rock-n-code/ccn
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Activity

Updated the analytics origin documentation for the Website service target.

Browse Source
This commit is contained in:
javier
2026-08-20 01:15:26 +02:00
parent 13093705a3
commit 08b4d80064
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Services/Website/README.md
+1 -1
View File
@@ -145,7 +145,7 @@ See [Persistence](#persistence-1) below for the workflow.
### Analytics
The template ships analytics **off**: `analytics.websiteID` is empty, so both pages embed no tracker at all and no third-party script is requested. Enabling it takes three steps, in this order:
1. Point `String.Analytics.origin` (`Sources/Library/Public/Extensions/String+Constants.swift`) at your own [Umami](https://umami.is) instance. It ships as `https://analytics.example.com`, an [RFC 2606](https://www.rfc-editor.org/rfc/rfc2606) reserved domain, so an unconfigured copy can never report to somebody else's server.
1. Check `String.Analytics.origin` (`Sources/Library/Public/Extensions/String+Constants.swift`). It ships as `https://analytics.rock-n-code.com`, the platform's shared [Umami](https://umami.is) instance; point it elsewhere if this site reports to another one. The origin alone tracks nothing — the tracker is omitted entirely while `analytics.websiteID` is empty.
2. Extend `security.contentSecurityPolicy` to allow that origin in `script-src` and `connect-src` — the default policy is `'self'`-only, so the tracker is blocked until you do.
3. Set `ANALYTICS_WEBSITE_ID` on the deployment.
Services/Website/Sources/Library/Public/Extensions/String+Constants.swift
+4 -4
View File
@@ -1,15 +1,15 @@
extension String {
/// A namespace for the analytics default configuration values.
///
/// Analytics ships **off**: ``websiteID`` is empty, so the pages embed no tracker until a deployment sets `analytics.websiteID`. Point
/// ``origin`` at your own instance before enabling it — the placeholder is an [RFC 2606](https://www.rfc-editor.org/rfc/rfc2606)
/// reserved domain, so an unconfigured copy can never report to someone else's server.
/// Analytics ships **off**: ``websiteID`` is empty, so the pages embed no tracker until a deployment sets `analytics.websiteID`. Until
/// then ``origin`` is inert — it names the platform's shared instance, which a site reporting to another one repoints before enabling
/// analytics.
public enum Analytics {
/// The origin the analytics scripts are loaded from and their beacons are sent to (scheme and host, no trailing slash).
///
/// Single-sourced here: both ``scriptURL`` and the session recorder script the pages embed in recorder mode derive from this
/// constant. It is deliberately not a configuration key — the `Content-Security-Policy` must allow the same origin, and a value that
/// can drift at runtime would silently break the tracker it is supposed to permit.
/// can drift at runtime would silently break the tracker it is supposed to permit. Defaults to the platform's shared Umami instance.
public static let origin = "https://analytics.rock-n-code.com"
/// The URL the analytics tracker script is loaded from.
public static let scriptURL = "\(origin)/script"