gamertan
3a4b6db9b8
Export the reviewed application-neutral package set through the exact public allowlist. Development history and private application evidence remain outside this canonical source root. Developed with material AI assistance under maintainer review. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
Gamertan Web Foundations
Status: unreleased development work toward
v0.1.0-preview.1. No install coordinate is promised until the reviewed public snapshot is tagged.
Small, composable Go packages for the unglamorous boundaries of a careful web application: request identity, structured request logs, browser security, passwords and sessions, permissions, SQLite persistence, and private analytics.
This is a toolkit, not an application framework. Your application keeps its
router, HTTP policy, HTML, authorization decisions, cache behavior, and
deployment. Each package works with net/http and can be adopted independently.
The first preview targets modest Linux servers, local files, SQLite, and normal Go binaries. It requires no Redis, message broker, hosted identity provider, telemetry service, or JavaScript framework.
Packages
requestmeta: trusted-proxy resolution, HTTPS/origin metadata, and request IDs.requestlog: bounded versioned records, middleware, sinks, and private JSONL.websec: headers, origin checks, CSRF, redirects, body limits, and rate limits.abuse: application-classified request abuse with pluggable persistence.auth,authhttp,authsqlite: passwords, sessions, permissions, cookies, and a no-CGO SQLite adapter.analytics: safe and sensitive aggregate projections over request records.
The copyable starter under starters/basic demonstrates the packages without
turning them into a router or template system.
Security boundary
Client addresses are accepted from forwarding headers only when the immediate peer and every skipped proxy are explicitly trusted. Sensitive request fields are off by default. Cryptographic entropy failures fail closed. Logs and account databases remain private application data and never belong in source releases.
See SECURITY.md, docs/THREAT_MODEL.md, the application adoption contract, and docs/SERVICES_ROADMAP.md.
Licensing
This is a multi-license repository with exact file-level SPDX identifiers:
- embeddable packages and adapters: MPL-2.0;
- future standalone network services and operational machinery: AGPL-3.0-only;
- starters, examples, and reusable configuration: 0BSD.
See LICENSES.md. No standalone auth or logging server is included in this preview.