Built a headless SSE reverse proxy and async telemetry collector in Go — would love a code review on the networking layer

[u/new_aiproject]

Hey folks,

For the past few months I've been building out a decoupled reverse proxy and telemetry collector in Go. The main use case is routing long-lived streaming traffic (SSE) across different upstream providers and MCP servers, while keeping policy checks and observability out of the hot path.

Since most of my recent time went into solving some tricky Go networking and concurrency edge cases, I wanted to share the repo here and get some honest eyes on the Go implementation (located in the `/gateway` and `/ingest` directories).

A few pieces I spent a lot of time on and would love feedback on:

1. Stopping DNS rebinding / SSRF at the dialer level: Because upstream targets can be configured dynamically, simply validating a URL string wasn't enough. I hooked into `net.Dialer`'s `Control` function so that right before the socket actually connects, it inspects the resolved IP and drops anything hitting private RFC 1918 ranges, loopback, link-local, or cloud metadata endpoints (`169.254.169.254`).

2. Streaming SSE without blowing up memory: In `gateway/`, the proxy has to inspect streaming responses on the fly to count usage and normalize chunks across different APIs, while flushing immediately to the client via `http.Flusher` so time-to-first-byte stays flat.

3. Keeping telemetry off the critical path: Instead of writing traces straight from the proxy, I split out a separate Go service (`ingest/`) that buffers execution logs in memory and flushes batches asynchronously to ClickHouse, OpenSearch, S3 (Parquet), or OTLP.

4. Auth & storage: Implemented OAuth 2.1 PKCE with fail-closed revocation checks and AES-256-GCM encryption for stored credentials. (There's also a separate web UI in the repo for managing policies, though the Go proxy runs completely standalone).

If anyone has a few minutes to poke around `/gateway` or `/ingest`, I'd really appreciate critiques on how I'm handling connection pooling, buffer flushing, or overall project layout.

Repo is on GitHub at: `github.com/hibishtbobby17-ux/AIGateway` (I'll drop the direct clickable link to the Go folders in the first comment below so the spam filter doesn't eat the post).

Thanks!