Private Analytics With Umami, Docker Compose, and Ansible

		
services:
  db:
    image: {{ umami_postgres_image }}
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      TZ: ${TZ}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - umami-db-data:/var/lib/postgresql/data
    networks:
      - umami-net
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
 
  umami:
    image: {{ umami_image }}
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "{{ umami_bind_address }}:${UMAMI_PORT:-{{ umami_listen_port }}}:3000"
    environment:
      DATABASE_TYPE: postgresql
      DATABASE_URL: ${DATABASE_URL}
      APP_SECRET: ${APP_SECRET}
      HOSTNAME: "0.0.0.0"
      PORT: "3000"
      TZ: ${TZ}
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/api/heartbeat || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - umami-net
	

Expand

		
---
umami_timezone: Europe/London
 
# Config storage (remote)
umami_base_dir: "/opt/umami"
 
# Secrets storage (local controller)
umami_secrets_dir: "{{ playbook_dir }}/.secrets/{{ inventory_hostname }}"
 
# Container images
umami_image: ghcr.io/umami-software/umami:postgresql-latest
umami_postgres_image: postgres:18-alpine
 
# Networking
umami_listen_port: 3000
umami_bind_address: 127.0.0.1
 
# Database
umami_db_name: umami
umami_db_user: umami
umami_db_password: ""
umami_app_secret: ""
 
# Compose options
umami_compose_project_name: umami
umami_compose_pull: always
umami_compose_recreate: auto
	

Expand

		
---
- name: Ensure base directory exists (remote)
  become: true
  ansible.builtin.file:
    path: "{{ umami_base_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
 
# --- Local secrets handling ---
- name: Ensure local secrets dir exists (controller)
  ansible.builtin.file:
    path: "{{ umami_secrets_dir }}"
    state: directory
    mode: "0700"
  delegate_to: localhost
  run_once: false
 
- name: Generate DB password if needed (local)
  ansible.builtin.set_fact:
    umami_db_password: >-
      {{ lookup('ansible.builtin.password',
                umami_secrets_dir ~ '/.db_password chars=ascii_letters,digits length=32') }}
  when: (umami_db_password | default('') | length) == 0
  delegate_to: localhost
  run_once: false
 
- name: Generate app secret if needed (local)
  ansible.builtin.set_fact:
    umami_app_secret: >-
      {{ lookup('ansible.builtin.password',
                umami_secrets_dir ~ '/.app_secret chars=hexdigits length=64') }}
  when: (umami_app_secret | default('') | length) == 0
  delegate_to: localhost
  run_once: false
 
# --- Remote config + deployment ---
- name: Render .env file
  become: true
  ansible.builtin.template:
    src: env.j2
    dest: "{{ umami_base_dir }}/.env"
    owner: root
    group: root
    mode: "0640"
  notify: Restart umami stack
 
- name: Render docker-compose.yml
  become: true
  ansible.builtin.template:
    src: docker-compose.yml.j2
    dest: "{{ umami_base_dir }}/docker-compose.yml"
    owner: root
    group: root
    mode: "0644"
  notify: Restart umami stack
 
- name: Ensure Umami stack is running
  become: true
  community.docker.docker_compose_v2:
    project_src: "{{ umami_base_dir }}"
    project_name: "{{ umami_compose_project_name }}"
    state: present
    pull: "{{ umami_compose_pull }}"
    recreate: "{{ umami_compose_recreate }}"
  register: umami_compose_result
 
- name: Display docker compose changes
  ansible.builtin.debug:
    var: umami_compose_result
  when: umami_compose_result is defined
	

Expand

		
# === Nginx/analytics access control ===
#
# CIDR/IPs allowed to reach the Umami dashboard via umami_nginx
nginx_dashboard_allowlist:
  - "127.0.0.1/32"
 
# === Domains ===
#
# Used by certbot role when requesting site certificates
primary_domain: "example.com"
# Shared by certbot + umami_nginx site template for analytics host
analytics_domain: "analytics.example.com"
 
# === Certbot ===
#
# Toggle ACME issuance in certbot role
certbot_issue_certificates: false
# Ensures packaged systemd timer stays enabled
certbot_auto_renew: true
# Certbot registration email for expiry notices and ToS
certbot_admin_email: "[email protected]"
# Domains to request via Certbot (include each site explicitly and point DNS to this host)
certbot_domains:
  - "example.com"
	

Expand

		
---
- name: Deploy tailscale serve systemd unit
  become: true
  ansible.builtin.template:
    src: tailscale-serve.service.j2
    dest: "/etc/systemd/system/{{ tailscale_serve_service_name }}.service"
    owner: root
    group: root
    mode: '0644'
  notify:
    - Restart tailscale serve
 
- name: Ensure tailscale serve service is enabled and {{ tailscale_serve_state }}
  become: true
  ansible.builtin.systemd:
    name: "{{ tailscale_serve_service_name }}"
    enabled: "{{ tailscale_serve_enabled }}"
    state: "{{ tailscale_serve_state }}"
    daemon_reload: true
	

Expand

		
# 1) HTTP → HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name {{ analytics_domain }};
    return 301 https://$host$request_uri;
}
 
# 2) HTTPS site
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name {{ analytics_domain }};
 
    # Logs
    access_log /var/log/nginx/{{ umami_nginx_site_name }}.access.log;
    error_log /var/log/nginx/{{ umami_nginx_site_name }}.error.log;
 
    # TLS certs
    ssl_certificate     /etc/letsencrypt/live/{{ analytics_domain }}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/{{ analytics_domain }}/privkey.pem;
 
 
    location = /script.js {
        proxy_pass http://{{ umami_nginx_upstream_host }}:{{ umami_nginx_upstream_port }};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
 
    location = /api/send {
        proxy_pass http://{{ umami_nginx_upstream_host }}:{{ umami_nginx_upstream_port }};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
 
        limit_except POST OPTIONS { deny all; }
 
        proxy_hide_header Access-Control-Allow-Origin;
        proxy_hide_header Access-Control-Allow-Methods;
        proxy_hide_header Access-Control-Allow-Headers;
        proxy_hide_header Access-Control-Max-Age;
 
        add_header Access-Control-Allow-Origin "$http_origin" always;
        add_header Access-Control-Allow-Methods "POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        add_header Access-Control-Max-Age 86400 always;
        add_header Vary "Origin" always;
 
        if ($request_method = OPTIONS) {
            return 204;
        }
    }
 
    location / {
        {% for cidr in nginx_dashboard_allowlist %}
        allow {{ cidr }};
        {% endfor %}
        deny all;
        proxy_pass http://{{ umami_nginx_upstream_host }}:{{ umami_nginx_upstream_port }};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
	

Expand