tacilytics 2.4.0 → 2.5.0

package/README.md

@@ -14,7 +14,11 @@
 ![No tracking](https://img.shields.io/badge/IPs%20stored-never-67e8f9)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-4ade80)
 
-<img src="docs/dashboard.png" width="820" alt="Tacilytics dashboard" />
+**[▶ Live demo](https://demo.tacilytics.com)** · **[Website](https://tacilytics.com)** · **[Hosted cloud](https://cloud.tacilytics.com)** · **[Quick start](#quick-start)**
+
+<a href="https://demo.tacilytics.com"><img src="docs/dashboard.png" width="820" alt="Tacilytics dashboard — open the live demo" /></a>
+
+<sub>The demo shows a fictional shop with generated data. No real visitors.</sub>
 
 </div>
 
@@ -29,7 +33,7 @@
 - 🚦 **Campaigns & funnels.** Full UTM (`source` / `medium` / `campaign`), entry & exit pages, **goal conversion rates** and **custom event properties**.
 - ⏱️ **Engagement time** — average time-on-page, measured privately (visible seconds only, no extra identifier).
 - 🤖 **Bots & crawlers dropped** automatically, so your numbers stay honest.
-- ⚡ **~2 KB tracker**, SPA-aware (tracks `pushState` / `popstate` route changes), optional **DNT / Global Privacy Control** honoring.
+- ⚡ **~5 KB tracker** (gzip, 14 KB raw, includes the strict mode, goals and revenue), SPA-aware (tracks `pushState` / `popstate` route changes), optional **DNT / Global Privacy Control** honoring.
 - 🗓️ **Data minimisation built in** — optional auto-purge of raw events after a retention window you choose.
 - 🎯 **Custom events & goals**, **live visitors**, **trends**, **custom date ranges**, **CSV export**.
 - 🛰️ **Agent-ready:** a clean `/api/v1` REST API (with segmentation params) + a `tacilytics` CLI (with `--json`).
@@ -47,6 +51,16 @@ npx tacilytics serve      # http://127.0.0.1:3920 — data/ and .env live in thi
 Or install it globally: `npm i -g tacilytics`, then `tacilytics serve`.
 Set your own `WEB_PASSWORD`, `SESSION_SECRET`, `INGEST_SALT` and `API_KEY` in a `.env` file in that folder (see [`.env.example`](.env.example)).
 
+**With Docker:**
+
+```bash
+git clone https://github.com/Open-Cosmic-Software/tacilytics.git && cd tacilytics
+cp .env.example .env     # set WEB_PASSWORD, SESSION_SECRET, INGEST_SALT, API_KEY
+docker compose up -d     # http://127.0.0.1:3920 — data lives in the tacilytics-data volume
+```
+
+The container listens on `0.0.0.0` inside, compose publishes it on `127.0.0.1` only. Outside Docker, set `HOST` to change the bind address.
+
 **From source:**
 
 ```bash
@@ -136,7 +150,7 @@ Server mode runs no script and reads or stores nothing on the visitor's device.
 
 ```http
 POST /api/v1/hit
-Authorization: Bearer tk_…            # a key created with write access (Settings → API keys), not read-only
+Authorization: Bearer tk_…            # a "server mode (count only)" key (Settings → API keys)
 Content-Type: application/json
 
 { "domain": "example.com", "path": "/shop?utm_source=news", "ip": "203.0.113.7",
@@ -144,21 +158,33 @@ Content-Type: application/json
   "purpose": "<Sec-Purpose or Purpose header>" }
 ```
 
-Node / Express, after your static files and before your pages:
+Node / Express, after your static files and before your pages. It reports only page loads that ended with `200` (no 404s, no redirects) and only for clients that asked for HTML:
 
 ```js
 app.use((req, res, next) => {
-  if (req.method === 'GET' && req.accepts('html')) fetch('https://analytics.example.com/api/v1/hit', {
-    method: 'POST', headers: { Authorization: 'Bearer ' + process.env.TACILYTICS_KEY, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ domain: 'example.com', path: req.originalUrl, ip: req.ip, ua: req.get('user-agent'),
-      referrer: req.get('referer'), lang: req.get('accept-language'), purpose: req.get('sec-purpose') || req.get('purpose') }),
-  }).catch(() => {});
+  if (req.method !== 'GET' || req.accepts(['html', 'json']) !== 'html') return next();
+  res.on('finish', () => {
+    if (res.statusCode !== 200) return;
+    fetch('https://analytics.example.com/api/v1/hit', {
+      method: 'POST', headers: { Authorization: 'Bearer ' + process.env.TACILYTICS_KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ domain: 'example.com', path: req.originalUrl, ip: req.ip, ua: req.get('user-agent'),
+        referrer: req.get('referer'), lang: req.get('accept-language'), purpose: req.get('sec-purpose') || req.get('purpose') }),
+    }).then((r) => { if (r.status === 429) console.warn('tacilytics: rate limited'); }).catch(() => {});
+  });
   next();
 });
 ```
 
-- **The visitor IP** is only accepted here, with a write key, never on the public `/api/collect`. It is hashed like a tracker hit (daily salt) and never stored. Behind a proxy or load balancer, send the real visitor IP (e.g. `req.ip` with Express `trust proxy` set right), not your proxy's. Without an IP the hit is refused (`400`), because all visitors would fall onto one hash.
-- **Filtered on our side:** bots and monitors (same list as the tracker), requests without a user agent, prefetch / prerender (`purpose`), and `dnt: true` / `gpc: true` if you choose to forward those headers. A site-limited key can only report for its own sites.
+**Which key goes on the web server.** Web servers are where sites get broken into, so the key there should be able to do as little as possible:
+
+- Create a **server mode (count only)** key under Settings → API keys (admin or owner) and tick the site(s) it reports for. It can call `POST /api/v1/hit` for those sites and nothing else (`403` everywhere else, reads included), and it never reaches more than the account that created it.
+- **Never** put the `API_KEY` from `.env` on a web server. It is the owner key for every site on the instance.
+- Don't use a read + write key either. It still works on `/api/v1/hit` (as in 2.4.0), but a stolen one can also create public share links, point alert webhooks at any URL, upload or delete imports, and change notes, funnels and the time zone of its sites.
+- If several sites run on different servers, give each server its own key, so one break-in can be revoked without touching the others.
+- Server-mode keys arrived in 2.4.1. Before downgrading to 2.4.0, delete them: 2.4.0 does not know the scope and would treat them as ordinary read-only keys.
+
+- **The visitor IP** is only accepted here, with a server-mode or write key, never on the public `/api/collect`. It is hashed like a tracker hit (daily salt) and never stored. Behind a proxy or load balancer, send the real visitor IP (e.g. `req.ip` with Express `trust proxy` set right), not your proxy's. Without an IP the hit is refused (`400`), because all visitors would fall onto one hash.
