A word of warning guys, I've had a look through the code and unless I've missed the obvious, there's nothing in there to change user ID; which means this would either need to be run as root, or would need to listen on a port > 1024.

In the case of the former, that's a huge step backwards in terms of security.

In the case of the latter, that would mean you'd need another reverse proxy hooked up - which would negate the need for this web server to begin with.

This can easily be fixed within Go though:

    import (
    	"log"
	"syscall"
    )
    
    const (
    	user_id  int = 1000
    	group_id int = 1000
    )
    
    func secureDaemon() {
    	// set group id first as you need to be root to change group
    	err := syscall.Setgid(group_id)
    	if err != nil {
    		log.Fatalln(err)
    	}
    	
    	err = syscall.Setuid(user_id)
    	if err != nil {
    		log.Fatalln(err)
    	}	
    }

You can also add chroot to your code if you want to be ultra paranoid:

    import (
	"os"
    )
    
    const (
    	chroot_dir string = "/opt/go-webserver"
    )
    
    func chrootDaemon() {
    	err := os.Chdir(chroot_dir)
    	if err != nil {
    		log.Fatalln(err)
    	}

    	err = syscall.Chroot(chroot_dir)
    	if err != nil {
    		log.Fatalln(err)
    	}
    }

This will need to be done before you change your user ID (as you need root permissions to chroot) and you may need to compile the Go without CGO because some of the standard Go libraries will have SO dependencies (I found this to be the case with domain name lookups).

(the above code is adapted from my own Go web framework that I'm in the processes of building)