Adds plausible.

2026-07-10 03:35:41 +00:00
parent 4d983819c9
commit c80d8dc411
15 changed files with 575 additions and 0 deletions
--- a/plausible/versions/3/README.md
+++ b/plausible/versions/3/README.md
@@ -0,0 +1,49 @@
+# Plausible Analytics
+
+Plausible is a lightweight, privacy-friendly web analytics tool. It gives you a clear picture of how people find and use your websites — without tracking personal data, setting cookies, or requiring cookie consent banners. All data is stored on your own infrastructure.
+
+It's a straightforward alternative to Google Analytics for organizations that care about visitor privacy and data sovereignty.
+
+## Dependencies
+
+- **PostgreSQL** - Database for storing sites, users, and configuration
+- **ClickHouse** - Bundled analytics event database (deployed automatically within the Plausible namespace)
+
+## Configuration
+
+Key settings configured through your instance's `config.yaml`:
+
+- **domain** - Where Plausible will be accessible (default: `plausible.{your-cloud-domain}`)
+- **plausibleStorage** - Persistent volume for Plausible app data (default: `1Gi`)
+- **clickhouseStorage** - Persistent volume for analytics event data (default: `10Gi`). Increase this if you expect high traffic volumes.
+- **disableRegistration** - Controls who can create accounts: `"false"` (open), `"invite_only"`, or `"true"` (default: `"false"`)
+
+## Access
+
+After deployment, Plausible will be available at:
+- `https://plausible.{your-cloud-domain}` — Dashboard and admin
+
+## First-Time Setup
+
+1. Add and deploy the app:
+   ```bash
+   wild app add plausible
+   wild app deploy plausible
+   ```
+
+2. Open `https://plausible.{your-cloud-domain}` and register an account. The first registered user becomes the admin.
+
+3. Once your account is created, set `disableRegistration: "invite_only"` in your `config.yaml` to prevent open registration, then redeploy:
+   ```bash
+   wild app deploy plausible
+   ```
+
+4. Add a website in the Plausible dashboard and copy the tracking snippet into your site's `<head>`:
+   ```html
+   <script defer data-domain="yourdomain.com"
+     src="https://plausible.{your-cloud-domain}/js/script.js"></script>
+   ```
+
+## Inviting Users
+
+With registration set to `invite_only`, you can invite teammates from **Settings → Users** in the Plausible dashboard.
--- a/plausible/versions/3/configmap-clickhouse.yaml
+++ b/plausible/versions/3/configmap-clickhouse.yaml
@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: clickhouse-config
+  labels:
+    component: clickhouse
+data:
+  logs.xml: |
+    <clickhouse>
+        <logger>
+            <level>warning</level>
+            <console>true</console>
+        </logger>
+
+        <query_log replace="1">
+            <database>system</database>
+            <table>query_log</table>
+            <flush_interval_milliseconds>7500</flush_interval_milliseconds>
+            <engine>
+                ENGINE = MergeTree
+                PARTITION BY event_date
+                ORDER BY (event_time)
+                TTL event_date + interval 30 day
+                SETTINGS ttl_only_drop_parts=1
+            </engine>
+        </query_log>
+
+        <!-- Stops unnecessary logging -->
+        <metric_log remove="remove" />
+        <asynchronous_metric_log remove="remove" />
+        <query_thread_log remove="remove" />
+        <text_log remove="remove" />
+        <trace_log remove="remove" />
+        <session_log remove="remove" />
+        <part_log remove="remove" />
+    </clickhouse>
+  ipv4-only.xml: |
+    <clickhouse>
+        <listen_host>0.0.0.0</listen_host>
+    </clickhouse>
+  low-resources.xml: |
+    <clickhouse>
+        <!-- https://clickhouse.com/docs/en/operations/server-configuration-parameters/settings#mark_cache_size -->
+        <mark_cache_size>524288000</mark_cache_size>
+    </clickhouse>
+  default-profile-low-resources-overrides.xml: |
+    <!-- https://clickhouse.com/docs/en/operations/tips#using-less-than-16gb-of-ram -->
+    <clickhouse>
+        <profiles>
+            <default>
+                <max_threads>1</max_threads>
+                <max_block_size>8192</max_block_size>
+                <max_download_threads>1</max_download_threads>
+                <input_format_parallel_parsing>0</input_format_parallel_parsing>
+                <output_format_parallel_formatting>0</output_format_parallel_formatting>
+            </default>
+        </profiles>
+    </clickhouse>
--- a/plausible/versions/3/db-init-job.yaml
+++ b/plausible/versions/3/db-init-job.yaml
@@ -0,0 +1,66 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: plausible-db-init
+  labels:
+    component: db-init
+spec:
+  template:
+    metadata:
+      labels:
+        component: db-init
+    spec:
+      restartPolicy: OnFailure
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        runAsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: postgres-init
+        image: postgres:16
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false
+        env:
+        - name: PGHOST
+          value: {{ .db.host }}
+        - name: PGUSER
+          value: postgres
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: plausible-secrets
+              key: postgres.password
+        - name: DB_NAME
+          value: {{ .db.name }}
+        - name: DB_USER
+          value: {{ .db.user }}
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: plausible-secrets
+              key: dbPassword
+        command:
+        - /bin/bash
+        - -c
+        - |
+          set -e
+          echo "Waiting for PostgreSQL to be ready..."