+- **Filtered on our side:** bots and monitors (same list as the tracker), requests without a user agent, prefetch / prerender (`purpose`), and `dnt: true` / `gpc: true` if you choose to forward those headers. A key can only report for its own sites. The rate limit (6,000 page views a minute) applies per key, so sites on one shared-hosting IP don't block each other; above it the API answers `429` and the hit is not counted.
 - **Page caches and CDNs:** if a cache plugin or a CDN (e.g. Cloudflare) answers the request, your server code never runs and the visit is not reported. Report from somewhere every request passes, or exclude HTML from the cache.
 - **What you give up compared with the script:** no time on page, no scroll depth, no click / outbound / download events, no country, and no `?tacilytics=off`. Server-side goals work: add `"name": "Purchase", "props": { "value": 49.9 }`.
 - **Data protection:** the IP and user agent are personal data while they are hashed. That needs a legal basis (typically legitimate interest, GDPR Art. 6(1)(f)) and a sentence in your privacy policy. If someone else runs Tacilytics for you (for example Tacilytics Cloud), your server passes visitor IPs to them, so you need a data processing agreement (DPA). Server mode does not decide whether you need consent for the rest of your website. This is not legal advice.
@@ -273,7 +299,7 @@ curl -H "Authorization: Bearer $TACILYTICS_API_KEY" \
 | `POST /api/v1/sites` | add a site `{ domain }` |
 | `GET /api/v1/stats?site=&period=` | aggregated stats — `today \| 7d \| 30d \| 90d \| 12mo`, or `from=YYYY-MM-DD&to=YYYY-MM-DD` |
 | `GET /api/v1/realtime?site=` | online count, 30-min pulse + recent events |
-| `POST /api/v1/hit` | server mode: report a page view from your web server (write key), see [Server mode](#server-mode-no-script-at-all) |
+| `POST /api/v1/hit` | server mode: report a page view from your web server (server-mode key), see [Server mode](#server-mode-no-script-at-all) |
 
 Add any of `country, source, page, browser, os, device, lang, medium, campaign, goal` to `/stats` to segment, e.g. `…/stats?site=example.com&period=30d&country=DE&medium=email`.
 
@@ -309,6 +335,28 @@ devices. You get the 95 % that matters (how many, which pages, from where) witho
 the same approach as Plausible/Fathom. Whether you still need consent depends on your
 jurisdiction and setup; strict mode (`data-strict`) reduces the device reads further.
 
+**Sources per visit.** Like GA, Plausible and Matomo, the source belongs to the visit: an internal
+click or a reload inherits the source of the same visitor's previous page view within 30 minutes,
+instead of showing up as *Direct*. This happens on the server (daily visitor hash), so strict mode
+works the same and nothing extra is read on the device.
+
+**Bots and scrapers.** Known crawler, AI-scraper and HTTP-library user agents are dropped. Scrapers
+that pretend to be a normal browser usually run in a cloud: by default, visits from cloud and hosting
+networks are ignored too (list: [X4BNet/lists_vpn](https://github.com/X4BNet/lists_vpn) *datacenter*,
+MIT, downloaded once a day — no visitor data leaves your server). The IP is checked on arrival and
+never stored. iCloud Private Relay runs on the same cloud networks, so Apple's published egress list is
+downloaded too and always let through; without it the filter stays off (with a fixed local list via
+`TACILYTICS_DATACENTER_FILE` it runs anyway — set `TACILYTICS_RELAY_FILE` too, the server warns at start).
+A list that looks wrong (an IPv4 range shorter than /8 or IPv6 shorter than /24, more than 25 % of IPv4
+or 0.1 % of global IPv6, a known residential address inside) is refused, and a failed download of either
+list is retried with backoff. The site settings show how many hits were ignored today and grey the
+switch out while the filter is not running. Honest trade-off: commercial VPNs, Opera's built-in VPN and
+cloud desktops (Windows 365, AVD) are not counted either — for B2B sites consider switching it off.
+If more than half of a site's hits in an hour are dropped (or all of at least 5 on a small site), the
+server log warns (usually a proxy setup: check `TRUST_PROXY`). Switch it off per site in the site
+settings (clock button), or for the whole server
+with `TACILYTICS_DATACENTER=off`.
+
 ## Light mode & German
 
 Settings → Security → **Appearance**: *Theme* (System / Light / Dark) and *Language* (Automatic / English / Deutsch), saved per browser. *System* follows the device's light/dark setting live; *Automatic* picks German when the browser is German. Your data (paths, sources, event names) is never translated.
@@ -360,6 +408,9 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 | `SMTP_URL` / `REPORT_FROM` | — | Mail server + sender for the weekly report |
 | `REPORT_HOUR_UTC` | `6` | Monday hour (UTC) the weekly report goes out; it covers the last 7 full days in each site's time zone |
 | `AUDIT_RETENTION_DAYS` | `365` | How long the team activity log is kept (min. 30) |
+| `TACILYTICS_DATACENTER` | on | `off` disables the cloud / hosting network filter server-wide (no list download) |
+| `TACILYTICS_DATACENTER_FILE` | — | Use local range lists instead of the daily download (comma-separated paths, CIDR per line), e.g. for offline installs |
+| `TACILYTICS_RELAY_FILE` | — | Local copy of Apple's iCloud Private Relay egress CSV (with a local datacenter list) |
 | `DATA_RETENTION_DAYS` | `0` | `0` = keep forever; `>0` purges raw events older than N days, daily (data minimisation) |
 
 ## Privacy & security
@@ -380,17 +431,28 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 - All visitor-supplied values are HTML-escaped before they reach the DOM.
 - Run behind TLS; keep `.env` at `chmod 600`.
 
-## Tacilytics vs. Google Analytics
+## How it compares
 
-| | Tacilytics | Google Analytics |
-|---|---|---|
-| Cookies | ❌ none | ✅ yes |
-| Reads from the device | a few (time zone, language, window size, one localStorage flag); none in strict mode | ✅ a lot |
-| Works without any script on the visitor's device | ✅ server mode | ❌ |
-| Stores IPs / personal data | ❌ never | ✅ yes |
-| Self-hosted, you own the data | ✅ | ❌ |
-| Weight | ~2 KB | ~45 KB+ |
-| Setup | 1 script + 1 process | tag manager, config… |
+An honest overview. Plausible and Umami are good projects; pick what fits you.
