FortiSafe
A drop-in authorization service — role- and group-based access control in Go.
Overview
A backend service that centralizes authorization: model users, roles, groups, and resources once, then let any application ask a single question — "can this user do this action on this resource?" Written in Go on Fiber, containerized with Docker, and fronted by Nginx.
The problem
Access-control logic tends to get copy-pasted into every service that needs it, drifting out of sync and becoming impossible to audit. FortiSafe pulls that concern into one place with a clean, documented API.
Architecture
- Callers: Your applications (Ask for permission checks); Admins (Manage users, roles and groups)
- (HTTPS) Proxy [Docker Compose]: Nginx (Reverse proxy)
- Go service [Docker Compose]: User auth (JWT + bcrypt); Authorization (Roles + groups → CRUD on resources); Admin plane (Separate login, CSV bulk import)
- (GORM, parameterized queries) Data: PostgreSQL (On AWS RDS: users, roles, groups, resources)
Any app asks one question: can this user do this action on this resource? Admins sign in on a separate plane.
Approach
An RBAC + GBAC model
Users hold roles and belong to groups; roles and groups map to four CRUD permissions over resources — modeled with GORM over PostgreSQL (AWS RDS) so every relationship stays explicit, queryable, and auditable.
A separate admin plane
Admin authentication is isolated from user authentication, with JWT and bcrypt password hashing across both, so operators and end users never share a trust boundary.
Bulk provisioning
CSV upload imports users and resources at scale while preserving their role and group relationships — turning onboarding from a scripting chore into one request.
Containerized and proxied
Docker Compose runs the Go service behind an Nginx reverse proxy; GORM parameterizes queries to keep SQL injection off the table. The full REST API is published as Postman docs.
Highlights
- Role- and group-based CRUD permissions
- Separate admin auth plane (JWT + bcrypt)
- Bulk CSV import that preserves relationships
- Dockerized behind Nginx, PostgreSQL on AWS RDS
Stack
Go, Fiber, GORM, PostgreSQL, Docker, Nginx, JWT