Cthulhu: An Anonymous File Sharing Platform

An anonymous file sharing platform built on Go microservices: upload up to 1 GB without an account and get a secure link that expires in 48 hours. Authenticated users extend that to 14 days, manage their uploads on demand, and optionally password-protect shared content.

The backend is five independent Go services communicating over gRPC, with an Astro frontend talking only to the gateway. File uploads use a two-phase presigned URL flow: the gateway calls the filemanager to prepare presigned S3 PUT URLs, the client uploads directly to S3, then confirms the upload to persist metadata. This keeps file bytes off the application layer entirely. On confirmation, the filemanager publishes to a RabbitMQ exchange and the filescanner picks up the job, streams the file bytes to ClamAV over the INSTREAM TCP protocol, and writes the scan verdict back. The lifecycle service runs a cleanup daemon on a configurable interval, queries for expired bucket records, and calls filemanager to delete the buckets and their S3 objects.

Protobuf definitions live in a shared proto package and are compiled with buf into typed Go clients and servers across all services. The whole repo is a Turborepo monorepo with a single mise run dev command that installs the toolchain, generates protobuf and sqlc code, and starts the full development pipeline.

Highlights

• Designed an upload path where file bytes never pass through application code: client uploads directly to S3 via presigned URLs, application layer only handles metadata.
• Built async malware scanning via RabbitMQ and ClamAV INSTREAM protocol, keeping scan latency off the upload confirmation path.
• Implemented a lifecycle cleanup daemon that periodically purges expired buckets by calling back into the filemanager gRPC service.
• Structured as a Turborepo monorepo with shared proto, messaging, and common packages used across all five Go services and the Astro client.