Mastering Private GitLab Repositories with Go Modules: GOPRIVATE, GONOPROXY & GONOSUMDB

This article introduces practical steps for building a private GitLab repository workflow for Go projects.

go get

Running go get your.gitlab.com/pkg/example without configuration often yields an error about missing credentials. The error message points to the Go FAQ for HTTPS usage.

Companies often permit outgoing traffic only on ports 80 (HTTP) and 443 (HTTPS), blocking git (9418) and SSH (22). Using HTTPS enforces certificate validation, providing protection against man‑in‑the‑middle attacks, which is why go get defaults to HTTPS.

To use HTTPS, configure authentication via .netrc or switch to SSH by editing ~/.gitconfig:

machine github.com login USERNAME password APIKEY

[url "ssh://[email protected]/"
    insteadOf = https://github.com/

After configuring, go get (or go get -v) works and shows logs.

GONOPROXY

Before Go 1.12, setting GOPROXY for proxy access caused 404 errors when the proxy could not reach private repositories. Go 1.13 introduced GONOPROXY to specify domains that should bypass the proxy, supporting comma‑separated values.

GONOSUMDB

Go modules verify downloaded dependencies with checksums from sum.golang.org. Private repositories are invisible to this service, leading to verification failures. Go 1.13 added GONOSUMDB to exclude specified domains from checksum verification, also supporting comma‑separated lists.

GOPRIVATE

Go 1.13 also introduced GOPRIVATE, which automatically disables proxy and checksum verification for matching domains. Example: GOPRIVATE=*.corp.example.com,your.gitlab.com Combined with GONOPROXY and GONOSUMDB, you can fine‑tune behavior. Be aware that setting GONOPROXY=none while GOPRIVATE is defined may still route requests through the proxy, causing errors; adjust settings accordingly.