skip to content
Sandip's Blog
Table of Contents

1. HTTP services

  • net/http server with the 1.22+ ServeMux (GET /users/{id})
  • Middleware chains: logging, recovery, auth, CORS, request ID, timeouts
  • Server timeouts: ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout
  • Graceful shutdown with server.Shutdown(ctx) and signal.NotifyContext
  • Request validation, JSON error responses, status codes
  • Routers (optional): chi, gin, echo, fiber. Learn stdlib + chi first
  • REST design, pagination, versioning, idempotency
  • OpenAPI / Swagger

Visual: request lifecycle

sequenceDiagram
  participant C as Client
  participant M as Middleware
  participant H as Handler
  participant S as Service
  participant R as Repository
  participant DB as PostgreSQL
  C->>M: HTTP request
  M->>M: log, auth, request ID, timeout
  M->>H: ctx with deadline
  H->>S: validated input
  S->>R: business operation
  R->>DB: QueryContext(ctx, ...)
  DB-->>R: rows
  R-->>S: domain model
  S-->>H: result or error
  H-->>C: JSON response

2. Databases

  • database/sql: connection pool, QueryContext, ExecContext, transactions, sql.NullString
  • Prepared statements and SQL injection prevention
  • Drivers: pgx (PostgreSQL), go-sql-driver/mysql
  • Query generation: sqlc (recommended), sqlx, ORM gorm / ent
  • Migrations: goose, golang-migrate
  • Redis (go-redis), MongoDB driver
  • Repository pattern, transactions across layers

3. APIs and messaging

  • gRPC + Protocol Buffers
  • WebSockets (gorilla/websocket or coder/websocket)
  • Message queues: Kafka (segmentio/kafka-go), NATS, RabbitMQ
  • GraphQL (gqlgen) optional

4. Architecture

  • Layered / clean / hexagonal architecture: don’t over-abstract
  • Dependency injection by constructors (no framework needed); wire optional
  • Configuration: env vars, flag, viper, 12-factor
  • Domain vs transport vs storage separation
  • Monolith first, microservices only when needed

Visual: layered architecture

flowchart TB
  T["Transport: HTTP / gRPC handlers"] --> S["Service: business logic"]
  S --> R["Repository interface"]
  R --> DB["Storage: Postgres, Redis"]
  S --> X["External clients"]
  CFG["Config and DI in main()"] -.-> T
  CFG -.-> S
  CFG -.-> R

Define the repository interface next to the service that consumes it.

5. Security

  • Password hashing: bcrypt / argon2
  • JWT, sessions, OAuth2 (golang.org/x/oauth2)
  • TLS, secrets management, input validation
  • govulncheck, dependency updates
  • OWASP top 10 awareness

6. Observability

  • Structured logs (slog)
  • Metrics: Prometheus client
  • Tracing: OpenTelemetry
  • Health endpoints (/healthz, /readyz)
  • pprof endpoint (protected)

7. Deployment

  • Docker multi-stage builds
  • Docker Compose for local dev
  • Kubernetes basics
  • CI/CD with GitHub Actions: fmt, vet, lint, test -race, build, docker
  • Reliability: retries with backoff, circuit breakers, timeouts everywhere, idempotency

Practice

Build one service that has: REST API, Postgres, migrations, auth, structured logging, metrics, tests, Dockerfile, CI, and graceful shutdown.

Previous: Go Mastery 5: Testing, Profiling and Internals
Next: Go Mastery 7: Projects That Prove Mastery

Back to the roadmap