+
+| | Tacilytics | Plausible CE | Umami | Google Analytics 4 |
+|---|---|---|---|---|
+| Cookies | ❌ none | ❌ none | ❌ none | ✅ yes |
+| IPs leave your server | ❌ never | ❌ | ❌ | ✅ sent to Google |
+| No script on the device at all | ✅ server mode | ❌ | ❌ | ❌ |
+| Strict mode (no device reads) | ✅ | ❌ | ❌ | ❌ |
+| Mobile app SDK | ✅ Flutter | ❌ | ❌ | ✅ |
+| Runs on | Node + SQLite file | Elixir + Postgres + ClickHouse | Node + Postgres/MySQL | Google |
+| Tracker size (gzip) | ~5 KB | ~1 KB | ~2 KB | ~45 KB+ |
+| Built for big traffic (millions/day) | ⚠️ not yet, SQLite | ✅ | ✅ | ✅ |
+| Self-hosted, you own the data | ✅ | ✅ | ✅ | ❌ |
+| Licence | MIT | AGPL | MIT | proprietary |
+
+*As of October 2026, to the best of our knowledge. Spot a mistake? Please [open an issue](https://github.com/Open-Cosmic-Software/tacilytics/issues).*
+
+## Contributing
+
+Issues, ideas and pull requests are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md). Security reports go [privately](SECURITY.md).
 
 ## Credits
 
@@ -398,6 +460,8 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 - Brand marks: [Simple Icons](https://simpleicons.org) (CC0). Brand names and logos are trademarks of their owners; see `public/assets/DISCLAIMER-simple-icons.md`. Windows and Edge have no free official mark, so a neutral icon is shown.
 - Flags: [flag-icons](https://flagicons.lipis.dev) (MIT)
 - Font: [Inter](https://rsms.me/inter/) (SIL OFL 1.1), self-hosted
+- Datacenter ranges: [X4BNet/lists_vpn](https://github.com/X4BNet/lists_vpn) (MIT), downloaded at runtime, not bundled
+- iCloud Private Relay egress ranges: published by Apple (`mask-api.icloud.com`), downloaded at runtime as an allowlist
 
 ## License
 

package/auth.js

@@ -180,6 +180,11 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     );
   `);
 
+  // 2.4.1: key scopes. '' = the old behaviour (read-only or the account's own rights); 'hit' = server mode only,
+  // usable for POST /api/v1/hit on the listed sites and nothing else. Existing keys keep scope '' (unchanged).
+  for (const [col, decl] of [['scope', "TEXT NOT NULL DEFAULT ''"], ['sites', 'TEXT']]) {
+    if (!db.prepare('PRAGMA table_info(api_keys)').all().some((c) => c.name === col)) db.exec(`ALTER TABLE api_keys ADD COLUMN ${col} ${decl}`);
+  }
   const q = {
     userCount: db.prepare('SELECT COUNT(*) n FROM users'),
     ownerCount: db.prepare("SELECT COUNT(*) n FROM users WHERE role = 'owner'"),
@@ -204,13 +209,14 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
   // after the response is sent. Handlers can name the action/target via res.locals.audit;
   // otherwise method + route are recorded. New endpoints are covered without remembering to.
   // Not logged: tracking beacons, sign-in steps, WebAuthn option requests (no state change).
-  const AUDIT_SKIP = new Set(['/api/collect', '/auth/login', '/auth/login/totp', '/auth/passkey/options', '/auth/passkey/verify', '/auth/logout', '/api/me/passkeys/options', '/api/me/totp/setup']);
+  const AUDIT_SKIP = new Set(['/api/collect', '/auth/login', '/auth/login/totp', '/auth/passkey/options', '/auth/passkey/verify', '/auth/logout', '/api/me/passkeys/options', '/api/me/totp/setup', '/api/v1/hit']);
   const AUDIT_DAYS = Math.max(30, parseInt(process.env.AUDIT_RETENTION_DAYS, 10) || 365);
   const insAudit = db.prepare('INSERT INTO audit_log (ts, actor, action, target, ip) VALUES (?, ?, ?, ?, ?)');
   function actorOf(p) {
     if (!p) return null;
     if (p.kind === 'user') return p.user.username;
     if (p.kind === 'userkey') return p.user.username + ' (API key)';
+    if (p.kind === 'hitkey') return p.user.username + ' (server-mode key)';
     if (p.kind === 'apikey') return 'API key';
     if (p.kind === 'legacy') return 'passphrase';
     return null;
@@ -220,17 +226,25 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     res.on('finish', () => {
       if (res.statusCode < 200 || res.statusCode >= 300) return;
       try {
-        const a = res.locals.audit || {};
+        // one row per named action (a single save can change several things, e.g. time zone + filter)
+        const list = res.locals.audits && res.locals.audits.length ? res.locals.audits : [{}];
         const route = req.route ? req.route.path : req.path;
-        const action = a.action || `${req.method} ${route}`;
-        const actor = a.actor !== undefined ? a.actor : actorOf(req.principal);
-        insAudit.run(Date.now(), actor, action, a.target == null ? null : String(a.target).slice(0, 200), clientIp(req));
+        const ts = Date.now();
+        for (const a of list) {
+          const action = a.action || `${req.method} ${route}`;
+          const actor = a.actor !== undefined ? a.actor : actorOf(req.principal);
+          insAudit.run(ts, actor, action, a.target == null ? null : String(a.target).slice(0, 200), clientIp(req));
+        }
       } catch (e) { console.error('audit log:', e.message); }
     });
     next();
   });
   setInterval(() => db.prepare('DELETE FROM audit_log WHERE ts < ?').run(Date.now() - AUDIT_DAYS * 864e5), 6 * 3600e3).unref();
-  const audit = (res, action, target, actor) => { res.locals.audit = { action, target, ...(actor !== undefined ? { actor } : {}) }; };
+  const audit = (res, action, target, actor) => {
+    const a = { action, target, ...(actor !== undefined ? { actor } : {}) };
+    res.locals.audit = a;
+    (res.locals.audits || (res.locals.audits = [])).push(a);
+  };
   if (hasUsers() && !process.env.TACILYTICS_ORIGIN) {
     console.warn('⚠️  TACILYTICS_ORIGIN is not set. Passkeys use the request host, so they break if the dashboard is reached under another host/port or behind a proxy without X-Forwarded-Proto. Set it to the public dashboard URL.');
   }
@@ -256,8 +270,14 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
         const u = k && q.userById.get(k.user_id);
         if (!u) return null;
         if (!k.last_used || Date.now() - k.last_used > 60000) db.prepare('UPDATE api_keys SET last_used = ? WHERE id = ?').run(Date.now(), k.id);
+        const userSites = u.sites ? JSON.parse(u.sites) : null;
+        if (k.scope === 'hit') {
+          // never more than the account itself may see today (an account limited later narrows its old keys too)
+          const ks = JSON.parse(k.sites || '[]').filter((id) => userSites == null || userSites.includes(id));
+          return { kind: 'hitkey', role: 'viewer', sites: ks, user: u, keyId: k.id };
+        }
         const role = k.read_only ? 'viewer' : u.role;
-        return { kind: 'userkey', role, sites: u.sites ? JSON.parse(u.sites) : null, user: u, keyId: k.id };
