DarkLabel
The white-label company-site engine that powers meiuxmeiux.com itself.
DarkLabel is a single-binary white-label company-site framework — Go + SQLite + html/template, no node_modules, no build pipeline. Drop in copy and assets, run the gate ritual, ship a production site with admin, lead capture, mail relay, AI news discovery, reviews, sessions, and security hardening already wired. The site you are reading this on is a fresh-history fork of DarkLabel.
- Go 1.25
- SQLite (WAL)
- html/template
- Postmark
- OpenRouter
- Apache (reverse proxy)
- systemd
- Lucide icons
- Vanilla CSS/JS
DarkLabel is the white-label company-site framework we built so that every new client engagement starts at "configure brand + content" rather than "wire up a CMS." The public face is intentionally generic — four service slots, contact form, lead pipeline, news/testimonials, terms + privacy. The interesting half is the admin: a single Go binary with an embedded SQLite database, a renderer, a session manager, a mail relay, and an AI-assisted news-discovery flow that streams drafts back to the operator over SSE.
What ships in the box
- Public site — Home, Services, About,
Contact, Thanks, Terms, Privacy, Careers, Testimonials,
News (list + detail), plus
/health,/robots.txt,/sitemap.xml, and/.well-known/security.txt. Twenty-seven routes out of the gate. - Lead capture with honeypot + 3-per-hour rate limit + Postmark notification. Empty token → quiet no-op, the dev path stays usable.
- Admin panel at
/admin/— dashboard, leads, inbox (inbound mail), sent, compose, news CRUD with AI discovery, reviews CRUD with feature/active toggles, trash, settings, help. - AI news discovery — server-sent-events stream that pulls Google News RSS, dedupes against the database, fetches OG metadata, asks an OpenRouter model for title/summary/commentary/category/tags, saves a draft. Brand-neutral by design: callers pass a config struct with their own search queries, system prompt, valid categories, and stock images.
- Reviews with public testimonials page, admin CRUD, toggle-featured / toggle-active, animated star rendering.
- Sessions in SQLite, hydrated into an in-memory cache at boot. Sessions survive systemd restarts; the in-memory layer keeps lookups O(1).
Security plumbing
- Constant-time credential compare via
crypto/subtle. - Admin cookies are
HttpOnly + Secure + SameSite=Strict, scoped to/admin. - 5-per-15min admin login rate limit, 3-per-hour public form rate limit.
- TLS 1.2+ only, HSTS, X-Frame-Options, Referrer-Policy on every response.
- systemd unit ships with
NoNewPrivileges,PrivateTmp, andProtectSystem=full. - Parameterized SQL only — even for integer columns. No ORM.
The fork-and-scrub pattern
DarkLabel is also the donor codebase for client engagements.
Each fork ships with a scrub gate
(scripts/verify-scrub.sh + a Go test +
scripts/scrub-live.sh) that walks every rendered
route, every header, and every response body looking for
upstream brand tokens. Zero hits is the bar; the pipeline
refuses to commit otherwise. The result is a pattern where
we can stand up a brand-new company site in days without
leaking the previous engagement's vocabulary — which is exactly
how meiuxmeiux.com itself was born.
Why "DarkLabel"
The name is the pitch. The codebase is intentionally brand-blank: dark on the inside, ready to be labeled. Most "company site" CMSes assume you want WordPress; DarkLabel assumes you want a single Go binary you can SSH to, restart in milliseconds, and forget about.
Straight from the source
The project's own README.
Rendered in place — every link, image, and code block carried over from the repo. The page below is what a contributor would see opening the project for the first time.
DarkLabel
A white-label lead management platform built with Go. Features a public-facing website with service information and contact form, plus a full admin panel for managing leads and email communications. Fully configuration-driven — customize business name, colors, services, and more via environment variables.
