diff options
| author | Leitwolf | 2026-11-06 09:36:33 +0300 |
|---|---|---|
| committer | GitHub | 2026-11-06 09:36:33 +0300 |
| commit | 9660d2c5f0bda5d666ed076a0e18d5cb2dbe881d (patch) | |
| tree | 52f3eb670a8fb6246de982b219d10a0346526736 /Documents | |
| parent | fc3246f3eb404bc2c3132691d1161a95c5bfac76 (diff) | |
| parent | 7d1ef624fd8842acab54fce6373b4ad2bbb25eb9 (diff) | |
| download | website-9660d2c5f0bda5d666ed076a0e18d5cb2dbe881d.tar.gz | |
Merge pull request #55 from Progmasoft/ops/cloudflare-analytics
Let Cloudflare Web Analytics run on the Tala sites
Diffstat (limited to 'Documents')
| -rw-r--r-- | Documents/ARCHITECTURE.md | 6 | ||||
| -rw-r--r-- | Documents/OPERATIONS.md | 12 |
2 files changed, 12 insertions, 6 deletions
diff --git a/Documents/ARCHITECTURE.md b/Documents/ARCHITECTURE.md index 53a32ac..40d72eb 100644 --- a/Documents/ARCHITECTURE.md +++ b/Documents/ARCHITECTURE.md @@ -105,5 +105,7 @@ allows only its own script, stylesheet and two images. ## Security headers Nginx sends a content security policy that allows only same-origin resources, plus HSTS, `X-Content-Type-Options`, -`X-Frame-Options: DENY` and a referrer policy. The policy has no exception for third-party scripts; a script injected -by an intermediary, such as an analytics beacon added by a CDN, is blocked by the browser. +`X-Frame-Options: DENY` and a referrer policy. The policy of the four hosts of the site has one exception: Cloudflare +Web Analytics, which Cloudflare adds to every page. Its beacon loads from `https://static.cloudflareinsights.com` and +reports to `https://cloudflareinsights.com` and to `/cdn-cgi/rum` on the same host. Any other script injected by an +intermediary is blocked by the browser. The forum placeholder keeps a policy of its own, same-origin only. diff --git a/Documents/OPERATIONS.md b/Documents/OPERATIONS.md index ce1a4ee..cf4db71 100644 --- a/Documents/OPERATIONS.md +++ b/Documents/OPERATIONS.md @@ -250,10 +250,14 @@ static files and 404 for other paths. Expected legacy redirect responses are 308. In maintenance mode the main domain answers 503 with `Retry-After`. A 200 from a retired login or registry route is a regression. -Neither the static site nor the forum placeholder should send personal data -to a third-party analytics service. The content security policy allows -same-origin scripts only, so a script added by an intermediary is blocked by -the browser rather than run. Theme and language preferences are kept +The static site uses Cloudflare Web Analytics, which counts page views without +cookies and without a fingerprint of the visitor. Its content security policy +allows same-origin scripts and that beacon only: the beacon loads from +`https://static.cloudflareinsights.com` and reports to +`https://cloudflareinsights.com` and `/cdn-cgi/rum`. Any other script added by +an intermediary is blocked by the browser rather than run. The forum +placeholder allows same-origin scripts only and sends nothing to an analytics +service. Theme and language preferences are kept locally in the browser. Nginx and API logs still need normal retention and access-control practices, but this repository does not define an account database or a user profile store. |