analytics

Signed-off-by: Melvin Strobl <lc3267@kit.edu>

Makefile

@@ -4,7 +4,7 @@
 
 .PHONY: dev-utils dev dev-local up down update install dev-backend dev-frontend \
         generate-client seed-example test test-backend test-frontend soak lint lint-backend \
-        lint-frontend clean help
+        lint-frontend umami clean help
 
 COMPOSE_ROOT := $(CURDIR)
 # Explicit project name keeps this stack isolated from the sibling website
@@ -39,6 +39,32 @@ dev-local:  ## Start the integrated local stack (called by the root `make dev`)
 up:  ## Start the production stack
 	$(COMPOSE_PROD_RUN) up --build -d
 
+umami:  ## Provision + start the optional Umami site-analytics service (idempotent)
+	# Guard: the dashboard is internet-facing on analytics.$(DOMAIN); refuse to
+	# start when its session-signing secret is unset or still the placeholder.
+	@secret=$$(grep -E '^UMAMI_APP_SECRET=' $(COMPOSE_ROOT)/.env 2>/dev/null | head -1 | cut -d= -f2-); \
+	if [ -z "$$secret" ] || [ "$$secret" = "changethis" ]; then \
+		echo "ERROR: UMAMI_APP_SECRET is empty or 'changethis' in .env — run the workspace root's scripts/setup.sh (or set it: openssl rand -hex 32) before 'make umami'." >&2; \
+		exit 1; \
+	fi
+	# --no-recreate: reuse an already-running db instead of recreating it under
+	# the prod compose set, which would blip every service that depends on it.
+	$(COMPOSE_PROD) up -d --wait --no-recreate db
+	# Least-privilege role owning only the umami database, so the third-party
+	# image never holds the shared superuser credentials.
+	@pguser=$$(grep -E '^POSTGRES_USER=' $(COMPOSE_ROOT)/.env 2>/dev/null | head -1 | cut -d= -f2-); pguser=$${pguser:-postgres}; \
+	role=$$(grep -E '^UMAMI_DB_USER=' $(COMPOSE_ROOT)/.env 2>/dev/null | head -1 | cut -d= -f2-); role=$${role:-umami}; \
+	pw=$$(grep -E '^UMAMI_DB_PASSWORD=' $(COMPOSE_ROOT)/.env 2>/dev/null | head -1 | cut -d= -f2-); \
+	db=$$(grep -E '^UMAMI_DB=' $(COMPOSE_ROOT)/.env 2>/dev/null | head -1 | cut -d= -f2-); db=$${db:-umami}; \
+	if [ -z "$$pw" ] || [ "$$pw" = "changethis" ]; then \
+		echo "ERROR: UMAMI_DB_PASSWORD is empty or 'changethis' in .env — run the workspace root's scripts/setup.sh before 'make umami'." >&2; \
+		exit 1; \
+	fi; \
+	$(COMPOSE_PROD) exec -T db psql -v ON_ERROR_STOP=1 -U "$$pguser" -d postgres \
+		-v role="$$role" -v pw="$$pw" -v db="$$db" < docker/provision-umami-db.sql
+	# --no-deps: only (re)create umami, never restart the shared db underneath it.
+	$(COMPOSE_PROD) --profile analytics up -d --no-deps umami
+
 update:  ## Pull, rebuild using the layer cache, and recreate changed containers
 	git pull
 	$(COMPOSE_PROD_RUN) build