A complete SaaS in one Go binary. Yours, on your server, readable in an afternoon.
Website · Documentation · Try it in 2 minutes · Blog · Buy a licence
Accounts, teams, roles, Stripe, transactional email, an admin backoffice, FR/EN — the six months of plumbing every SaaS rewrites, already written, already tested, and shipped as code you own. Go + chi + sqlc on the back, Vue 3 + TypeScript + Tailwind on the front, PostgreSQL or SQLite, one static binary at the end.
No Vercel, no Supabase, no Clerk, no per-seat platform tax. A VPS and a domain are all it takes, and nothing phones home.
This repository is the public face of a commercial product. The source code is delivered to licensees through a private repository. What is public here: the documentation, the capability map coding agents read (AGENTS.md), the architecture decisions (DECISIONS.md), the changelog, the licence text, and a standalone Docker Compose that runs the full product on your machine without buying anything. Issues and Discussions are open to everyone.
curl -fsSLO https://govuekit.dev/labs/docker-compose.yml
docker compose up -d
# → http://labs.localhost — sign in with dev@labs.local / labsOne file, one command. It starts the product and everything it talks to:
the app, PostgreSQL, single sign-on (Dex), S3 uploads (MinIO), a Stripe API
double, and a mail inbox catching every email. No domain, no certificate, no
configuration. Sign in through SSO, create an organization, invite a
teammate, read their invitation in the inbox, upload an avatar into the
bucket, open the backoffice. Wipe it all with docker compose down -v.
The same file lives in labs/ with its walkthrough.
 |
 |
Light and dark, French and English: the same binary serves all four.
| Capability | Details |
|---|---|
| Accounts | argon2id passwords, email verification, reset, magic links, Google / GitHub / Microsoft / any OIDC, TOTP two-factor, session listing and revocation. Enumeration-safe, rate-limited. |
| Organizations | owner / admin / member roles enforced server-side, email invitations, row-level tenancy on every query. A non-member gets a 404, never a 403, and a test proves it cross-tenant. |
| Billing | Stripe subscriptions and one-time products behind one provider seam. Idempotent webhooks (signature over the raw body, dedup and business write in one transaction), refunds and chargebacks handled. Off until a key is set, and the unconfigured path is tested. |
| 16 transactional templates in French and English, SMTP or Resend, a durable DB-backed queue with retries so a redeploy loses nothing. | |
| Jobs | Background jobs stored in the database, surviving restarts. |
| Files | Local disk or any S3-compatible storage, one env var. |
| Admin | Super-admin backoffice: MRR, ARPU, churn, plan mix, signups, moderation, impersonation, audit log. Computed from your own database, no Stripe round-trip. |
| Security baseline | CSRF everywhere, SameSite/Secure/HttpOnly cookies, HSTS/CSP/XCTO/XFO, timing-safe comparisons, an SSRF-hardened outbound HTTP client, rate limits on every sensitive route. |
| SEO | One build flag prerenders the public pages to static HTML with canonical, hreflang, per-language URLs and a sitemap. |
| Frontend | Vue 3 + TypeScript + Composition API, Pinia, Vue Router, Tailwind, dark mode, i18n FR/EN with parity enforced by a test, typed fetch client. |
| Packaging | vite build → go:embed → one ~27 MB static binary. Docker multi-stage, docker-compose.prod.yml with Traefik and Let's Encrypt. |
Numbers, measured on the code a buyer receives: ~11 000 lines of Go, 19 packages, 234 tests run in CI on both PostgreSQL and SQLite, 14 Playwright journeys driving the real production binary, one migration file, 14 direct Go dependencies. govulncheck and npm audit: zero reachable vulnerabilities.
- You own the code. Not a framework, not a dependency: a repository you read, edit and delete from. The ten-minute tour follows one request through every layer. That is the whole architecture, and the claim is falsifiable.
- The boring parts are the hard parts, and they are done. Tenancy, idempotent webhooks, session revocation, a durable mail queue, TOTP: the things a starter usually leaves as an exercise.
- Built for coding agents too. AGENTS.md maps every capability to its package and extension seam, so Claude Code, Codex or Cursor extend the kit instead of rebuilding a login flow or a second Stripe client. A test fails when that map drifts from the code.
- Tested like something you bill through. The whole suite runs on both engines in CI, and the unconfigured paths (no Stripe key, no OAuth keys, the default for most deployments) are tested too.
- Small enough to trust. A schema that fits in one migration file and a DECISIONS.md that explains every non-obvious choice, including the features that were built and then removed to keep it a core.
Published at docs.govuekit.dev and mirrored in
docs/:
- Getting started · The ten-minute tour · The labs
- With a coding agent · Stripe: on, off, removed · Security
- Testing · Deploy on one VPS · Customizing
- DECISIONS.md · CHANGELOG.md · ROADMAP.md · SECURITY.md
From the blog (also in French):
- Go SaaS boilerplates in 2026: the honest list · Vue 3 SaaS starter kits in 2026 · GoVueKit vs supastarter vs SaaS Pegasus vs ShipFast
- Stripe webhooks in Go: the complete idempotent handler · Multi-tenant SaaS in Go with chi and sqlc · Row-level multi-tenancy in Go
- Embedding a Vue 3 app in a Go binary with go:embed, and keeping SEO · SQLite or PostgreSQL: one codebase, two engines
- Vibe coding on a boilerplate: AGENTS.md as a tested contract · Self-hosted SaaS boilerplate: what "self-hosted" has to mean · 21 questions to ask a SaaS boilerplate
Go (latest stable), go-chi/chi, database/sql + sqlc (no ORM),
pressly/goose migrations embedded and auto-run, alexedwards/scs sessions,
alexedwards/argon2id, stripe/stripe-go, go-playground/validator,
gorilla/csrf, jackc/pgx and modernc.org/sqlite (pure Go, no CGO).
Vue 3, TypeScript, Vite, Pinia, Vue Router, Tailwind CSS, vue-i18n,
Playwright, Vitest.
One-time purchase, €199 at launch (regular price €249), perpetual licence, lifetime updates of the major version, unlimited end products including client work. Full refund within 14 days as long as the licence has not been claimed. The complete text is in LICENSE.md.
Delivery is a read-only invitation to the private source repository, sent minutes after checkout. → govuekit.dev/#pricing
- Discussions for questions and feedback: open to everyone, licensee or not.
- Issues for bugs and documentation errors.
- Security reports: see SECURITY.md.
- Email: benjamin@kolapsis.com
Made in France by kOlapsis, the people behind Maintenant, Ackify and SHM.