go-devsecops-pipeline VS certmagic

Here’s acode example of the way AWS expects a go project to be formatted (checks main.go).

Anyways, here's a basic app (M-V-C) built with GitHub Actions and deployed to AWS Elastic Beanstalk with Docker containers with a CI/CD pipeline.

Here's a repo that shows how GO files should be structured for running in AWS EB on the Docker Platform (pay attention to the main.go server port number as that is required)

2.) If you'd like to see what deploying a GoLang web app to Elastic Beanstalk with Docker in AWS looks like then here's the sauce for that (source code only).

Now, I serve TLS directly from the application and was able to make it all work with Certmagic.

For deployment, you may not need a reverse proxy with Nginx or the likes. Certmagic will make HTTPS a breeze. Also makes it possible to handle multi-tenant SaaS domains SSL provisioning. While not the easiest, it was much easier than trying to do it at the reverse proxy and cheaper than doing it with Cloudflare's SaaS service.

If you don't want to move certificate management to a different service, use CertMagic in your app.

With certmagic its done completly automatic using letsencrypt: https://github.com/caddyserver/certmagic

The project is also a boon for devs. The certmagic library0 makes it trivial to add Let's Encrypt support to any Golang web server code.

Because Lego maintainers wouldn't budge when Caddy needed changes made to increase ACME reliability. Matt wrote his own implementation https://github.com/mholt/acmez and started using that in Caddy soon after. There's a deeper explanation here: https://github.com/caddyserver/certmagic/issues/71

That said, I would use https://github.com/caddyserver/certmagic to manage you SSL certs.

I terminate SSL in GO (less moving parts to manage), and use https://github.com/caddyserver/certmagic to provision and renew my certs.