Federated blogging with WriteFreely

Re building and "downloading several dozen packages". The project is at least using go.mod and so the downloads are fully pinned to git commits/tags and checksummed. So it's not quite the wild west of "let's just download the latest version of foo and hope for the best". Personally, I much prefer pointers to vendoring all your deps, but I know opinions differ on that.

They're using the built-in Go webserver which as far as I know has an excellent security record - I would have no worries about exposing it directly to the internet; I have used it a lot commercially/professionally.

The template language *is* documented. It's the standard Go templating system. https://golang.org/pkg/text/template/ https://golang.org/pkg/html/template/
That said, I agree about documenting which resources/methods/vars are available to the templates. The template entry point is Execute or ExecuteTemplate, and the last arg to that is always the "receiver" for the template, but eg https://github.com/writeas/writefreely/blob/cb1bd37f64abc... is unhelpful given it comes in as the empty interface. Generally I consider use of the empty interface in Go as a code smell... https://github.com/writeas/writefreely/blob/32e99d00415c6... is somewhat more discoverable. OTOH, depends on the intended audience - I've been working professionally in Go for over 5 years now so I have no qualms digging through this.

Just FTR, I've no association with WriteFreely and have never heard of it or looked at the code base before this morning.