Learning Resources on Golang4U

Design Patterns in Go: The Once-per-Lifetime Patterns That Actually Pay Off

Thu, 15 Oct 2026 09:00:00 +0000

Every Go developer has read Design Patterns (Gang of Four, 1994) and thought “this is C++-ism”. The refactoring.guru catalogue is the friendlier reference, but most of it is inheritance-based, and Go has no inheritance. So what is left? The answer is smaller than you expect, and that is the point.

This post walks the whole 23-pattern catalogue and marks which patterns Go handles natively (with the exact idiom) and which are better left to a library. The organizing rule is the thesis of the post:

gRPC in Go: The Service That Doesn't Need a Microservice Framework

Thu, 15 Oct 2026 09:00:00 +0000

The Java gRPC story is a framework: an @Grpc annotation, a Service base class, a Client interface, a config file. The Go story is the opposite, and it is the reason gRPC in Go feels like using stdlib: gRPC is a conn + a generated stub. There is no GrpcClient base class to configure, no service registry to wire. The service is a struct that implements a generated interface; the client is two lines.

Kafka in Go: The Consumer Group That Actually Works

Thu, 15 Oct 2026 09:00:00 +0000

Every Go service that “integrates with Kafka” starts the same way and ends the same way: a NewConsumerGroup, a fetch loop, and a 3am page — the consumer died, the group rebalanced, the committed offset was for the previous batch, and the next batch got delivered twice. The failure is never in the broker. It is in three decisions your service makes: how it joins the group, when it commits, and what it does on a rebalance.

PASETO: The Token Format You Didn't Know You Needed

Thu, 15 Oct 2026 09:00:00 +0000

JWT has been the default for a decade, and the default is the problem. Every JWT deployment is its own crypto stack: pick an alg, pick a kid, stand up a JWKS endpoint, wire up an aud check, and get any of the four wrong and you have the alg: "none" bug, the kid confusion bug, or the “token signed for service A used against service B” bug. Paragonie’s “JWT is a Bad Standard” is the canonical indictment, and PASETO (Platform-Agnostic SEcurity TOkens) is the fix that ships. The whole idea is to remove the rope: one token format, no alg field, no kid, no header/body ambiguity — the version is the algorithm, and the library decides the rest.

The Go Goroutine Pool Pattern That Always Works

Thu, 15 Oct 2026 09:00:00 +0000

The goroutine pool is the most over-engineered pattern in the Go ecosystem and the most under-engineered one in production. The standard library gives you sync.WaitGroup (a barrier, not a pool) and errgroup (a fan-out, not a pool); everything else — the 40-line WorkerPool on StackOverflow, the channel-based “pool” in every blog post — is a re-implementation of the same 50-line pattern, each with a slightly different name for the slot and a slightly different condition for slot free.

The Jailer in My Codebase: In-Memory Jail and Why It Became a Library

Thu, 15 Oct 2026 09:00:00 +0000

Every login system grows a jail. Mine started as a map[string]int of failed logins and a comment saying “5 and they’re out”. Six sprints later it was a 300-line blob with three kinds of counters, two kinds of windows, and a backoff that someone hand-tuned in production at 3am. The data never changed; the rules did — what counts as a try, what “exceeding” a budget means, who gets jailed and for how long.

The Golang4U LLM Bible: Internals of the Intelligent Llama Manager

Tue, 10 Mar 2026 00:00:00 +0800

Preface: Why Native llama.cpp is Painful

Running Large Language Models (LLMs) locally using llama.cpp offers incredible privacy and performance. However, deploying it effectively is notoriously difficult. The native experience is raw: compiling binaries manually, dealing with unoptimized package manager downloads, juggling 50GB file transfers, calculating mental VRAM boundaries, and memorizing arcane CLI flags. Get a single context metric wrong, and your GPU violently crashes with an Out-Of-Memory (OOM) panic.

We built an all-in-one Go application—llama_manager.go—to solve this entirely. It is a highly fault-tolerant daemon that dynamically profiles physical hardware, reverse-engineers a model’s memory footprint on the fly, and calculates the exact parameters needed to run engines at absolute peak efficiency.

The Golang4U Cryptography Bible: E2EE, ECIES & Blind Indexing

Tue, 10 Feb 2026 16:00:00 +0800

Preface: Why TLS is Not Enough

HTTPS (TLS 1.3) protects data “In Transit.” It prevents the Hacker in the Coffee Shop from reading your password. But it does not protect against:

Malicious Proxies: A corporate proxy (MITM) that terminates TLS.
The Server Itself: If our logs accidentally print req.Body.
Memory Dumps: If the server crashes and dumps RAM.

