Matomo¶
Web analytics for public sites.
| Runtime | Container (Docker Swarm), 2 containers: app, db |
| Tier | Apps (Important) |
| Node | swarm-core |
| Image | matomo:5.12.0-apache; mariadb:11.4 |
| URL | https://matomo.lab.riversfamily.uk |
| Auth | Native OIDC for admin login only; tracking endpoints stay public |
| Source | ansible/stacks/apps/matomo/ |
Configuration¶
Deliberately not behind forward-auth. The tracking endpoints
(/matomo.php, /matomo.js) must stay reachable by anonymous visitors of
instrumented sites; a forward-auth gate on the whole domain would block
them. Admin login instead uses Matomo's LoginOIDC plugin, configured
manually, post-deploy, through the Matomo admin UI (endpoint and
client id/secret) — there is no compose-level env var or config file for
this plugin's OIDC settings.
Mail and reverse-proxy settings that have no env var surface are rendered
into a mounted common.config.ini.php
(/var/www/html/config/common.config.ini.php): assume_secure_protocol=1,
force_ssl=1, proxy_client_headers[]=HTTP_X_FORWARDED_FOR,
proxy_host_headers[]=HTTP_X_FORWARDED_HOST.
Volumes¶
| Volume | Path | Backing | Contents |
|---|---|---|---|
matomo |
/var/www/html |
Local | Matomo application state |
database |
/var/lib/mysql |
Local | MariaDB data — never NFS |
| (rendered) | /var/www/html/config/common.config.ini.php |
Read-only | Mail and proxy-header config |
Networking¶
app joins both the shared traefik network (for its Traefik route) and
this stack's private internal network. db joins internal only — it is
unreachable from every other stack.
Secrets¶
| Vault variable | Delivered as | Purpose |
|---|---|---|
vault_matomo_db_password |
Swarm secret on db (MARIADB_PASSWORD_FILE); app reads the same value inline |
MariaDB password |
vault_matomo_oidc_client_secret |
Not present in the compose file at all | Configured entirely post-deploy via the LoginOIDC plugin UI |
Gotchas¶
- Post-deploy manual step required: install the LoginOIDC plugin and configure its endpoint/client id/secret through the Matomo admin UI. This is not automated by Ansible.
- The public-tracking-endpoint requirement is why Matomo is the one native- OIDC service that still can't use a blanket forward-auth middleware even as a fallback — the admin UI and the tracking endpoints share the same domain and must be split by path, not by a router-level gate.