+          until pg_isready; do
+            echo "PostgreSQL is not ready - sleeping"
+            sleep 2
+          done
+          echo "PostgreSQL is ready"
+
+          echo "Creating database and user for Plausible..."
+          psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';" || echo "User ${DB_USER} already exists"
+          psql -c "ALTER USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
+          psql -c "CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};" || echo "Database ${DB_NAME} already exists"
+          psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
+          psql -d ${DB_NAME} -c "GRANT ALL ON SCHEMA public TO ${DB_USER};"
+          echo "Database initialization complete"
--- a/plausible/versions/3/deployment-clickhouse.yaml
+++ b/plausible/versions/3/deployment-clickhouse.yaml
@@ -0,0 +1,91 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: clickhouse
+  labels:
+    component: clickhouse
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: clickhouse
+  template:
+    metadata:
+      labels:
+        component: clickhouse
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: clickhouse
+        image: clickhouse/clickhouse-server:24.12-alpine
+        ports:
+        - name: http
+          containerPort: 8123
+          protocol: TCP
+        - name: native
+          containerPort: 9000
+          protocol: TCP
+        env:
+        - name: CLICKHOUSE_SKIP_USER_SETUP
+          value: "1"
+        volumeMounts:
+        - name: clickhouse-data
+          mountPath: /var/lib/clickhouse
+        - name: clickhouse-config
+          mountPath: /etc/clickhouse-server/config.d/logs.xml
+          subPath: logs.xml
+          readOnly: true
+        - name: clickhouse-config
+          mountPath: /etc/clickhouse-server/config.d/ipv4-only.xml
+          subPath: ipv4-only.xml
+          readOnly: true
+        - name: clickhouse-config
+          mountPath: /etc/clickhouse-server/config.d/low-resources.xml
+          subPath: low-resources.xml
+          readOnly: true
+        - name: clickhouse-users-config
+          mountPath: /etc/clickhouse-server/users.d/default-profile-low-resources-overrides.xml
+          subPath: default-profile-low-resources-overrides.xml
+          readOnly: true
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 8123
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: 8123
+          initialDelaySeconds: 30
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        resources:
+          limits:
+            cpu: "2"
+            memory: 2Gi
+            ephemeral-storage: 1Gi
+          requests:
+            cpu: 100m
+            memory: 512Mi
+            ephemeral-storage: 50Mi
+        securityContext:
+          readOnlyRootFilesystem: false
+      volumes:
+      - name: clickhouse-data
+        persistentVolumeClaim:
+          claimName: clickhouse-data
+      - name: clickhouse-config
+        configMap:
+          name: clickhouse-config
+      - name: clickhouse-users-config
+        configMap:
+          name: clickhouse-config
+      restartPolicy: Always
--- a/plausible/versions/3/deployment.yaml
+++ b/plausible/versions/3/deployment.yaml
@@ -0,0 +1,121 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plausible
+  labels:
+    component: web
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+      - name: init-dirs
+        image: busybox:1.37
+        command:
+        - /bin/sh
+        - -c
+        - |
+          mkdir -p /data/tmp /data/tzdata_data/release_ets
+          chmod -R 777 /data/tmp /data/tzdata_data
+        securityContext:
+          runAsUser: 0
+        volumeMounts:
+        - name: plausible-data
+          mountPath: /data
+      - name: wait-for-clickhouse
+        image: busybox:1.37
+        command:
+        - /bin/sh
+        - -c
+        - |
+          until wget --no-verbose --tries=1 -O - http://{{ .clickhouse.host }}:{{ .clickhouse.port }}/ping; do
+            echo "Waiting for ClickHouse..."