To fix this, we implement End-to-End Encryption (E2EE) at the Application Layer. The password is encrypted in the browser and only decrypted inside the Service function.

The Golang4U Authentication Bible: PASETO, Usage & Design

Tue, 10 Feb 2026 14:00:00 +0800

Preface: Authentication vs Authorization

First, a distinction.

Authentication (AuthN): “Who are you?” (I am User 123).
Authorization (AuthZ): “What can you do?” (I can delete posts).

This, guide focuses on AuthN. specifically, how we securely identify a user across stateless HTTP requests.

Chapter 1: The Fall of JWT (JSON Web Tokens)

For a decade, JWT (RFC 7519) was the king. But heavy lies the crown. A JWT is a string: header.payload.signature.

The Design Flaw: Cipher Agility

The header tells the server how to verify the token.

The Golang4U Security Bible: A Defense-in-Depth Masterclass

Tue, 10 Feb 2026 12:00:00 +0800

Preface: The Zero Trust Mindset

Security is often treated as a feature. “Add a login page, and we’re secure.” This is false. Security is a Process. It is the sum of every line of code that handles input.

In Golang4U, we adopt a Zero Trust mindset.

Trust No IP: Even if it didn’t attack us yesterday, it might attack us today.
Trust No User: Even if they have a valid token, they might be spamming.
Trust No Browser: Even if Chrome says it’s secure, we enforce it with headers.

This guide will walk you through the three rings of defense: Network, Application, and Presentation.

The Golang4U Architecture: A Service-Oriented Masterclass

Tue, 10 Feb 2026 10:00:00 +0800

Preface: Why Read This?

If you are just starting with Go, you might write everything in main.go. It works for a “Hello World,” but it fails for a production system. If you are an expert, you might argue about “Clean Architecture” vs “Hexagonal” vs “Onion.”

Golang4U adopts a pragmatic, production-ready Service-Oriented Architecture (SOA) structure. It is designed to be:

Testable: Every layer can be mocked.
Scalable: New features (like a “Video” post type) don’t break old ones.
Readable: A new developer knows exactly where to put code.

This guide is not a summary. It is a Masterclass. We will read the code together, line by line, layer by layer. By the end, you will understand not just how it works, but why it was built this way.

Mon, 01 Jan 0001 00:00:00 +0000

title: “Domain-Driven Design in Go: the Rich Model, the User/Store split, and the referral-code algorithm” image: /images/covers/domain-driven-design.svg date: 2026-10-17T09:00:00+00:00 author: “Punit Naran” description: “Anemic Domain Models are data bags with all the logic in Services. The Rich Model puts behavior on the struct. This post is the Golang4U domain layer: the User business entity (constructor-validated, never nil-shaped), the Store persistence record (system metadata the API must never leak), and the collision-free referral-code minting algorithm that lives on the record, not the service. Every code block here compiles with the stdlib alone.” tags: [“Go”, “DDD”, “Rich Model”, “Domain-Driven-Design”, “Validation”] draft: false

Domain-Driven Design in Go: the Rich Model, the User/Store split, and the referral-code algorithm

The classic Go “gotcha” is not a concurrency bug — it is the anemic domain model: your structs are data bags (type User struct { Name string }) and all the behavior lives in a Service (func (s *Service) IsAdult(u *User) bool { return u.Age >= 18 }). The result is a codebase where the data has no semantics, and the semantics have no home — every rule is a function that takes a data bag and a flag, and the type system is telling you nothing about what a valid User is. This post is the Rich Model in Go, from the Golang4U domain layer: a User that is structurally valid (every constructor validates it once, at the boundary), a Store record that wraps the User with system metadata the API must never leak, and a referral-code minting algorithm that lives on the record (because it mutates the record’s referral list) — not in the service, not in a helper, right where the data lives.

