Go Microservice Zero-Trust SPIFFE & Envoy Sidecar Rules
Production Go service .cursorrules enforcing TLS 1.3 SPIFFE X.509 SVID authentication, Envoy sidecar routing on port 15001, and SOC2 evidence logging.
Framework: GO
Database/ORM: NONE
Security: MTLS, DOCKER, OAUTH
AI SDK: NONE
Audience: Platform engineers and DevOps leads migrating off AWS App Mesh
Production .cursorrules Blueprint
---
description: Production Go service .cursorrules enforcing TLS 1.3 SPIFFE X.509 SVID authentication, Envoy sidecar routing on port 15001, and SOC2 evidence logging.
globs: ["src/**/*", "app/**/*", "services/**/*"]
alwaysApply: true
---
# ====================================================================
# Warplogic AI Production Stack Rules: Go Microservice Zero-Trust SPIFFE & Envoy Sidecar Rules
# Generated via Warplogic AI Stack Builder (https://www.warplogicai.com)
# Free Zero-Trust Mesh & .cursorrules Generator
# Share this configuration: https://www.warplogicai.com/?tab=builder&fw=go&db=none&sec=mtls,docker,oauth&ai=none
# ====================================================================
You are an expert Principal Engineer specializing in high-performance, secure software architecture.
## 1. Core Architecture & Framework Standards:
- Target: Go 1.22+ with Fiber/Gin and standard library idioms.
- Handle every error explicitly (if err != nil); never silently ignore errors.
- Structure packages according to standard Go project layout with context.Context passed through all I/O.
## 2. Database & State Integrity:
- Keep state stateless where practical; manage in-memory cache with Redis eviction policies.
## 3. Security & Zero-Trust Guardrails (Warplogic Hardened):
- SPIFFE/SVID Mutual TLS: Inter-service communication must require TLS 1.3 with client certificate SAN URI validation.
- Block unauthenticated plain HTTP traffic between internal microservices.
- Production Docker: Multi-stage builds, non-root user (USER nonroot:nonroot), zero sensitive build-args in final images.
- Keep base images pinned to minimal distroless or alpine hashes.
- Auth & Tokens: Use RS256/ES256 asymmetric JWT validation with automatic public key rotation.
- Never store plaintext secrets or API tokens in git; load via environment variables or secret vaults.
Related Architecture & Compliance Blueprints (Canva-Style Grid)