Go Backend for Tor Hidden Services: High Performance Onion API

Go's net/http provides a production-ready HTTP server. Critical security configuration: http.Server{ Addr: '127.0.0.1:8080', ReadTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second, IdleTimeout: 120 * time.Second, MaxHeaderBytes: 1 << 20 }. The timeouts prevent Slowloris attacks and resource exhaustion. Bind to 127.0.0.1 only - never 0.0.0.0 for a hidden service. Security middleware: add response headers in a middleware function: w.Header().Set('X-Content-Type-Options', 'nosniff'); w.Header().Set('X-Frame-Options', 'DENY'). Never expose the pprof debugging endpoint (import _ 'net/http/pprof' automatically registers debug routes on DefaultServeMux - use a separate mux for the production server).

Input validation using Go struct tags and validator library: import 'github.com/go-playground/validator/v10'. Define request structs: type RegisterRequest struct { Username string json:'username' validate:'required,min=3,max=30,alphanum'; Password string json:'password' validate:'required,min=12' }. Validate on handler entry: if err := validate.Struct(req); err != nil { http.Error(w, 'Invalid input', 400); return }. Always decode JSON with json.NewDecoder(r.Body).Decode(&req) - this handles malformed JSON gracefully. Limit request body size: r.Body = http.MaxBytesReader(w, r.Body, 1024*1024) (1MB limit). Return generic error messages to clients - never leak internal error details.

pgx is a high-performance PostgreSQL driver for Go. Setup: import 'github.com/jackc/pgx/v5/pgxpool'. Connection pool: pool, err := pgxpool.New(ctx, os.Getenv('DATABASE_URL')). Always use parameterized queries: pool.QueryRow(ctx, 'SELECT id, password_hash FROM users WHERE username = $1', username). Never format user input into query strings. Connection pool configuration: pgxpool.Config{ MaxConns: 10, MinConns: 2, MaxConnLifetime: time.Hour, MaxConnIdleTime: 30 * time.Minute }. Handle errors explicitly - pgx returns errors rather than panicking. Close the pool on application shutdown: defer pool.Close().

Go compiles to a single binary with no runtime dependencies - ideal for hidden service deployment. Build for Linux: GOOS=linux GOARCH=amd64 go build -o hidden-service-api cmd/server/main.go. Deploy binary to server: scp -P 4499 hidden-service-api root@server:/opt/hidden-service/. Create systemd service: [Service]; Type=simple; User=hiddenservice; WorkingDirectory=/opt/hidden-service; ExecStart=/opt/hidden-service/hidden-service-api; Restart=always; RestartSec=5; EnvironmentFile=/etc/hidden-service/env. Enable: systemctl enable --now hidden-service-api. The compiled binary has no Python/Node dependencies to manage. Updates are clean: compile new binary, stop service, replace binary, start service.

Structured logging with zerolog or slog (Go 1.21+): import 'github.com/rs/zerolog'. Configure: log := zerolog.New(os.Stdout).With().Timestamp().Logger(). Request logging middleware: log.Info().Str('method', r.Method).Str('path', r.URL.Path).Int('status', statusCode).Dur('duration', duration).Msg('request'). Never log: user passwords, session tokens, sensitive request bodies, or PII. Log: status codes, response times, error conditions (without sensitive details), application lifecycle events. For production log shipping: write to stdout and use systemd journal (journalctl -u hidden-service-api). Log rotation: systemd journal handles rotation automatically. Log retention: configure journald.conf MaxRetentionSec for automatic deletion of old logs.