site: add self-hosted cookieless analytics (Umami), amend privacy promise - #43
Open
idoco2003 wants to merge 1 commit into
Open
site: add self-hosted cookieless analytics (Umami), amend privacy promise#43idoco2003 wants to merge 1 commit into
idoco2003 wants to merge 1 commit into
Conversation
…mise Netlify Web Analytics tops out at country-level location and flat top-pages counts. The founder wants city-level detail and per-page interest data, and chose a self-hosted cookieless counter over any third-party analytics service. The tracking tag is env-gated (PUBLIC_UMAMI_HOST and PUBLIC_UMAMI_WEBSITE_ID): this change ships the amended privacy page with analytics still dark, honoring the page's own promise that changes land in the public repo, with the reason, before going live. Tracking starts only when the Umami instance is provisioned and the env vars are set on Netlify. The CSP allowlists analytics.urml.dev explicitly instead of proxying through this origin, so the request stays visible in any Network tab. Every other place the repo claimed "no analytics" (README, legacy MkDocs config, layout and stylesheet comments) moves in the same commit, and the stale MkDocs privacy page is deleted rather than left to drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Ido Yahalomi <ido@jacob-ai.com>
✅ Deploy Preview for urml-website ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Adds a self-hosted, cookieless Umami analytics counter to urml.dev, env-gated so it ships dark, and amends every "no analytics" claim in the repo honestly in the same change.
src/layouts/Base.astro: Umami tag rendered only whenPUBLIC_UMAMI_HOST+PUBLIC_UMAMI_WEBSITE_IDare set at build time.data-domains="urml.dev"keeps deploy previews and localhost out of the data./adminuses AdminBase and stays untracked.netlify.toml: CSP allowlistshttps://analytics.urml.devinscript-srcandconnect-src, explicitly rather than proxied, so the request stays visible in the Network tab. Comment block rewritten to state the amended network property.src/pages/privacy.astro: the load-bearing change. New Analytics section modeled on the digest section (full data flow: what is recorded, IP used for geolocation + daily visit dedup then discarded, no cookies, no cross-site identifier, off state verifiable). Intro, meta description, bullets, and Verify-it-yourself updated to match.README.md,mkdocs.yml(legacy),src/styles/global.csscomment; deleted the stale legacydocs/privacy.md(MkDocs copy of a live page, drift waiting to happen).Why
Netlify Web Analytics is country-only with flat top-pages counts. Founder wants city-level location and per-page interest data, and picked self-hosted over any third-party analytics company. Umami is the only self-hostable option with city-level geolocation that stays cookieless (GoatCounter tops out at region; Plausible CE needs Postgres + ClickHouse).
Rollout order (honors the privacy page's own Changes clause)
The privacy page promises: changes land in the public repository first, with the reason, before going live. So:
analytics.urml.dev(CNAME) at it. Create theurml.devwebsite in Umami, copy the website ID.PUBLIC_UMAMI_HOST=https://analytics.urml.devandPUBLIC_UMAMI_WEBSITE_ID=<id>in Netlify and redeploys. Tracking starts only after the amended promise is already public. Optional: name the hosting provider in the privacy page's Analytics section at that point (it currently says "a server we rent and control").How it was tested
npm run buildwithout env vars: no script tag anywhere indist/; only the privacy page prose mentions the subdomain.npm run buildwith both env vars: tag present with correct src/id/domains on all public pages; absent from alldist/admin/pages.curl -sI https://urml.devfor the amended CSP header, first visit appears in Umami with city-level location.Rollback
Revert the merge commit. With env vars unset the site is already analytics-free even without a revert; unsetting them is the instant kill switch.
🤖 Generated with Claude Code