+        return { kind: 'userkey', role, sites: userSites, user: u, keyId: k.id };
       }
       return null; // a wrong key is a failed sign-in, not an anonymous request
     }
@@ -278,6 +298,8 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
   function auth(req, res, next) {
     const p = principal(req);
     if (!p) return res.status(401).json({ error: 'Not authenticated' });
+    // a server-mode key reports page views and does nothing else — not even read stats
+    if (p.kind === 'hitkey' && !(req.method === 'POST' && req.path === '/api/v1/hit')) return res.status(403).json({ error: 'This key can only report page views (POST /api/v1/hit)' });
     req.principal = p;
     next();
   }
@@ -498,7 +520,7 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     res.json(out);
   });
   const userOnly = (req, res, next) => {
-    if (req.principal.kind === 'userkey') return res.status(403).json({ error: 'API keys cannot change account settings — sign in' });
+    if (req.principal.kind === 'userkey' || req.principal.kind === 'hitkey') return res.status(403).json({ error: 'API keys cannot change account settings — sign in' });
     return req.principal.user ? next() : res.status(400).json({ error: 'Create an account first' });
   };
   async function needPassword(req, res) {
@@ -599,7 +621,7 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
   });
 
   app.get('/api/audit', requireRole('owner'), (req, res) => {
-    if (req.principal.kind === 'userkey') return res.status(403).json({ error: 'API keys cannot read the audit log — sign in' });
+    if (req.principal.kind === 'userkey' || req.principal.kind === 'hitkey') return res.status(403).json({ error: 'API keys cannot read the audit log — sign in' });
     const before = Number(req.query.before) || Date.now() + 1;
     const limit = Math.min(500, Math.max(1, Number(req.query.limit) || 100));
     res.json(db.prepare('SELECT id, ts, actor, action, target, ip FROM audit_log WHERE ts < ? ORDER BY ts DESC, id DESC LIMIT ?').all(before, limit));
@@ -607,21 +629,33 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
 
   // ── personal API keys ──
   app.get('/api/me/keys', auth, userOnly, (req, res) => {
-    res.json(db.prepare('SELECT id, prefix, name, read_only, created, last_used FROM api_keys WHERE user_id = ? ORDER BY created').all(req.principal.user.id)
-      .map((k) => ({ ...k, read_only: !!k.read_only })));
+    res.json(db.prepare('SELECT id, prefix, name, read_only, scope, sites, created, last_used FROM api_keys WHERE user_id = ? ORDER BY created').all(req.principal.user.id)
+      .map((k) => ({ ...k, read_only: !!k.read_only, scope: k.scope || '', sites: k.sites ? JSON.parse(k.sites) : null })));
   });
   app.post('/api/me/keys', auth, userOnly, (req, res) => {
     const b = req.body || {};
     const n = db.prepare('SELECT COUNT(*) n FROM api_keys WHERE user_id = ?').get(req.principal.user.id).n;
     if (n >= 20) return res.status(400).json({ error: 'At most 20 keys per account' });
-    // a viewer can only ever get a read-only key
-    const readOnly = req.principal.role === 'viewer' ? true : b.readOnly !== false;
     const key = 'tk_' + crypto.randomBytes(24).toString('base64url');
     const name = String(b.name || '').trim().slice(0, 60) || 'API key';
+    if (b.scope === 'hit') {
+      // server mode: bound to explicit sites, never more than the account may see. Admin or owner only: reporting
+      // page views is writing data (it can add visitors), and a viewer may not write — same rule as /api/v1/hit in 2.4.0.
+      if (req.principal.role === 'viewer') return res.status(403).json({ error: 'Viewers cannot create server-mode keys' });
+      if (!Array.isArray(b.sites) || !b.sites.length) return res.status(400).json({ error: 'Pick the site(s) this server reports for' });
+      const ids = [...new Set(b.sites.map(Number))];
+      if (ids.some((id) => !allSiteIds().includes(id) || !siteAllowed(req, id))) return res.status(403).json({ error: 'You have no access to one of these sites' });
+      const info = db.prepare("INSERT INTO api_keys (key_hash, prefix, user_id, name, read_only, scope, sites, created) VALUES (?, ?, ?, ?, 1, 'hit', ?, ?)")
+        .run(sha256(key), key.slice(0, 10), req.principal.user.id, name, JSON.stringify(ids), Date.now());
+      audit(res, 'me.apikey.add', `${name} (${key.slice(0, 10)}…, server mode: sites ${ids.join(',')})`);
+      return res.json({ id: info.lastInsertRowid, key, name, read_only: true, scope: 'hit', sites: ids });
+    }
+    // a viewer can only ever get a read-only key
+    const readOnly = req.principal.role === 'viewer' ? true : b.readOnly !== false;
     const info = db.prepare('INSERT INTO api_keys (key_hash, prefix, user_id, name, read_only, created) VALUES (?, ?, ?, ?, ?, ?)')
       .run(sha256(key), key.slice(0, 10), req.principal.user.id, name, readOnly ? 1 : 0, Date.now());
     audit(res, 'me.apikey.add', `${name} (${key.slice(0, 10)}…, ${readOnly ? 'read-only' : 'read + write'})`);
-    res.json({ id: info.lastInsertRowid, key, name, read_only: readOnly }); // the key is shown exactly once
+    res.json({ id: info.lastInsertRowid, key, name, read_only: readOnly, scope: '' }); // the key is shown exactly once
   });
   app.delete('/api/me/keys/:id', auth, userOnly, (req, res) => {
     const k = db.prepare('SELECT name, prefix FROM api_keys WHERE id = ? AND user_id = ?').get(Number(req.params.id), req.principal.user.id);
@@ -633,7 +667,7 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
   // ── team (owner) ───────────────────────────────────────────────────────────
   // team management needs a real sign-in (or the server API_KEY): a personal key that leaks must not
   // be able to invite, promote or remove people
-  const ownerOnly = (req, res, next) => requireRole('owner')(req, res, () => (req.principal.kind === 'userkey'
+  const ownerOnly = (req, res, next) => requireRole('owner')(req, res, () => (req.principal.kind === 'userkey' || req.principal.kind === 'hitkey'
     ? res.status(403).json({ error: 'API keys cannot manage the team — sign in' }) : next()));
 
   // first account: only from a legacy (WEB_PASSWORD) or API-key session, only while there are none

package/datacenter.js

@@ -0,0 +1,232 @@
+'use strict';
+// Datacenter IP check (2.5). Scrapers that pretend to be a normal Chrome on a Mac pass every
+// user-agent filter, but people do not browse from cloud servers. Like Plausible, the visitor IP is
+// checked once on arrival against public lists of hosting / cloud networks and never stored.
