Welcome to server-side web development. Over this course we'll build SignFlow — a real, deployed document-signing app — from an empty folder to a live URL.

Where we're going. SignFlow is running right now: signflow-production-67f3.up.railway.app. Open it. You register an account, upload a document, invite signers by email, they open a private link and sign, and every action lands in an append-only audit trail. That is the finished app — the thing you'll have built and deployed by the end.

What makes it worth building. Nothing here is a toy. Along the way you meet the things real server apps are actually made of:

• Server-side sessions in an HttpOnly cookie (not JWT — and lesson 14 is the whole argument for why the choice differs from the Pica mobile app you may have built).
• CSRF protection — including the one 403 error every developer hits and misreads (lesson 6).
• A file upload hashed with SHA-256 as it streams to disk, so a signature can pin the exact bytes.
• An append-only audit trail the database itself refuses to let you rewrite.

The honest caveat, stated up front. A "signature" in SignFlow is a typed name + a timestamp + the SHA-256 hash of the document. That gives tamper-evidence — change one byte of a signed file and the app tells you — and nothing more. It is not real public-key cryptography, not an eIDAS qualified signature, not proof of who signed. Real e-signature platforms bind a verified identity with cryptographic keys. SignFlow deliberately stops at integrity so the mechanics stay teachable. We'll come back to this honestly in lesson 11, where you'll watch the tamper detection fire.

The six phases. SignFlow was built in six phases, and so is this course:

1. Skeleton — a running server (this lesson).
2. Auth — sessions, login, CSRF, password reset.
3. Documents — upload + hashing + an owner dashboard.
4. Signing — tokened links, signing, tamper-evidence.
5. Audit trail — append-only, enforced by the database.
6. Deploy — Railway, Docker, a persistent volume.

The stack: Go, Chi (router), Templ (type-safe HTML), HTMX (interactivity, no build step), sqlc + goose (database), and PostgreSQL. No JavaScript framework — the server renders the HTML.

This lesson: the skeleton. By the end you'll have a Go module, a Chi router, env-based config, and a page answering on http://localhost:8080 — the foundation everything else grows onto. It starts the way every Go project starts:

go mod init github.com/programuoki/signflow