From 6c014525bf41f10103e3171ed640b5b532e7cee2 Mon Sep 17 00:00:00 2001 From: Javier Cicchelli Date: Thu, 20 Aug 2026 01:14:49 +0200 Subject: [PATCH] Updated the analytics origin documentation for the Website service target. --- Scripts/bootstrap | 6 +++--- Services/Website/README.md | 2 +- .../Library/Public/Extensions/String+Constants.swift | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Scripts/bootstrap b/Scripts/bootstrap index b6c7b11..e5cfd71 100755 --- a/Scripts/bootstrap +++ b/Scripts/bootstrap @@ -194,9 +194,9 @@ Next steps: - $W/Resources/Static/site.webmanifest (name / short_name) 2. Set a real database password in a git-ignored $W/.env (the committed .env.local defaults the password to the slug — do NOT ship that). - 3. Analytics ships OFF, and stays off until you opt in. To enable it: point - String.Analytics.origin at your own Umami instance (it defaults to the - reserved https://analytics.example.com), allow that origin in + 3. Analytics ships OFF, and stays off until you opt in. To enable it: check + String.Analytics.origin (it defaults to the platform instance at + https://analytics.rock-n-code.com), allow that origin in security.contentSecurityPolicy, then set ANALYTICS_WEBSITE_ID. 4. Point the git remote at your new repository: git remote set-url origin # or 'git remote add origin ...' diff --git a/Services/Website/README.md b/Services/Website/README.md index 5355f6f..ca0d288 100644 --- a/Services/Website/README.md +++ b/Services/Website/README.md @@ -145,7 +145,7 @@ See [Persistence](#persistence-1) below for the workflow. ### Analytics The template ships analytics **off**: `analytics.websiteID` is empty, so both pages embed no tracker at all and no third-party script is requested. Enabling it takes three steps, in this order: -1. Point `String.Analytics.origin` (`Sources/Library/Public/Extensions/String+Constants.swift`) at your own [Umami](https://umami.is) instance. It ships as `https://analytics.example.com`, an [RFC 2606](https://www.rfc-editor.org/rfc/rfc2606) reserved domain, so an unconfigured copy can never report to somebody else's server. +1. Check `String.Analytics.origin` (`Sources/Library/Public/Extensions/String+Constants.swift`). It ships as `https://analytics.rock-n-code.com`, the platform's shared [Umami](https://umami.is) instance; point it elsewhere if this site reports to another one. The origin alone tracks nothing — the tracker is omitted entirely while `analytics.websiteID` is empty. 2. Extend `security.contentSecurityPolicy` to allow that origin in `script-src` and `connect-src` — the default policy is `'self'`-only, so the tracker is blocked until you do. 3. Set `ANALYTICS_WEBSITE_ID` on the deployment. diff --git a/Services/Website/Sources/Library/Public/Extensions/String+Constants.swift b/Services/Website/Sources/Library/Public/Extensions/String+Constants.swift index 3c35954..e95e120 100644 --- a/Services/Website/Sources/Library/Public/Extensions/String+Constants.swift +++ b/Services/Website/Sources/Library/Public/Extensions/String+Constants.swift @@ -1,15 +1,15 @@ extension String { /// A namespace for the analytics default configuration values. /// - /// Analytics ships **off**: ``websiteID`` is empty, so the pages embed no tracker until a deployment sets `analytics.websiteID`. Point - /// ``origin`` at your own instance before enabling it — the placeholder is an [RFC 2606](https://www.rfc-editor.org/rfc/rfc2606) - /// reserved domain, so an unconfigured copy can never report to someone else's server. + /// Analytics ships **off**: ``websiteID`` is empty, so the pages embed no tracker until a deployment sets `analytics.websiteID`. Until + /// then ``origin`` is inert — it names the platform's shared instance, which a site reporting to another one repoints before enabling + /// analytics. public enum Analytics { /// The origin the analytics scripts are loaded from and their beacons are sent to (scheme and host, no trailing slash). /// /// Single-sourced here: both ``scriptURL`` and the session recorder script the pages embed in recorder mode derive from this /// constant. It is deliberately not a configuration key — the `Content-Security-Policy` must allow the same origin, and a value that - /// can drift at runtime would silently break the tracker it is supposed to permit. + /// can drift at runtime would silently break the tracker it is supposed to permit. Defaults to the platform's shared Umami instance. public static let origin = "https://analytics.rock-n-code.com" /// The URL the analytics tracker script is loaded from. public static let scriptURL = "\(origin)/script"