Self-hosted cookieless Matomo analytics, remove foreign tracking #17

New issue

Closed

opened 2026-07-09 17:42:37 +00:00 by Phil · 0 comments

Phil commented

2026-07-09 17:42:37 +00:00

Owner

Symptom / Motivation

The site currently ships a hardcoded Matomo Tag Manager snippet in templates/_components/core/footer.twig (lines 35–44) pointing at a third-party Matomo instance (https://krisnetics.biz/matomo/, container container_mAz2p4E2.js) — a leftover from a previous developer. philflow.io is currently sending visitor data to a foreign, unauthorized analytics endpoint, unconditionally and without consent. This is a data-protection / DSGVO problem and must be removed.

Phil wants his own analytics instead: self-hosted, cookieless, GDPR-defensible.

Scope

Remove the foreign krisnetics.biz Matomo Tag Manager snippet from footer.twig.
Add a config-driven, cookieless Matomo _paq tracking partial (_system/analytics.twig), rendered only when MATOMO_URL + MATOMO_SITE_ID are set (⇒ no tracking locally).
Surface config via new config/custom.php reading App::env(); forward the two env vars into the php service in docker-compose.traefik.yml.
Self-host Matomo as its own container + own MariaDB + Traefik subdomain (analytics.philflow.io), image pinned matomo:5.11-apache. No host-port mapping.

Acceptance criteria

No reference to krisnetics.biz anywhere in rendered HTML.
Local docker compose up: page renders no Matomo snippet (env empty).
Prod: analytics.philflow.io serves Matomo over HTTPS (LE cert); visiting philflow.io records a hit; no _pk_* cookies set (cookieless); IP anonymized.
Setup reproducible via compose (bar the one-time Matomo web-installer bootstrap + DNS).

Note

Cookieless-JS in DE (TDDDG) is a risk-reduction, not a guaranteed consent exemption — accepted trade-off (no banner).

## Symptom / Motivation The site currently ships a hardcoded Matomo Tag Manager snippet in `templates/_components/core/footer.twig` (lines 35–44) pointing at a **third-party Matomo instance** (`https://krisnetics.biz/matomo/`, container `container_mAz2p4E2.js`) — a leftover from a previous developer. philflow.io is currently sending visitor data to a foreign, unauthorized analytics endpoint, unconditionally and without consent. This is a data-protection / DSGVO problem and must be removed. Phil wants his own analytics instead: self-hosted, cookieless, GDPR-defensible. ## Scope 1. Remove the foreign `krisnetics.biz` Matomo Tag Manager snippet from `footer.twig`. 2. Add a config-driven, cookieless Matomo `_paq` tracking partial (`_system/analytics.twig`), rendered only when `MATOMO_URL` + `MATOMO_SITE_ID` are set (⇒ no tracking locally). 3. Surface config via new `config/custom.php` reading `App::env()`; forward the two env vars into the `php` service in `docker-compose.traefik.yml`. 4. Self-host Matomo as its own container + own MariaDB + Traefik subdomain (`analytics.philflow.io`), image pinned `matomo:5.11-apache`. No host-port mapping. ## Acceptance criteria - No reference to `krisnetics.biz` anywhere in rendered HTML. - Local `docker compose up`: page renders **no** Matomo snippet (env empty). - Prod: `analytics.philflow.io` serves Matomo over HTTPS (LE cert); visiting philflow.io records a hit; **no** `_pk_*` cookies set (cookieless); IP anonymized. - Setup reproducible via compose (bar the one-time Matomo web-installer bootstrap + DNS). ## Note Cookieless-JS in DE (TDDDG) is a risk-reduction, not a guaranteed consent exemption — accepted trade-off (no banner).

Phil referenced this issue from a commit

2026-07-09 17:48:09 +00:00

feat(analytics): cookieless self-hosted Matomo, drop foreign tracking

Phil referenced this issue from a commit

2026-07-09 17:48:09 +00:00

feat(deploy): self-host Matomo container + dedicated DB in traefik stack

Phil referenced this issue from a pull request that will close it,

2026-07-09 17:48:23 +00:00

feat: self-hosted cookieless Matomo, remove foreign tracking #18

Phil closed this issue

2026-07-09 17:49:00 +00:00

Phil referenced this issue from a commit