+//
+// List: X4BNet/lists_vpn "datacenter" output (MIT, https://github.com/X4BNet/lists_vpn), refreshed once
+// a day into the data directory. Nothing about visitors leaves the server: we only download the list.
+// If no list is available (offline install, first start without network) the check is off and every
+// visit counts — losing real visitors is worse than counting a few bots.
+const fs = require('fs');
+const net = require('net');
+
+const DEFAULT_URLS = [
+  'https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv4.txt',
+  'https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv6.txt',
+];
+// iCloud Private Relay runs on Akamai / Fastly / Cloudflare networks that the datacenter list contains.
+// Those are real Safari visitors, so Apple's published egress ranges are an allowlist checked first.
+const RELAY_URL = 'https://mask-api.icloud.com/egress-ip-ranges.csv';
+
+// sanity limits: a broken or hostile list must never be able to drop everyone
+const MIN_BITS_V4 = 8;
+const MIN_BITS_V6 = 24; // the real list's largest IPv6 prefix is /24
+const MAX_V4_SHARE = 0.25; // today ~9 % of the IPv4 space
+const MAX_V6_SHARE = 0.001; // of global unicast 2000::/3, today ~12 ppm
+// residential / ISP addresses that must never be inside a datacenter list (Telekom, Vodafone, Comcast, Telekom v6)
+// IPv6: Telekom, Vodafone, T-Mobile, 1&1, O2
+const CANARIES = ['79.192.0.1', '84.150.3.3', '91.64.1.1', '73.0.0.1',
+  '2003::1', '2a02:8108::1', '2a01:598::1', '2001:16b8::1', '2a02:3030::1'];
+
+function v4ToInt(ip) {
+  const p = ip.split('.');
+  return ((+p[0] << 24) >>> 0) + (+p[1] << 16) + (+p[2] << 8) + +p[3];
+}
+function v6ToBig(ip) {
+  // expand "::" and an embedded IPv4 tail, then read 8 groups of 16 bits
+  let s = ip.toLowerCase();
+  const v4 = s.match(/(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4) { const n = v4ToInt(v4[1]); s = s.slice(0, -v4[1].length) + ((n >>> 16).toString(16)) + ':' + ((n & 0xffff).toString(16)); }
+  const [head, tail] = s.split('::');
+  const h = head ? head.split(':') : [];
+  const t = tail !== undefined ? (tail ? tail.split(':') : []) : [];
+  const groups = tail !== undefined ? [...h, ...Array(8 - h.length - t.length).fill('0'), ...t] : h;
+  let x = 0n;
+  for (const g of groups) x = (x << 16n) + BigInt(parseInt(g || '0', 16));
+  return x;
+}
+
+// parse "a.b.c.d/nn" and "x::/nn" lines into sorted, merged [start, end] ranges
+function parseList(text, { minV4 = MIN_BITS_V4, minV6 = MIN_BITS_V6 } = {}) {
+  const v4 = []; const v6 = [];
+  for (const raw of String(text).split('\n')) {
+    const line = raw.split('#')[0].trim();
+    if (!line) continue;
+    const [addrRaw, bitsS, extra] = line.split(',')[0].trim().split('/');
+    const addr = addrRaw.trim();
+    if (extra !== undefined) continue;
+    if (bitsS !== undefined && !/^\d{1,3}$/.test(bitsS)) continue; // "1.2.3.4/" must not become /0
+    const kind = net.isIP(addr);
+    if (kind === 4) {
+      const bits = bitsS === undefined ? 32 : +bitsS;
+      if (!(bits >= minV4 && bits <= 32)) continue;
+      const size = 2 ** (32 - bits);
+      const start = Math.floor(v4ToInt(addr) / size) * size;
+      v4.push([start, start + size - 1]);
+    } else if (kind === 6) {
+      const bits = bitsS === undefined ? 128 : +bitsS;
+      if (!(bits >= minV6 && bits <= 128)) continue;
+      const host = 128n - BigInt(bits);
+      const start = (v6ToBig(addr) >> host) << host;
+      v6.push([start, start + (1n << host) - 1n]);
+    }
+  }
+  const merge = (arr) => {
+    arr.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+    const out = [];
+    for (const r of arr) {
+      const last = out[out.length - 1];
+      if (last && r[0] <= last[1] + (typeof r[0] === 'bigint' ? 1n : 1)) { if (r[1] > last[1]) last[1] = r[1]; } else out.push([r[0], r[1]]);
+    }
+    return out;
+  };
+  return { v4: merge(v4), v6: merge(v6) };
+}
+
+function inRanges(ranges, x) {
+  let lo = 0; let hi = ranges.length - 1;
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1;
+    if (x < ranges[mid][0]) hi = mid - 1;
+    else if (x > ranges[mid][1]) lo = mid + 1;
+    else return true;
+  }
+  return false;
+}
+
+function v4Share(l) { let n = 0; for (const [a, b] of l.v4) n += b - a + 1; return n / 2 ** 32; }
+// share of global unicast 2000::/3 (2^125 addresses), counted only for the part inside it
+function v6Share(l) {
+  const lo = 0x2n << 124n; const hi = lo + (1n << 125n) - 1n;
+  let n = 0n;
+  for (const [a, b] of l.v6) { const s = a > lo ? a : lo; const e = b < hi ? b : hi; if (e >= s) n += e - s + 1n; }
+  return Number((n * 1000000n) >> 125n) / 1e6;
+}
+
+// Reject a whole list that looks wrong instead of trusting it. Returns an error text or null.
+function validate(l) {
+  if (!l.v4.length && !l.v6.length) return 'no ranges';
+  const share = v4Share(l);
+  if (share > MAX_V4_SHARE) return `covers ${(share * 100).toFixed(1)} % of IPv4 (limit ${MAX_V4_SHARE * 100} %)`;
+  const share6 = v6Share(l);
+  if (share6 > MAX_V6_SHARE) return `covers ${(share6 * 100).toFixed(3)} % of global IPv6 (limit ${MAX_V6_SHARE * 100} %)`;
+  for (const c of CANARIES) if (lookup(l, c)) return 'contains residential address ' + c;
+  return null;
+}
+function lookup(l, ip) {
+  const kind = net.isIP(ip);
+  if (kind === 4) return inRanges(l.v4, v4ToInt(ip));
+  if (kind === 6) return inRanges(l.v6, v6ToBig(ip));
+  return false;
+}
+// Apple relay CSV: "prefix,country,region,city,". Relay prefixes are small, no minimum length.
+// One pass over the ~12 MB file: keep only the prefix column and count the well-formed lines.
