Privacy-First Self-Hosted Analytics

The challenge

Third-party analytics scripts slow pages down, follow visitors across the web, and hand your traffic data to someone else. Many teams want to understand their audience without any of that — and without a database to babysit.

Our approach

We build the dashboard from data you already have: the web server’s own access logs. A rotation-aware ingestion script reads current and archived logs, a scheduled cron job refreshes the report, and the resulting dashboard is served as static files behind HTTP Basic Auth with its own scoped Content-Security-Policy.

Because everything is derived from logs on your server, there is no client-side tracker, no cookie sent to an ad network, and nothing to leak. We host a live demonstration of the dashboard on this very site.

What we deliver

Log ingestion that survives log rotation (current + gzipped archives).
A scheduled refresh via cron so the dashboard stays current with no manual steps.
Access control with HTTP Basic Auth and a dashboard-specific CSP.
Zero third-party JavaScript trackers and no external data sharing.

Example configuration

A small ingestion script folds rotated logs together and regenerates the report; cron keeps it fresh; Apache gates access.

ingest-logs.shbash

#!/usr/bin/env bash
set -euo pipefail
LOG_DIR=/var/log/apache2
OUT=/var/www/analytics/index.html

# Concatenate current + rotated (gzip-aware) access logs, then summarise.
{ zcat -f "${LOG_DIR}"/access.log*.gz 2>/dev/null || true; cat "${LOG_DIR}"/access.log; } \
  | ./summarise.py > "${OUT}.tmp"

mv "${OUT}.tmp" "${OUT}"   # atomic swap — never serve a half-written report

crontab + Apache authbash

# Refresh every 15 minutes
*/15 * * * *  /opt/analytics/ingest-logs.sh

# /etc/apache2 — gate the dashboard behind Basic Auth
<Location /analytics>
    AuthType Basic
    AuthName "Analytics"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Location>

Outcome

Actionable traffic insight that respects your visitors and keeps ownership of the data on your infrastructure — a privacy-friendly alternative to hosted analytics SaaS.