Prerequisites

• Go 1.25.12+
• PostgreSQL (SSL in production: DB_SSLMODE=require or higher)
• Environment file: .env (never commit; listed in .gitignore)

Build

go build -o bin/server ./cmd/server
go build -o bin/migrate ./cmd/migrate
go build -o bin/seed ./cmd/seed

CI builds the same binaries (.github/workflows/ci.yml).

Migration

./bin/migrate up          # or: go run ./cmd/migrate up
./bin/migrate down 1      # optional rollback step

Schema: migrations/000001_schema + 000002_seed (SQL seed / permission catalog).
For the admin user, also run:

./bin/seed

After production launch, new changes are added via incremental migration files; during development the schema may be consolidated.

Single-process deployment (no Redis)

GoCore is designed to run as a single process; Redis or an external cache is not required.

Components that use in-process memory:

• JWT refresh token store (MemoryTokenStore)
• Login guard and IP rate limiter
• Authz Resolver (role-permission cache)
• Settings Service (platform settings cache)

This setup is sufficient for a single instance. When planning horizontal scaling with multiple replicas, shared stores and consistent invalidation must be added — out of scope in the current version.

Running

./bin/server

Listen address: HTTP_HOST + HTTP_PORT (default 0.0.0.0:8080).
Shutdown: APP_SHUTDOWN_TIMEOUT.

Health:

Path	Meaning
/livez	Process alive
/readyz	Dependencies ready (DB, etc.)
/healthz	General health

Environment groups

Prefix	Required (production)
APP_*, HTTP_*, DB_*	Yes
AUTH_JWT_SECRET (≥32), MFA/encryption keys	Yes
AUTH_EMAIL_LINK_BASE_URL	Real public URL
OAUTH_*	If SSO is used
SEC_TURNSTILE_*	Yes (public forms)
SEC_TRUSTED_PROXIES	If behind a proxy
SMTP_*	For real email
CONTACT_RECIPIENT_EMAIL	Yes
NOTIFY_*	If SMS is used
PAYMENT_* + field encryption key	If payments are used

Full list: .env.example. The application validates at boot (fail-fast).

Reverse proxy

• Terminate TLS at the proxy; use SEC_TRUSTED_PROXIES for real client IP
• WebSocket: allow upgrade for /goui/ws (panel UI) and /api/v1/ws (general live events; notifications)
• Keep body limits aligned with HTTP_BODY_LIMIT_BYTES / SEC_MAX_UPLOAD_BYTES

Security checklist

• .env secrets are strong and rotation-ready
• APP_ENV=production
• DB SSL enabled
• Turnstile, JWT, MFA, and payment encryption keys set
• CORS: HTTP_CORS_ALLOW_ORIGIN restricted
• Seed default admin password changed
• Iyzico/Moka callback and webhook URLs registered in provider panels

Observability

• Logging: slog (structured)
• Test/scan: go test -race, golangci-lint, govulncheck, gosec