+function parseRelay(text) {
+  const t = String(text);
+  const out = [];
+  let lines = 0;
+  let i = 0;
+  let comma = -1; // reused across lines: a file without commas must not rescan to the end for every line
+  if (t.charCodeAt(0) === 0xfeff) i = 1; // byte-order mark
+  while (i < t.length) {
+    let nl = t.indexOf('\n', i); if (nl < 0) nl = t.length;
+    if (comma < i && comma !== -2) { comma = t.indexOf(',', i); if (comma < 0) comma = -2; }
+    if (comma > i && comma < nl) {
+      const prefix = t.slice(i, comma);
+      if (/^[0-9a-fA-F:.]+\/\d{1,3}$/.test(prefix)) { out.push(prefix); lines++; }
+    }
+    i = nl + 1;
+  }
+  const r = parseList(out.join('\n'), { minV4: 0, minV6: 0 });
+  r.lines = lines;
+  return r;
+}
+
+function createDatacenterCheck({ dir, mode = process.env.TACILYTICS_DATACENTER, files = process.env.TACILYTICS_DATACENTER_FILE,
+  relayFile = process.env.TACILYTICS_RELAY_FILE, log = console } = {}) {
+  let list = { v4: [], v6: [] };
+  let relay = { v4: [], v6: [] };
+  let loaded = false;
+  let loadedAt = 0;
+  let retryMs = 5 * 60000;
+  const off = String(mode || '').toLowerCase() === 'off';
+  const P = require('path');
+  const cache = dir ? P.join(dir, '.datacenter-ranges.txt') : null;
+  const relayCache = dir ? P.join(dir, '.relay-ranges.csv') : null;
+  const say = (k, m) => { if (log[k]) log[k]('datacenter check: ' + m); };
+
+  function use(text, from) {
+    const l = parseList(text);
+    const bad = validate(l);
+    if (bad) { say('warn', `list from ${from} rejected (${bad})` + (loaded ? ', keeping the last list' : ', filter stays off')); return false; }
+    list = l; loaded = true; loadedAt = Date.now();
+    say('info', `${l.v4.length} IPv4 + ${l.v6.length} IPv6 ranges (${from}, ${(v4Share(l) * 100).toFixed(1)} % of IPv4)`);
+    return true;
+  }
+  function useRelay(text, from) {
+    const r = parseRelay(text);
+    if (r.lines < 100) { say('warn', `relay list from ${from} too short, ignored`); return false; }
+    relay = { v4: r.v4, v6: r.v6 };
+    say('info', `${r.v4.length} IPv4 + ${r.v6.length} IPv6 iCloud Private Relay ranges allowed (${from})`);
+    return true;
+  }
+  const writeCache = (f, text) => { if (!f) return; const tmp = f + '.tmp'; fs.writeFileSync(tmp, text, { mode: 0o600 }); fs.renameSync(tmp, f); };
+  async function get(u) {
+    const r = await fetch(u, { signal: AbortSignal.timeout(30000) });
+    if (!r.ok) throw new Error(u + ' → HTTP ' + r.status);
+    return r.text();
+  }
+  let timer = null;
+  function schedule(ms) { if (timer) clearTimeout(timer); timer = setTimeout(refresh, ms); if (timer.unref) timer.unref(); }
+  async function refresh() {
+    if (off) return;
+    let ok = true;
+    try {
+      const text = (await Promise.all(DEFAULT_URLS.map(get))).join('\n');
+      if (use(text, 'download')) writeCache(cache, text); else ok = false;
+    } catch (e) { ok = false; say('warn', 'refresh failed (' + e.message + ')' + (loaded ? ', keeping the last list' : ', filter stays off until a list loads')); }
+    try { const t = await get(RELAY_URL); if (useRelay(t, 'download')) writeCache(relayCache, t); else ok = false; } catch (e) { ok = false; say('warn', 'relay list refresh failed (' + e.message + ')'); }
+    // without the relay allowlist the filter is off, so a missing relay list is a failure too
+    if (!relay.v4.length && !relay.v6.length) ok = false;
+    // retry with backoff while something failed, otherwise once a day
+    if (ok) { retryMs = 5 * 60000; schedule(24 * 3600 * 1000); } else { schedule(retryMs); retryMs = Math.min(retryMs * 4, 6 * 3600 * 1000); }
+  }
+  function start() {
+    if (off) { say('info', 'off (TACILYTICS_DATACENTER=off)'); return; }
+    if (relayFile) { try { useRelay(fs.readFileSync(relayFile, 'utf8'), 'file'); } catch (e) { say('warn', 'relay file: ' + e.message); } }
+    if (files) {
+      // fixed local list (offline installs, tests): no download
+      if (!relayFile) say('warn', 'TACILYTICS_DATACENTER_FILE without TACILYTICS_RELAY_FILE: iCloud Private Relay visitors inside the list will be dropped');
+      try { use(String(files).split(',').map((f) => fs.readFileSync(f.trim(), 'utf8')).join('\n'), 'file'); } catch (e) { say('warn', 'list file: ' + e.message); }
+      return;
+    }
+    let fresh = false;
+    let relayOk = false;
+    if (relayCache && fs.existsSync(relayCache)) { try { relayOk = useRelay(fs.readFileSync(relayCache, 'utf8'), 'cache'); } catch {} }
+    if (cache && fs.existsSync(cache)) {
+      try {
+        // clamp: a cache file with a future mtime must not give a negative age (timer overflow)
+        const age = Math.max(0, Date.now() - fs.statSync(cache).mtimeMs);
+        if (use(fs.readFileSync(cache, 'utf8'), 'cache')) { loadedAt = Date.now() - age; fresh = relayOk && age < 24 * 3600 * 1000; }
+        if (age > 7 * 24 * 3600 * 1000) say('warn', `cached list is ${Math.round(age / 86400000)} days old`);
+      } catch {}
+    }
+    if (fresh) schedule(Math.max(1000, 24 * 3600 * 1000 - (Date.now() - loadedAt))); else refresh();
+  }
+  function isDatacenter(ip) {
+    if (!loaded) return false;
+    let s = String(ip || '').split('%')[0].toLowerCase();
+    if (s.startsWith('::ffff:') && net.isIPv4(s.slice(7))) s = s.slice(7);
+    if (!net.isIP(s)) return false;
+    // without Apple's relay allowlist the datacenter list would drop iCloud Private Relay users
+    // (Akamai / Fastly egress): then the filter stays off. Only a fixed local list may run without it.
