Add Umami service and database configuration to Docker Compose; update environment variables in .env.example

.env.example

@@ -24,6 +24,8 @@ UMAMI_DB_PASS=your_strong_database_password
 UMAMI_DB_NAME=umami
 # Random 64-character secret for Umami app security
 UMAMI_APP_SECRET=your_64_character_random_secret_here
+# Website ID from Umami dashboard (use placeholder initially, update after setup)
+UMAMI_WEBSITE_ID=placeholder-website-id
 
 ## Grafana
 # Admin username for Grafana dashboard

docker-compose.yml

@@ -10,6 +10,7 @@ volumes:
   traefik_logs:
   portainer_data:
   uptime_kuma_data:
+  umami_data:
 
 ########################
 # Services
@@ -30,6 +31,10 @@ services:
     environment:
       TZ: "${TZ}"
     command:
+      # Experimental plugins
+      - --experimental.plugins.traefik-umami-plugin.modulename=github.com/1cedsoda/traefik-umami-plugin
+      - --experimental.plugins.traefik-umami-plugin.version=v1.0.3
+
       # Providers
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
@@ -81,6 +86,17 @@ services:
       # Basic Auth middleware
       - traefik.http.middlewares.basic-auth.basicauth.users=${BASIC_AUTH_USERS}
 
+      # Umami Analytics middleware
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.umamiHost=umami:3000
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.websiteId=${UMAMI_WEBSITE_ID}
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.forwardPath=umami
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.scriptInjection=true
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.scriptInjectionMode=tag
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.autoTrack=true
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.doNotTrack=false
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.cache=false
+      - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.serverSideTracking=false
+
       # Traefik dashboard (protected)
       - traefik.http.routers.traefik.rule=Host(`traefik.gate.${DOMAIN}`)
       - traefik.http.routers.traefik.entrypoints=websecure
@@ -124,3 +140,40 @@ services:
       - traefik.http.routers.kuma.tls.certresolver=le
       - traefik.http.routers.kuma.middlewares=basic-auth,security-headers
       - traefik.http.services.kuma.loadbalancer.server.port=3001
+
+  ## ─────────────────────────────────────────────
+  ## Umami — web analytics
+  ## ─────────────────────────────────────────────
+  umami:
+    image: ghcr.io/umami-software/umami:postgresql-latest
+    container_name: umami
+    restart: unless-stopped
+    networks: [traefik_proxy]
+    environment:
+      DATABASE_URL: postgresql://${UMAMI_DB_USER}:${UMAMI_DB_PASS}@umami-db:5432/${UMAMI_DB_NAME}
+      DATABASE_TYPE: postgresql
+      APP_SECRET: ${UMAMI_APP_SECRET}
+    depends_on:
+      - umami-db
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.umami.rule=Host(`umami.gate.${DOMAIN}`)
+      - traefik.http.routers.umami.entrypoints=websecure
+      - traefik.http.routers.umami.tls.certresolver=le
+      - traefik.http.routers.umami.middlewares=security-headers
+      - traefik.http.services.umami.loadbalancer.server.port=3000
+
+  ## ─────────────────────────────────────────────
+  ## Umami Database — PostgreSQL
+  ## ─────────────────────────────────────────────
+  umami-db:
+    image: postgres:15-alpine
+    container_name: umami-db
+    restart: unless-stopped
+    networks: [traefik_proxy]
+    environment:
+      POSTGRES_DB: ${UMAMI_DB_NAME}
+      POSTGRES_USER: ${UMAMI_DB_USER}
+      POSTGRES_PASSWORD: ${UMAMI_DB_PASS}
+    volumes:
+      - umami_data:/var/lib/postgresql/data