Added user counter and analytics to the kst4contest page

website/ops/analytics/nginx/analytics-filters.conf.example

@@ -0,0 +1,36 @@
+# Only page GET requests which are candidates for the reach statistics enter
+# the dedicated analytics log. GoAccess performs the second bot-classification
+# layer, including unknown browsers and operating systems.
+map $request_method $hamradioonline_analytics_method {
+    default 0;
+    GET 1;
+}
+
+map $uri $hamradioonline_analytics_path {
+    default 1;
+
+    /visitor-count.json 0;
+    /kst4ContestVersionInfo.xml 0;
+    /sitemap.xml 0;
+    /robots.txt 0;
+    /favicon.ico 0;
+    /assets/favicon.svg 0;
+    /health 0;
+    /healthz 0;
+    /ping 0;
+    /status 0;
+
+    ~*^/(?:assets|manual/assets)/ 0;
+    ~*\.(?:css|js|mjs|map|json|png|jpe?g|gif|svg|webp|avif|ico|woff2?|ttf|otf|eot|xml|txt|pdf|zip|gz|wasm|mp4|webm)$ 0;
+}
+
+map $http_user_agent $hamradioonline_analytics_known_bot {
+    default 0;
+    ~*(?:bot|crawler|spider|slurp|headless|monitor|healthcheck|uptime|wget|curl) 1;
+}
+
+map "$hamradioonline_analytics_method:$hamradioonline_analytics_path:$hamradioonline_analytics_known_bot"
+    $hamradioonline_analytics_loggable {
+    default 0;
+    "1:1:0" 1;
+}

website/ops/analytics/nginx/analytics-log.conf.example

@@ -0,0 +1,15 @@
+# Include in the Nginx http context. $uri is the normalized path and excludes
+# the query string. The format intentionally omits referrer and remote user.
+log_format hamradioonline_analytics
+    '$server_name\t$remote_addr\t$time_iso8601\t$request_method\t$uri\t'
+    '$server_protocol\t$status\t$body_bytes_sent\t"$http_user_agent"';
+
+# Include the maps below in the Nginx http context as well.
+include /etc/nginx/snippets/hamradioonline-analytics-filters.conf;
+
+# Add this extra log to each registered project server block. Keep the
+# existing operational access_log directive; do not replace it implicitly.
+#
+# access_log /var/log/nginx/kst4contest-analytics.log
+#     hamradioonline_analytics if=$hamradioonline_analytics_loggable;
+

website/ops/analytics/nginx/public-counter.conf.example

@@ -0,0 +1,9 @@
+# Include inside the kst4contest.hamradioonline.de HTTPS server block. Grant
+# the Nginx worker read access to the file and directory, but no write access.
+location = /visitor-count.json {
+    alias /var/lib/hamradioonline-analytics/public/kst4contest/visitor-count.json;
+    default_type application/json;
+    access_log off;
+    add_header Cache-Control "public, max-age=3600" always;
+    add_header X-Content-Type-Options "nosniff" always;
+}

website/ops/analytics/nginx/stats-vhost-http-bootstrap.conf.example

@@ -0,0 +1,17 @@
+# Temporary HTTP-only virtual host for initial certificate provisioning.
+# Replace it with stats-vhost.conf.example after Certbot has succeeded.
+server {
+    listen 80;
+    server_name stats.hamradioonline.de;
+
+    access_log off;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+
+    location / {
+        return 404;
+    }
+}

website/ops/analytics/nginx/stats-vhost.conf.example

@@ -0,0 +1,57 @@
+# Keep this HTTP server active so Certbot can renew the webroot certificate.
+server {
+    listen 80;
+    server_name stats.hamradioonline.de;
+
+    access_log off;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# This server exposes static reports only. Provision the certificate and the
+# htpasswd file outside the repository. Do not add this host to sites.json.
+server {
+    listen 443 ssl http2;
+    server_name stats.hamradioonline.de;
+
+    ssl_certificate /etc/letsencrypt/live/stats.hamradioonline.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/stats.hamradioonline.de/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    root /var/lib/hamradioonline-analytics/reports;
+    index report.html;
+
+    auth_basic "Private project statistics";
+    auth_basic_user_file /etc/nginx/htpasswd/hamradioonline-analytics;
+
+    access_log off;
+    add_header Cache-Control "private, no-store" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+
+    location = / {
+        try_files /__no_report_at_root__ @combined_reports;
+    }
+
+    location @combined_reports {
+        return 302 /combined/;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+}
+
+# IPv6 is deliberately omitted until the DNS AAAA record has been confirmed.