+    if (!relay.v4.length && !relay.v6.length && !files) return false;
+    if (lookup(relay, s)) return false; // iCloud Private Relay = a real person
+    return lookup(list, s);
+  }
+  // active = the filter really drops something right now (list loaded and, unless a fixed file is used, the relay allowlist too)
+  const active = () => !off && loaded && (!!files || relay.v4.length > 0 || relay.v6.length > 0);
+  return { start, refresh, isDatacenter, get loaded() { return loaded; }, get loadedAt() { return loadedAt; }, get active() { return active(); }, get off() { return off; } };
+}
+
+module.exports = { createDatacenterCheck, _test: { parseList, parseRelay, validate, inRanges, v4ToInt, v6ToBig, v6Share, MIN_BITS_V6 } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tacilytics",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Privacy-first, cookieless analytics for websites and apps. Self-hosted: one Node process, one SQLite file.",
   "main": "server.js",
   "type": "commonjs",
@@ -49,6 +49,7 @@
     "server.js",
     "cli.js",
     "day-salt.js",
+    "datacenter.js",
     "auth.js",
     "importers.js",
     "report.js",

package/public/account.js

@@ -277,11 +277,13 @@
       '<p class="muted">Every Monday morning, for each of your sites: key figures, a day-by-day chart, highlights, top pages, sources, countries, devices, goals, shop numbers and your notes — compared with the week before.</p>' +
       '<div id="repBox"><p class="muted small">Loading…</p></div></div>' +
       '<div class="set-card"><h3>' + ico('i-code') + 'API keys</h3>' +
-      '<p class="muted">For scripts, agents and the CLI (<code>TACILYTICS_API_KEY</code>). A key acts as you, sees only your sites, and cannot touch the team or your security settings. Read-only unless you untick it.</p>' +
+      '<p class="muted">For scripts, agents and the CLI (<code>TACILYTICS_API_KEY</code>). A key acts as you, sees only your sites, and cannot touch the team or your security settings.</p>' +
+      '<p class="muted small">For server mode, create a “server mode (count only)” key: it can only report page views for the sites you tick, nothing else. Never put a read + write key on a web server.</p>' +
       '<div id="keyList"><p class="muted small">Loading…</p></div>' +
       '<div class="set-inline"><input id="keyName" type="text" placeholder="Name, e.g. reporting script" maxlength="60">' +
-      (me.role !== 'viewer' ? '<label class="small muted" style="display:inline-flex;gap:6px;align-items:center;flex:0 0 auto"><input type="checkbox" id="keyRo" checked style="width:auto;margin:0"> read-only</label>' : '') +
-      '<button class="btn" id="keyAdd">Create key</button></div><div id="keyOut"></div></div>' +
+      '<select id="keyKind" style="flex:0 0 auto;width:auto"><option value="ro">read-only</option>' + (me.role !== 'viewer' ? '<option value="rw">read + write</option><option value="hit">server mode (count only)</option>' : '') + '</select>' +
+      '<button class="btn" id="keyAdd">Create key</button></div>' +
+      '<div id="keySites" class="hide small muted" style="margin-top:8px"></div><div id="keyOut"></div></div>' +
       '<div class="set-card"><h3>' + ico('i-shield') + 'Password</h3>' +
       '<div class="set-inline"><input id="pwOld" type="password" placeholder="Current password" autocomplete="current-password"><input id="pwNew" type="password" placeholder="New password (10+)" autocomplete="new-password"><button class="btn ghost" id="pwSave">Change</button></div>' +
       '<p class="muted small">Changing it signs you out on all other devices.</p></div>' +
@@ -343,7 +345,7 @@
     function loadKeys() {
       call('GET', '/api/me/keys').then(function (keys) {
         $('keyList').innerHTML = keys.length ? keys.map(function (k) {
-          return '<div class="set-row"><span>' + ico('i-code') + esc(k.name) + ' <code class="muted small">' + esc(k.prefix) + '…</code>' + (k.read_only ? ' <span class="pill">read-only</span>' : ' <span class="pill">read + write</span>') + '</span>' +
+          return '<div class="set-row"><span>' + ico('i-code') + esc(k.name) + ' <code class="muted small">' + esc(k.prefix) + '…</code>' + (k.scope === 'hit' ? ' <span class="pill"><span>server mode</span> · <span data-no-i18n>' + esc(siteNames(k.sites)) + '</span></span>' : k.read_only ? ' <span class="pill">read-only</span>' : ' <span class="pill">read + write</span>') + '</span>' +
             '<span class="muted small">' + (k.last_used ? 'used ' + date(k.last_used) : 'never used') + '</span><button class="btn ghost danger mini" data-delkey="' + k.id + '">Revoke</button></div>';
         }).join('') : '<p class="muted small">No keys yet.</p>';
         $('keyList').querySelectorAll('[data-delkey]').forEach(function (b) {
@@ -352,9 +354,21 @@
       }).catch(function (e) { setErr(e.message); });
     }
     loadKeys();
+    var siteList = (window.Taci && window.Taci.sites && window.Taci.sites()) || [];
+    $('keyKind').onchange = function () {
+      var hit = this.value === 'hit';
+      $('keySites').classList.toggle('hide', !hit);
+      if (hit && !$('keySites').innerHTML) $('keySites').innerHTML = 'Reports for: ' + siteList.map(function (st) {
+        return '<label style="display:inline-flex;gap:4px;align-items:center;margin-right:10px"><input type="checkbox" class="keySite" value="' + st.id + '" style="width:auto;margin:0"' + (siteList.length === 1 ? ' checked' : '') + '>' + esc(st.domain) + '</label>';
+      }).join('');
+    };
     $('keyAdd').onclick = function () {
       setErr('');
-      call('POST', '/api/me/keys', { name: $('keyName').value.trim(), readOnly: $('keyRo') ? $('keyRo').checked : true }).then(function (k) {
+      var kind = $('keyKind').value;
+      var body = { name: $('keyName').value.trim() };
+      if (kind === 'hit') { body.scope = 'hit'; body.sites = Array.prototype.map.call(document.querySelectorAll('.keySite:checked'), function (c) { return Number(c.value); }); }
+      else body.readOnly = kind !== 'rw';
+      call('POST', '/api/me/keys', body).then(function (k) {
         $('keyName').value = '';
         $('keyOut').innerHTML = '<p class="muted small" style="margin:10px 0 4px">Copy it now — it is shown only once.</p><div class="snippet">' + esc(k.key) + '</div><button class="btn ghost mini" id="keyCopy">Copy key</button>';
         $('keyCopy').onclick = function () { navigator.clipboard.writeText(k.key); this.textContent = 'Copied ✓'; };

package/public/app.js

@@ -145,13 +145,16 @@
   function showTz() { var s = currentSite(); $('tzName').textContent = s ? String(s.timezone || 'UTC').replace(/_/g, ' ') : 'UTC'; $('tzBtn').classList.toggle('hide', !s); }
   $('tzBtn').onclick = function () {
     var s = currentSite(); if (!s) return;
-    $('tzSite').textContent = s.domain; $('tzErr').textContent = ''; fillTz($('tzSelect'), s.timezone || 'UTC');
+    $('tzSite').textContent = s.domain; $('tzErr').textContent = ''; fillTz($('tzSelect'), s.timezone || 'UTC'); $('dcFilter').checked = s.dc_filter !== 0; $('dcFilter').disabled = s.dc_active === false;
+    $('dcFilter').parentNode.style.opacity = s.dc_active === false ? '0.55' : '';
+    $('dcInfo').textContent = s.dc_active === false ? 'The filter is not running on this server right now (switched off, or the network lists have not loaded yet). Every visit is counted.'
