Configure Go

BEFOREhttps://proxy.golang.org

AFTERhttp://localhost:23333/go/

Go reaches Depsilo through GOPROXY; module verification still comes from GOSUMDB and go.sum, which Depsilo does not replace.

Configure the client

go env -w GOPROXY=http://localhost:23333/go/,direct
go env GOPROXY

Keep GOSUMDB enabled so Go continues to verify public module checksums.

direct is not outage failover

The comma form, ,direct, advances only when the preceding proxy returns HTTP 404 or 410. It does not fall back when Depsilo is unreachable. Do not change it to |direct: the pipe form can also continue after a 451 policy response and bypass enforcement.

To query versions without changing persistent configuration (this does not verify a module download):

GOPROXY=http://localhost:23333/go/ go list -m -versions rsc.io/quote

Verify requests

1. Check that the instance is ready

   curl -fsS http://localhost:23333/ready

2. Download a pinned module version outside your project

   tmp_dir="$(mktemp -d)"
   (cd "$tmp_dir" && GOMODCACHE="$tmp_dir/gomod" \
     GOPROXY=http://localhost:23333/go/ \
     go mod download rsc.io/[email protected])

   Each run uses a new temporary directory and empty client module cache; it does not change your project or clear an existing cache. Remove this run’s $tmp_dir when finished. This check uses only Depsilo as its proxy, without ,direct, and keeps GOSUMDB enabled, so upstream fallback cannot hide a connection failure. The persistent ,direct setting above is for everyday use; its fallback behavior is described in the caution.

3. Confirm the traffic in Admin

   In Access logs, check the /go/ requests, the pinned version’s @v/*.mod and @v/*.zip files, and their cache results; the Cache page can also show the matching objects. A successful or faster download alone does not prove the request went through Depsilo. If the server has not cached the version, the first request fetches upstream; repeat the command with a new temporary client cache to verify a later hit. If already cached, the first request may hit.

Common questions

Should GOSUMDB be disabled?

No, unless your organisation runs its own checksum database. Keeping the default continues to verify public module checksums.

What about private modules?

GOPRIVATE and GONOSUMDB decide which modules skip public verification and proxying. Depsilo only proxies; it does not change those client policies.