[Grafana] --\u003e Tempo\n    Grafana --\u003e Loki\n    Grafana --\u003e Mimir\n\n    Loadgen[cmd/loadgen] --\u003e Router\n    Obscheck[cmd/obscheck] --\u003e Grafana\n```\n\n## Quick Start\n\n### Prerequisites:\n\n- [Go `1.26.0`](https://go.dev/dl/)\n- [Task](https://taskfile.dev/)\n- [Bazelisk](https://github.com/bazelbuild/bazelisk) (uses Bazel `9.0.0` from `.bazelversion`)\n- [Docker](https://docs.docker.com/get-docker/) + [Docker Compose](https://docs.docker.com/compose/)\n\n### Clone the repo and cd into it\n\n```bash\ngit clone git@github.com:sandeepkv93/everything-backend-starter-kit.git\ncd everything-backend-starter-kit\n```\n\n### Configure environment\n\n```bash\ncp .env.example .env\n```\n\n### Start local dependencies and run API\n\n```bash\ntask docker-up\ntask migrate\ntask seed\ntask run\n```\n\n### Database reset/backup/restore (local)\n\nThese commands operate on the Docker Compose-managed Postgres service (`db`) and its data volume.\n\n```bash\n# reset Postgres container + DB volume and start fresh db service\ntask integration:reset-db\n\n# create SQL backup (default: backups/backup_\u003ctimestamp\u003e.sql)\ntask integration:backup-db\n\n# restore from backup file\ntask integration:restore-db FILE=backups/backup_20260217_103000.sql\n```\n\n### Expected success checks\n\n```bash\ncurl -sSf http://localhost:8080/health/live\ncurl -sSf http://localhost:8080/health/ready\n```\n\n### REST Client Collection (Manual API Verification)\n\nUse the checked-in VS Code REST Client collections to exercise all APIs (including detailed RBAC/admin flows) end-to-end.\n\n1. Install the REST Client extension: `https://marketplace.visualstudio.com/items?itemName=humao.rest-client`\n2. Open the detailed split collections in `api/rest-client/` (recommended):\n   - `00-quickstart.rest`\n   - `01-auth.rest`\n   - `02-user-me-sessions-avatar.rest`\n   - `03-products.rest`\n   - `04-feature-flags.rest`\n   - `05-admin-rbac.rest`\n3. Optionally use `api/everything-backend-starter-kit.rest` as a monolithic fallback\n4. Update variables at the top (`@baseUrl`, user credentials, IDs) for your local environment\n5. Run requests in sequence:\n   - health checks\n   - local login/register\n   - CSRF-protected endpoints (`/auth/refresh`, `/auth/logout`, `/auth/local/change-password`, `/me/*` mutating routes)\n   - admin RBAC endpoints with a user that has required permissions\n\nNotes:\n- Cookie-based auth is used, so enable REST Client cookie persistence (`rest-client.rememberCookiesForSubsequentRequests`).\n- Idempotency-key headers are included for routes that can be wrapped by idempotency middleware.\n- When routes change in `internal/http/router/router.go`, update `api/rest-client/*.rest` (and monolithic file if used) in the same PR.\n\n### Pre-commit workflow\n\nInstall hooks and local tooling:\n\n```bash\ntask hooks-install\n```\n\nRun the full hook suite manually:\n\n```bash\ntask hooks-run-all\n# or, if pre-commit is already on PATH:\npre-commit run --all-files\n```\n\nHook coverage includes Go formatting/linting (`gofmt`, `goimports`, `golangci-lint`, `go mod tidy`), Dockerfile linting (`hadolint`), YAML linting (`yamllint`), and secret scanning (`detect-secrets`).\n\n### Mock Generation\n\nDeterministic gomock files are generated from exported interfaces in key packages.\n\n```bash\ntask mockgen:install\ntask mockgen\ntask mockgen-check\n```\n\nGenerated output directories:\n- `internal/repository/gomock`\n- `internal/service/gomock`\n- `internal/health/gomock`\n- `internal/http/middleware/gomock`\n\nCI enforces drift checks by re-running the generator.\n\n### Feature flags\n\nRuntime feature toggles support user evaluation and RBAC-gated admin management.\n\n- User evaluation endpoints:\n  - `GET /api/v1/feature-flags`\n  - `GET /api/v1/feature-flags/{key}`\n- Admin endpoints (require `feature_flags:read` / `feature_flags:write`):\n  - `GET|POST /api/v1/admin/feature-flags`\n  - `GET|PATCH|DELETE /api/v1/admin/feature-flags/{id}`\n  - `GET|POST /api/v1/admin/feature-flags/{id}/rules`\n  - `PATCH|DELETE /api/v1/admin/feature-flags/{id}/rules/{rule_id}`\n\nRule matching precedence during evaluation:\n`user` \u003e `role` \u003e `org` \u003e `environment` \u003e `percent` \u003e flag default.\n\n### Products Blueprint Module\n\nSample `products` CRUD module demonstrates domain/repository/service/handler layering with RBAC-protected routes and paginated list responses.\n\n- Endpoints:\n  - `GET /api/v1/products` (requires `products:read`)\n  - `GET /api/v1/products/{id}` (requires `products:read`)\n  - `POST /api/v1/products` (requires `products:write`)\n  - `PUT /api/v1/products/{id}` (requires `products:write`)\n  - `DELETE /api/v1/products/{id}` (requires `products:delete`)\n- Pagination defaults:\n  - `page=1`, `page_size=20`, max `page_size=100`\n\nEndpoints:\n\n- API base URL: `http://localhost:8080`\n- Grafana UI: `http://localhost:3000` (`admin` / `admin`)\n- MinIO Console: `http://localhost:9001` (`minioadmin` / `minioadmin`)\n\n## Documentation\n\n- [Project guide (full documentation)](docs/project-guide.md)\n- [Architecture and flow diagrams](docs/diagrams.md)\n- [Kubernetes deployment guide](k8s/README.md)\n- [Audit Taxonomy](docs/audit-taxonomy.md)\n\n## License\n\nMIT. See [LICENSE](LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsandeepkv93%2Feverything-backend-starter-kit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsandeepkv93%2Feverything-backend-starter-kit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsandeepkv93%2Feverything-backend-starter-kit/lists"}