Setting up a secure file server in Go is a great way to flex your coding muscles while creating something genuinely useful. I’ve built a few of these myself, and let me tell you, it’s both fun and rewarding.

Let’s start with the basics. We’ll need to import some essential packages:

import (
    "crypto/tls"
    "fmt"
    "io"
    "net/http"
    "os"
    "path/filepath"
)

These packages will help us handle HTTP requests, manage files, and implement security features.

Now, let’s create a simple file server function:

func fileServer(w http.ResponseWriter, r *http.Request) {
    path := r.URL.Path[1:]
    f, err := os.Open(path)
    if err != nil {
        http.Error(w, err.Error(), http.StatusNotFound)
        return
    }
    defer f.Close()

    io.Copy(w, f)
}

This function opens the requested file and sends its contents to the client. Pretty straightforward, right?

But wait, we can’t just serve any file on our system. That would be a huge security risk! We need to restrict access to a specific directory. Let’s modify our function:

func safeFileServer(dir string) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        path := filepath.Join(dir, r.URL.Path[1:])
        if !strings.HasPrefix(path, dir) {
            http.Error(w, "Forbidden", http.StatusForbidden)
            return
        }
        http.ServeFile(w, r, path)
    }
}

This version ensures that we only serve files from the specified directory. It’s a simple but effective security measure.

Now, let’s add some authentication. We’ll use basic auth for simplicity, but in a real-world scenario, you might want something more robust:

func basicAuth(next http.HandlerFunc, username, password string) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        user, pass, ok := r.BasicAuth()
        if !ok || user != username || pass != password {
            w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        next.ServeHTTP(w, r)
    }
}

This function wraps our file server handler and checks for correct credentials before allowing access. It’s not the most secure method out there, but it’s a good start for a personal project.

Speaking of security, we should definitely use HTTPS. Let’s set up a TLS configuration:

func setupTLS() *tls.Config {
    cert, err := tls.LoadX509KeyPair("server.crt", "server.key")
    if err != nil {
        log.Fatal(err)
    }
    return &tls.Config{Certificates: []tls.Certificate{cert}}
}

Don’t forget to generate your SSL certificate and key files! You can use a tool like OpenSSL for this.

Now, let’s put it all together in our main function:

func main() {
    dir := "./files"
    username := "admin"
    password := "secret"

    handler := basicAuth(safeFileServer(dir), username, password)

    server := &http.Server{
        Addr:      ":8080",
        Handler:   handler,
        TLSConfig: setupTLS(),
    }

    fmt.Println("Server starting on https://localhost:8080")
    log.Fatal(server.ListenAndServeTLS("", ""))
}

And there you have it! A basic, secure file server in Go. But we’re not done yet. There’s always room for improvement.

For instance, we could add rate limiting to prevent abuse:

import "golang.org/x/time/rate"

func rateLimiter(next http.HandlerFunc) http.HandlerFunc {
    limiter := rate.NewLimiter(1, 3)
    return func(w http.ResponseWriter, r *http.Request) {
        if !limiter.Allow() {
            http.Error(w, "Too many requests", http.StatusTooManyRequests)
            return
        }
        next.ServeHTTP(w, r)
    }
}

This limits clients to 1 request per second with a burst of 3. You’d wrap your handler with this function in the main() function.

We could also add logging to keep track of access:

func loggingMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        log.Printf("%s %s %s", r.RemoteAddr, r.Method, r.URL)
        next.ServeHTTP(w, r)
    }
}

Again, you’d wrap your handler with this in main().

Now, let’s talk about file uploads. We’ve been focusing on serving files, but what if we want to allow users to upload files too? Here’s a simple upload handler:

func uploadHandler(w http.ResponseWriter, r *http.Request) {
    if r.Method != "POST" {
        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
        return
    }

    r.ParseMultipartForm(10 << 20) // 10 MB limit
    file, handler, err := r.FormFile("file")
    if err != nil {
        http.Error(w, err.Error(), http.StatusBadRequest)
        return
    }
    defer file.Close()

    f, err := os.OpenFile("./files/"+handler.Filename, os.O_WRONLY|os.O_CREATE, 0666)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    defer f.Close()

    io.Copy(f, file)
    fmt.Fprintf(w, "File uploaded successfully")
}

Remember to add this handler to your server setup in main().

One thing I’ve learned from building file servers is that it’s crucial to handle errors gracefully. Users will inevitably try to access files that don’t exist or upload files that are too large. Make sure your error messages are clear and helpful.

Another important aspect is monitoring. You might want to add some basic statistics tracking:

var (
    uploadCount   int64
    downloadCount int64
)

func statsHandler(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintf(w, "Uploads: %d\nDownloads: %d\n", atomic.LoadInt64(&uploadCount), atomic.LoadInt64(&downloadCount))
}

Don’t forget to increment these counters in your upload and download handlers!

As your file server grows, you might want to consider implementing more advanced features like:

1. File versioning
2. User quotas
3. File expiration
4. Search functionality
5. Thumbnail generation for images

Each of these would be a project in itself, but they’re all doable in Go.

Remember, security should always be your top priority when building a file server. Regularly update your dependencies, keep your SSL certificates current, and consider implementing additional security measures like Content Security Policy headers.

Building a secure file server in Go is a journey, not a destination. There’s always room for improvement and new features to add. But with the foundation we’ve built here, you’re well on your way to creating a robust and secure file serving solution. Happy coding!