insight

Insight is a web analytics dashboard you run on your own server. It is installed once with Docker, then a single script tag is pasted into a site's head; the dashboard then shows, in real time, who is visiting, from where, what they read, what they buy, and which AI bots crawl the pages. There is no SaaS account and no third party — every byte stays in a database on the machine you chose. Audience and content metrics - Visitors, pageviews, bounce rate, engaged time, new versus returning visitors - Live feed and a 3D world map with per-visitor detail - Top pages, landing pages, exit pages and outbound clicks - Countries, regions, cities and languages Acquisition - Channel classification (search, social, AI, referral, direct), referrers, campaigns and a full UTM breakdown - Search Console keywords through an optional connection Revenue - A Stripe connection using a read-only key surfaces revenue net of refunds, conversion rate, revenue per visitor, and source and campaign attribution derived from your own purchase events Behaviour and bots - Funnels of two to four steps, weekly retention cohorts and a busy-hours heatmap - Logging of AI and indexing crawlers per page, split into AI answers, indexing and training groups; crawlers that never execute JavaScript are still recorded server-side Comfort features - Date ranges of today, 7d, 30d, 90d or custom, plus chart notes - Light and dark themes and drag-and-drop dashboard customisation - Optional GA4 import for historical numbers and Mapbox for the globe Privacy model - By default the tracker writes nothing to the visitor's device: no cookies and no localStorage - Visitors are counted with a salted SHA-256 hash that rotates daily; raw IP addresses are never written to the database and cannot be recovered from the hash - Optional precise mode via data-persist="true" stores a random first-party id in localStorage for exact returning-visitor and retention tracking; the README notes this should be treated like a cookie in privacy policies and, for EU audiences, in consent flows - The project states plainly that no analytics tool makes a site GDPR compliant on its own, since compliance concerns everything done with personal data Installation and operations - A provisioning script for a fresh Ubuntu server installs Docker, firewall rules and automatic security updates - Configuration lives in a .env file: admin email and password, auth secret and ClickHouse password - Two containers started with Docker Compose; a small 1 vCPU / 2 GB RAM server is described as sufficient - An optional GitHub Actions workflow builds the image and deploys to your server over SSH on every push Security - No public sign-up and no register endpoint; the only admin is the email and password set in the server environment, compared in constant time - Mandatory two-factor authentication: a QR code is shown at first login and a 6-digit code is required afterwards - Sessions are HMAC-signed with the auth secret and expire after 30 days - The dashboard is marked noindex and disallowed in robots.txt - Secrets live only in the server's .env; the repository contains none CLI - A read-only CLI with a separate token exposes figures such as "insight stats 30d", "insight stats today --site myshop.com" and "insight sites", and can be pointed at an AI assistant for plain-language questions; the token cannot unlock the dashboard Stack and licence - Next.js 16 App Router (standalone), React 19, TypeScript and Tailwind CSS v4 - ClickHouse stores events, SQLite stores configuration; Mapbox GL renders the globe and Recharts draws the charts - MIT licensed, built by Nicolas Lecocq