Google analytics integration.

Sentry.io integration.
Vince integration.
Region-scoped consent (denied-by-default in EU/EEA/UK/CH, granted elsewhere, DPDP-friendly notice)

ansible/files/Caddyfile.j2

@@ -8,6 +8,13 @@
 		reverse_proxy {{ docker_container }}:{{ cms_port }}
 	}
 
+	# First-party analytics (Vince) — script (/stats/js/script.js) and event
+	# endpoint (/stats/api/event) proxied same-origin so they survive ad
+	# blockers and never touch a third-party domain.
+	handle /stats/* {
+		reverse_proxy {{ vince_container }}:{{ vince_port }}
+	}
+
 	# TanStack Start frontend
 	handle {
 		reverse_proxy {{ docker_container }}:{{ www_port }}

ansible/playbook.yml

@@ -10,5 +10,6 @@
   roles:
     - upload
     - network
+    - analytics
     - mozimo
     - caddy

ansible/roles/analytics/defaults/main.yaml

@@ -0,0 +1,4 @@
+---
+# vince_container / vince_port live in ansible/vars/default.yml (the Caddy
+# template needs them at play level).
+vince_image: vinceanalytics/vince:latest

ansible/roles/analytics/tasks/main.yaml

@@ -0,0 +1,28 @@
+---
+# Self-hosted first-party analytics (Vince — Plausible-protocol, single
+# binary). Only reachable on the docker network: Caddy proxies /stats/*
+# on the www host to this container, so browser requests stay first-party.
+- name: Pull Vince image
+  docker_image:
+    name: "{{ vince_image }}"
+    source: pull
+    state: present
+    force_source: "{{ vince_image_force_update | default(false) }}"
+
+- name: Ensure Vince data directory exists
+  file:
+    path: "{{ host_directory }}/vince_data"
+    state: directory
+    owner: "1000"
+    group: "1000"
+
+- name: Create Vince container
+  docker_container:
+    name: "{{ vince_container }}"
+    image: "{{ vince_image }}"
+    state: started
+    restart_policy: "unless-stopped"
+    volumes:
+      - "{{ host_directory }}/vince_data:/data"
+    networks:
+      - name: "{{ docker_network }}"

ansible/vars/default.yml

@@ -20,6 +20,10 @@ docker_network: "{{ title }}_net"
 docker_image: "{{ registry }}/{{ title }}:{{ image_tag | default(tag) }}"
 docker_container: "{{ title }}-staging"
 
+# self-hosted first-party analytics (Vince) — proxied at /stats/* on www host
+vince_container: vince
+vince_port: 8000
+
 # caddy publishes www (SSR + /api/* + /_/* -> pocketbase) and cms (admin)
 
 caddy_container: caddy