Repository navigation
Add a dormant Matomo proxy mode, switched by MATOMO_MODE - #27
Open
matthewberry wants to merge 2 commits into
Open
matthewberry wants to merge 2 commits into
matthewberry wants to merge 2 commits into
Conversation
With MATOMO_MODE=proxied, entrypoint.sh writes nginx locations that serve matomo.js at /px/s.js and forward hits from /px/h to matomo.php, and the app initializes the tracker against those paths with cookies disabled. Any other value keeps today's direct tracking. The locations are written only when the flag is on, because nginx won't start if a proxy_pass host doesn't resolve. The tracker is now configured in deferred mode, after envvars.json loads.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of Phase 2 of the Matomo plan (upgrade, cookieless tracking, ad-block recovery). This change is dormant: with the default
matomoMode: direct, tracking behaves as it does today.What
MATOMO_MODE(chartconfig.matomoMode, optional in the Deployment, written toenvvars.json).proxiedturns the proxy on; anything else is direct.src/main.ts).MatomoModule.forRoot({ mode: 'deferred' }), then an app initializer loadsenvvars.jsonand callsinitializeTracker:proxied:disableCookies(), tracker/px/h, script/px/s.js.https://matomo.mmli2.ncsa.illinois.edu/as before.default.confincludes/etc/nginx/matomo-proxy/*.conf.entrypoint.shwriteslocations.confthere only when proxied:/px/s.js→matomo.js/px/h→matomo.php, appendingX-Forwarded-ForCookieandAuthorizationheaders on the way to Matomo, and hide anySet-Cookiecoming backMATOMO_UPSTREAM, defaulthttp://matomo.matomo.svc.cluster.localThe locations aren't in
default.confitself because nginx refuses to start when aproxy_passhost doesn't resolve (local docker, apps not on mmli2). The paths have nomatomo/piwikand no.php, since EasyPrivacy blocks*.php?action_name=.X-Forwarded-Foris appended to, not overwritten: Traefik replaces any client-sent header with the real client IP, and Matomo (on release day,proxy_ips[] = 10.42.0.0/16withproxy_ip_read_last_in_list = 1) reads from the right and skips the pod network. That needsproxy_client_headers[] = HTTP_X_FORWARDED_FORtoo: it's commented out by default, and without it Matomo ignores the header and records the app pod's IP. All three lines are in the plan's release-day step. Using$remote_addrwould record Traefik's IP.Verification
docker buildpasses.ng test: 33/33 pass._pk_id/_pk_sescookies set.host not found in upstream, as expected (this is why the flag gates the file).MATOMO_UPSTREAM=https://matomo.mmli2.ncsa.illinois.edu:nginx -tpasses,/px/s.jsserves the tracker, headless Chrome sends hits to/px/hwith no cookies, and test hits to site 11 (SPICE test) were accepted with noSet-Cookiein the response.Not verified: that Matomo records the real visitor IP through the proxy. That needs the cluster plus the release-day
proxy_ipsconfig. I also didn't check what headers reach Matomo, only the nginx config that strips them.Not in this PR
Syncing to the apps, and the Helm values flip on release day.