I don't want to ID my account but they basically look like:

- OpenAPI API spec and using https://github.com/oapi-codegen/oapi-codegen/ to generate the types, server interface, and client library

- Standard library http package for the API server implementation

- Standard library template/html package for generating the dynamic parts of the webpage content

- Static web content is embedded within the Go binary (https://pkg.go.dev/embed) and served through server routes

- api served from /api route, htmx webpage served from /

- no ORM, mostly using standard library database/sql package for DB transactions, maybe reaching for a query builder library for more complex queries like complex search functionality

- Local S3 compatible object store for dynamic binary data like user-uploaded images and video. Local filesystem can be fine for small scale stuff.

For my home server I have authn/authz happening at the OS/infra layer, but if you need multitenancy you can pretty easily integrate an OAuth/OpenID authn/authz middleware for login with Google or whatever.