Features
Public Website
- Responsive, mobile-first design
- Service listings and business information
- Contact form with validation and honeypot spam protection
- SEO optimized (meta tags, sitemap, structured data)
- Configurable color scheme via CSS variables
Admin Panel
- Lead management with status tracking (new, contacted, closed)
- Email inbox (Postmark inbound webhook)
- Compose and send emails via Postmark
- Email forwarding configuration
- Trash/spam management for leads and emails
- Session-based authentication with rate limiting
White-Label Ready
- All branding configured via environment variables
- Dynamic service options (JSON configuration)
- Customizable color palette (primary, secondary, accent)
- No hardcoded business names, addresses, or phone numbers
Tech Stack
- Backend: Go (standard library, no frameworks)
- Database: SQLite with WAL mode
- Email: Postmark API
- Frontend: Vanilla HTML/CSS/JS, Lucide icons
- Deployment: systemd service behind nginx
Quick Start
# Copy environment config
cp .env.example .env
# Edit .env with your business details
# Build
make build
# Run locally
make run
The app will start on the configured port (default: 8123).
Configuration
Copy .env.example to .env and configure all variables:
| Variable | Default | Description |
|---|---|---|
PORT |
8123 |
Server port |
DOMAIN |
localhost |
Your domain name |
ADMIN_USER |
admin |
Admin login username |
ADMIN_PASS |
changeme |
Admin login password |
BUSINESS_NAME |
My Business |
Displayed throughout the site |
BUSINESS_PHONE |
(555) 000-0000 |
Contact phone number |
BUSINESS_EMAIL |
[email protected] |
Contact email address |
BUSINESS_ADDRESS |
Your City, ST |
Business location |
BUSINESS_TAGLINE |
Professional services you can trust |
Hero/meta tagline |
BUSINESS_HOURS |
Mon-Fri: 9am-5pm |
Displayed on contact page |
SERVICES_JSON |
[{"value":"general","label":"General Inquiry"}...] |
Contact form service options |
COLOR_PRIMARY |
#1e293b |
Primary brand color |
COLOR_SECONDARY |
#334155 |
Secondary brand color |
COLOR_ACCENT |
#3b82f6 |
Accent/highlight color |
POSTMARK_TOKEN |
(empty) | Postmark server API token |
POSTMARK_FROM |
(empty) | Postmark sender address |
REPLY_SUBJECT_TEMPLATE |
Re: Your Inquiry - %s |
Email reply subject (%s = business name) |
Services Configuration
The SERVICES_JSON variable accepts a JSON array of service options for the contact form:
[
{"value": "consulting", "label": "Consulting"},
{"value": "support", "label": "Technical Support"},
{"value": "sales", "label": "Sales Inquiry"},
{"value": "other", "label": "Other"}
]
Project Structure
.
├── cmd/main.go # Entry point, routing, middleware
├── internal/
│ ├── config/ # Environment configuration
│ ├── database/ # SQLite initialization and migrations
│ ├── handlers/
│ │ ├── admin/ # Admin panel handlers
│ │ └── public.go # Public page handlers
│ ├── mailer/ # Postmark email client
│ ├── models/ # Data structures
│ ├── ratelimit/ # IP-based rate limiting
│ ├── session/ # Session management
│ ├── templates/ # Template rendering
│ ├── testutil/ # Test helpers
│ └── validation/ # Form validation
├── static/
│ ├── css/ # Stylesheets
│ └── js/ # JavaScript
├── templates/ # HTML templates
│ ├── admin/ # Admin panel templates
│ ├── base.html # Base layout
│ └── *.html # Public pages
├── data/ # SQLite database (gitignored)
└── .env.example # Environment template
Commands
make build # Build the binary
make run # Run locally
make restart # Rebuild and restart systemd service
make logs # View service logs
make status # Check service status
Customization
Colors
Override the default slate/blue palette with any hex colors:
COLOR_PRIMARY=#1a1a2e
COLOR_SECONDARY=#16213e
COLOR_ACCENT=#e94560
These are injected as CSS custom properties and cascade throughout the site.
Templates
HTML templates are in the templates/ directory. They use Go's html/template package with template variables for all business data. No hardcoded values need changing — everything flows from the configuration.
License
MIT License. See LICENSE for details.
Build something like this
Want a tool like this for your shop?
We've shipped this kind of thing before. Twenty-minute intro call, no slides.