+            sleep 3
+          done
+        securityContext:
+          runAsUser: 65534
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+      containers:
+      - name: plausible
+        image: ghcr.io/plausible/community-edition:v3.2.1
+        command:
+        - sh
+        - -c
+        - /entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run
+        ports:
+        - name: http
+          containerPort: 8000
+          protocol: TCP
+        env:
+        - name: BASE_URL
+          value: https://{{ .domain }}
+        - name: TMPDIR
+          value: /var/lib/plausible/tmp
+        - name: DISABLE_REGISTRATION
+          value: "{{ .disableRegistration }}"
+        - name: SECRET_KEY_BASE
+          valueFrom:
+            secretKeyRef:
+              name: plausible-secrets
+              key: secretKeyBase
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: plausible-secrets
+              key: dbUrl
+        - name: CLICKHOUSE_DATABASE_URL
+          value: http://{{ .clickhouse.host }}:{{ .clickhouse.port }}/{{ .clickhouse.db }}
+        volumeMounts:
+        - name: plausible-data
+          mountPath: /var/lib/plausible
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8000
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 8000
+          initialDelaySeconds: 60
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        resources:
+          limits:
+            cpu: "1"
+            memory: 1Gi
+            ephemeral-storage: 1Gi
+          requests:
+            cpu: 100m
+            memory: 256Mi
+            ephemeral-storage: 50Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false
+      volumes:
+      - name: plausible-data
+        persistentVolumeClaim:
+          claimName: plausible-data
+      restartPolicy: Always
--- a/plausible/versions/3/ingress.yaml
+++ b/plausible/versions/3/ingress.yaml
@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: plausible
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: plausible-private-network-access@kubernetescrd
+    external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    external-dns.alpha.kubernetes.io/ttl: "60"
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - {{ .domain }}
+    secretName: {{ .tlsSecretName }}
+  rules:
+  - host: {{ .domain }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: plausible
+            port:
+              number: 80
--- a/plausible/versions/3/kustomization.yaml
+++ b/plausible/versions/3/kustomization.yaml
@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: plausible
+labels:
+  - includeSelectors: true
+    pairs:
+      app: plausible
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - db-init-job.yaml
+  - configmap-clickhouse.yaml
+  - pvc.yaml
+  - deployment-clickhouse.yaml
+  - service-clickhouse.yaml
+  - deployment.yaml
+  - service.yaml
+  - middleware.yaml
+  - ingress.yaml
--- a/plausible/versions/3/manifest.yaml
+++ b/plausible/versions/3/manifest.yaml
@@ -0,0 +1,33 @@
+version: v3.2.1-1
+requires:
+  - name: postgres
+defaultConfig:
+  namespace: plausible
+  externalDnsDomain: '{{ .cloud.domain }}'
+  domain: plausible.{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
+  plausibleStorage: 1Gi
+  clickhouseStorage: 10Gi
+  db:
+    host: '{{ .apps.postgres.host }}'
+    port: '{{ .apps.postgres.port }}'
+    name: plausible
+    user: plausible
+  clickhouse:
+    host: clickhouse
+    port: "8123"
+    db: plausible_events_db
+  disableRegistration: "false"
+  central:
+    headers:
+      response:
+        Access-Control-Allow-Private-Network: 'true'
+defaultSecrets:
+  - key: dbPassword
+  - key: secretKeySeed
+  - key: secretKeyBase
+    default: '{{ crypto.SHA256 .secrets.secretKeySeed }}'
+  - key: dbUrl
+    default: 'postgresql://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?sslmode=disable'
+requiredSecrets:
+  - postgres.password
--- a/plausible/versions/3/middleware.yaml
+++ b/plausible/versions/3/middleware.yaml
@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: private-network-access
+spec:
+  headers:
+    customResponseHeaders:
+      Access-Control-Allow-Private-Network: "true"
--- a/plausible/versions/3/namespace.yaml
+++ b/plausible/versions/3/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: "{{ .namespace }}"
--- a/plausible/versions/3/pvc.yaml
+++ b/plausible/versions/3/pvc.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: plausible-data
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .plausibleStorage }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: clickhouse-data
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .clickhouseStorage }}
--- a/plausible/versions/3/service-clickhouse.yaml
+++ b/plausible/versions/3/service-clickhouse.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: clickhouse
+  labels:
+    component: clickhouse
+spec:
+  type: ClusterIP
+  ports:
+  - port: 8123
+    targetPort: http
+    protocol: TCP
+    name: http
+  - port: 9000
+    targetPort: native
+    protocol: TCP
+    name: native
+  selector:
+    component: clickhouse
--- a/plausible/versions/3/service.yaml
+++ b/plausible/versions/3/service.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: plausible
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    component: web