Vukem is a web framework for REST APIs and full-stack apps: routing, validation, an ORM with migrations, authentication, JSON resources with problem+json errors, HTMX-first views or Inertia with React, Vue or Svelte, GraphQL, gRPC and realtime channels, all driven by one CLI.
Why Vukem#
- Standard library first. Handlers and middleware are plain
net/http. Anyhttp.Handlerworks. - No magic. No globals, no
init()registration, no reflection-based dependency injection. Generators write code you own. - Typed end to end. Typed configuration structs, named routes checked at boot, Zod-style schemas (
z) that parse every input into Go types. - Batteries included, opt-in. SQLite out of the box; PostgreSQL, MySQL, Redis, MongoDB, S3 and WebSockets as separate driver modules, so you only download what you use.
- APIs first-class. RFC 9457 problem details, JSON-only route groups, CORS and body limits are built in.
- Secure by default. Security headers with CSP nonces, deny-by-default CORS, path-traversal-safe static files and fail-closed boot checks, mapped to the OWASP Top 10:2025.
A taste#
A handler is a function that receives a *web.Ctx and returns an error. Returned errors go to a central handler that renders the right response for the client.
func Routes(r *router.Router, posts *controllers.PostController) {
r.Get("/", func(c *web.Ctx) error {
return c.String(http.StatusOK, "Hello from Vukem")
}).Name("home")
r.Group("/admin", func(g *router.Group) {
g.Resource("posts", posts) // posts.index, posts.store, posts.show…
}).Name("admin.")
}
func (p *PostController) Show(c *web.Ctx) error {
id, err := c.ParamInt("post") // non-numeric id → 404
if err != nil {
return err
}
post, ok := p.store.Find(id)
if !ok {
return errs.ErrNotFound // HTML page or problem+json, by content negotiation
}
return c.JSON(http.StatusOK, post)
}What works today#
The Prototype (v0.1) and ALPHA (v0.2–v0.13) phases are complete, and every BETA feature has shipped (v0.14–v0.20); BETA is in stabilisation before v1.0.0.
| Area | Status |
|---|---|
Configuration, application lifecycle, router, *web.Ctx, middleware, problem+json errors | Available |
Validation with z, sessions, CSRF, html/template views, htmx 4 helpers | Available |
| SQLite and PostgreSQL, generic ORM, relations, migrations, factories and seeders | Available |
REST toolkit: vukem new --api, install:api, pagination and query conventions, rate limiting, CORS | Available |
Authentication (session and token guards, install:auth), social login, authorization | Available |
| Mail (SMTP, Resend), cache, storage, events, Telegram logging | Available |
| Security building blocks: SSRF-safe client, signed URLs, webhook signatures, security events | Available |
vukemtest and the vukem CLI | Available |
| Typed handlers, OpenAPI 3.1, TypeScript/Zod types and the Scalar API reference, idempotency keys | Available |
| Queues (sync, memory, database, Redis), task scheduling, Redis, MongoDB | Available |
| Starters: HTMX on Vite + Tailwind CSS v4, templ, Inertia (React, Vue, Svelte), API | Available |
| Localization, server-sent events, encryption, MySQL/MariaDB, S3, file uploads (streaming, tus, direct-to-bucket) | Available |
| GraphQL, WebSockets and broadcasting, gRPC (connect-go), typed API clients | Available |
| Admin panel, dev dashboard, JWT, two-factor, Stripe billing | Available |
See it in production#
Three open-source apps built with Vukem run live: an HTMX quiz, a raffle platform with Inertia and Vue, and a marketplace with Inertia and React. The Showcase links each one and lists the features it demonstrates.