Instructions for AI coding agents working in this repository.
ThruBox Server is a self-hostable relay server acting as a "dumb encrypted mailbox": it stores and forwards opaque encrypted payloads via a REST API. It never sees plaintext — all encryption/decryption happens client-side in the ThruBox Client SDK or other consumers.
cmd/relay/— server entrypoint- Storage: embedded SQLite (WAL mode) via
mattn/go-sqlite3 public/— logo assets referenced by READMEbrand/— logo, favicons, and brand guidelines (seebrand/Brand.md)
go mod download
go build -o relay-server ./cmd/relay
go vet ./...
go test ./...
./relay-server # run in a separate terminal — this blocksDocker:
docker compose up -dNote: there are no _test.go files in the repository yet. If you add functionality, add tests alongside it — don't rely on this note as an excuse to skip tests.
- Keep runtime dependencies minimal: standard library
net/httpplusmattn/go-sqlite3,google/uuid, andyaml.v3(seego.mod) — don't add a web framework, ORM, or other new dependency without discussing it in an issue first. - All SQL must be parameterized (no string-concatenated queries) — this is a relay storing arbitrary payloads, so injection surface must stay closed.
- The server must never decrypt or inspect message payloads; it only stores/forwards opaque blobs.
- Configuration is read from
config.yamlor environment variables (see the table inREADME.md"Configuration") — don't hardcode values that are already configurable.