Mon, 01 Jan 0001 00:00:00 +0000

title: “Implementing 2FA in Go: TOTP from RFC 6238, the 3-phase enrollment state machine, and recovery codes — stdlib only” image: /images/covers/implementing-2fa.svg date: 2026-10-17T09:00:00+00:00 author: “Punit Naran” description: “Two-factor authentication is a function of time and a shared secret, and the whole standard (RFC 6238) fits in ~80 lines of Go stdlib: crypto/hmac, crypto/rand, encoding/base32. This post implements TOTP from the RFC, the 3-phase setup/activate/commit state machine that prevents the classic ‘I scanned the QR but my phone broke’ lockout, a ±1 clock-drift window, and one-shot recovery codes stored as hashes — all with no third-party TOTP SDK.” tags: [“Go”, “Authentication”, “2FA”, “TOTP”, “RFC 6238”, “Recovery Codes”, “State Machine”] draft: false

Implementing 2FA in Go: TOTP from RFC 6238, the 3-phase enrollment state machine, and recovery codes

The standard “you need a TOTP SDK” answer is wrong for Go: the entire TOTP standard (RFC 6238) is a function of time and a shared secret, computed with HMAC-SHA1 — and Go’s stdlib already ships crypto/hmac, crypto/rand, and encoding/base32. A complete 2FA implementation (secret generation, code generation, validation with a drift window, the *otpauth:// enrollment URI, the 3-phase setup/activate/commit state machine, and one-shot recovery *codes) fits in under 200 lines of stdlib Go. The thesis of this post is that the two hard parts of 2FA are not the crypto (the crypto is one HMAC *call) *— they are the state machine (a user who scans a QR but never activates must never be locked *out) and the recovery path (a user who loses their phone must not be gone for *good). The state machine and the recovery codes are where 2FA systems actually fail, and they are exactly the parts a SDK hides from you.

Mon, 01 Jan 0001 00:00:00 +0000

title: “The Golang4U Hardening Bible: DDoS-Proofing & OOM Prevention” image: /images/covers/production-hardening.svg date: 2026-02-14T15:00:00+08:00 lastmod: 2026-02-14T15:00:00+08:00 author: “Punit Naran” authorLink: "" description: “Your code is correct, but your server is vulnerable. The Golang4U hardening playbook: Slowloris timeouts, GOMEMLIMIT OOM prevention, and bounded database pooling - the runtime knobs that stop the 3 a.m. page.” tags: [“Go”, “DevOps”, “DDoS”, “OOM”, “GOMEMLIMIT”, “Production”, “Docker”, “Kubernetes”] categories: [“DevOps”, “Engineering Handbook”] featuredImage: ""

Your code is correct. It passed every test. Then the 3 a.m. page: OOM kill, a hung pool of connections, a Slowloris-shaped incident. The difference is that default settings are tuned for a laptop demo, not a production box. This post is the Golang4U hardening playbook, told through the runtime’s own knobs: GOMEMLIMIT, the HTTP server timeout ladder, and database pooling.

Mon, 01 Jan 0001 00:00:00 +0000

title: “Secure file uploads in Go: magic-byte sniffing, streaming to ClamAV, and a SANE-style frame client that never touches the disk” image: /images/covers/secure-file-uploads.svg date: 2026-10-17T09:00:00+00:00 author: “Punit Naran” description: “A file-upload endpoint is a backdoor: a shell in a .jpg, a virus in a PDF, a 50GB file that fills the disk. This post treats every upload as a potential bomb and defuses it the Go way: http.DetectContentType (magic bytes, not the Content-Type header) for the format check, a ClamAV streaming scan over a TCP pipe so the file is checked before it is stored, a body-size limit that severs the request before it hits RAM, and an IP ban that turns the endpoint into a honeypot. The streaming frame client (a SANE-style request/response protocol) is the Go idiom for ‘consume a byte stream without buffering the whole thing’.” tags: [“Go”, “Security”, “ClamAV”, “FileUploads”, “Streaming”, “Magic Bytes”, “DoS”] draft: false

Mon, 01 Jan 0001 00:00:00 +0000

title: “The Golang4U Email Bible: Native SMTP & Transactional Systems” image: /images/covers/transactional-email.svg date: 2026-02-14T11:00:00+08:00 lastmod: 2026-02-14T11:00:00+08:00 author: “Punit Naran” authorLink: "" description: “A reliable transactional mailer on the Go standard library only: the raw SMTP conversation, the net/smtp sender, and a bounded worker-pool queue with a dead letter - no vendor, no SDK.” tags: [“Go”, “Email”, “SMTP”, “TransactionEmail”, “StandardLib”, “NoDependencies”] categories: [“Architecture”, “Engineering Handbook”] featuredImage: ""

Every startup guide says: “sign up for SendGrid / Mailgun / AWS SES.” The cost: API keys to rotate, webhooks to build, SDKs to pin, and lock-in that turns a provider switch into a rewrite. Golang4U’s answer is the standard library: net/smtp is battle-hardened and speaks the raw protocol of the internet. This post is the email system we actually run — a reliable transactional mailer built on net/smtp, a worker-pool queue, and no vendor.