+      : s.dc_dropped_today ? s.dc_dropped_today + ' of ' + s.dc_seen_today + ' hits from cloud networks ignored today (UTC).' : '';
     $('tzModal').classList.remove('hide'); $('tzSelect').focus();
   };
   $('cancelTz').onclick = function () { closeModal($('tzModal'), { force: true }); };
   $('saveTz').onclick = function () {
     var s = currentSite(); if (!s) return;
-    api('/api/sites/' + s.id, { method: 'PATCH', body: JSON.stringify({ timezone: $('tzSelect').value }) }).then(function (r) {
+    api('/api/sites/' + s.id, { method: 'PATCH', body: JSON.stringify($('dcFilter').disabled ? { timezone: $('tzSelect').value } : { timezone: $('tzSelect').value, dcFilter: $('dcFilter').checked }) }).then(function (r) {
       if (r.error) { $('tzErr').textContent = r.error; return; }
       closeModal($('tzModal'), { force: true });
       loadSites().then(load);

package/public/i18n.js

@@ -131,16 +131,21 @@
     'Tacilytics · open source ·': 'Tacilytics · Open Source ·',
     '· open source ·': '· Open Source ·',
     'Discard your changes?': 'Änderungen verwerfen?',
-    'Time zone': 'Zeitzone',
+    'Time zone': 'Zeitzone', 'Site settings': 'Website-Einstellungen',
+    'The filter is not running on this server right now (switched off, or the network lists have not loaded yet). Every visit is counted.': 'Der Filter läuft auf diesem Server gerade nicht (ausgeschaltet oder die Netzlisten sind noch nicht geladen). Jeder Besuch wird gezählt.',
     'Time zone (days start at midnight here)': 'Zeitzone (hier beginnt der Tag um Mitternacht)',
     'Time zone of this site — days start at midnight here': 'Zeitzone dieser Website, hier beginnt der Tag um Mitternacht',
     'Days, hours, the weekly report and alerts follow this time zone for': 'Tage, Stunden, Wochenbericht und Alarme richten sich nach dieser Zeitzone für',
+    'Ignore visits from cloud and hosting networks (scrapers). The IP is checked on arrival and never stored. iCloud Private Relay is let through; commercial VPNs and cloud desktops are not counted.': 'Besuche aus Cloud- und Hosting-Netzen ignorieren (Scraper). Die IP wird beim Eintreffen geprüft und nie gespeichert. iCloud Private Relay wird durchgelassen, kommerzielle VPNs und Cloud-Desktops werden nicht gezählt.',
     'Stored data does not change — switching back and forth is safe.': 'Gespeicherte Daten ändern sich nicht, Hin- und Herwechseln ist gefahrlos.',
     'Unique visitors per day are an approximation outside UTC: the anonymous visitor ID changes at midnight UTC.': 'Eindeutige Besucher pro Tag sind außerhalb von UTC eine Näherung: Die anonyme Besucher-ID wechselt um Mitternacht UTC.',
     'Unknown time zone': 'Unbekannte Zeitzone',
     'Direct / none': 'Direkt / keine', 'Android app': 'Android-App', 'iOS app': 'iOS-App', 'Web': 'Web',
     'For scripts, agents and the CLI (': 'Für Skripte, Agents und die CLI (',
     '). A key acts as you, sees only your sites, and cannot touch the team or your security settings. Read-only unless you untick it.': '). Ein Key handelt als du, sieht nur deine Seiten und kann weder das Team noch deine Sicherheitseinstellungen ändern. Nur lesen, außer du nimmst den Haken raus.',
+    '). A key acts as you, sees only your sites, and cannot touch the team or your security settings.': '). Ein Key handelt als du, sieht nur deine Seiten und kann weder das Team noch deine Sicherheitseinstellungen ändern.',
+    'For server mode, create a “server mode (count only)” key: it can only report page views for the sites you tick, nothing else. Never put a read + write key on a web server.': 'Für den Server-Modus legst du einen Key „Server-Modus (nur zählen)“ an: Er kann nur Seitenaufrufe für die angehakten Seiten melden, sonst nichts. Leg nie einen Key mit Schreibrechten auf einen Webserver.',
+    'server mode (count only)': 'Server-Modus (nur zählen)', 'server mode': 'Server-Modus', 'Reports for:': 'Meldet für:',
     'Signed in as': 'Angemeldet als',
     'Viewer — read only': 'Viewer: nur lesen', 'Admin — sites, share links and funnels (all or picked sites)': 'Admin: Seiten, Share-Links und Funnels (alle oder ausgewählte Seiten)', 'Owner — everything, including the team': 'Owner: alles, auch das Team',
     'In Plausible:': 'In Plausible:', 'Site settings → Imports & Exports → Export data': 'Website-Einstellungen → Imports & Exports → Export data',
@@ -163,6 +168,7 @@
     [/^Days from (.+) on already have own data — imported numbers count only before that day\.$/, 'Ab $1 gibt es schon eigene Daten. Importierte Zahlen zählen nur vor diesem Tag.'],
     [/^Left the site \(([\d.,]+k?)\)$/, 'Seite verlassen ($1)'],
     [/^(\d+)% deep$/, '$1 % tief'],
+    [/^(\d+) of (\d+) hits from cloud networks ignored today \(UTC\)\.$/, '$1 von $2 Aufrufen aus Cloud-Netzen heute ignoriert (UTC).'],
     [/^(.+) — ([\d.,]+k?) measured views$/, '$1 · $2 gemessene Aufrufe'],
     [/^· ([\d.,]+k?) sessions, top paths, 30-min session window$/, '· $1 Sitzungen, häufigste Wege, Sitzungsfenster 30 Min.'],
     [/^([\d.,]+) searches · ([\d.,]+)% without results$/, '$1 Suchen · $2 % ohne Treffer'],

package/public/index.html

@@ -9,7 +9,7 @@
 <meta name="theme-color" content="#071114">
 <link rel="preload" href="/assets/fonts/inter-latin-wght-normal.woff2" as="font" type="font/woff2" crossorigin>
 <script src="/theme.js?v=1"></script>
-<link rel="stylesheet" href="/style.css?v=2.5.0.5">
+<link rel="stylesheet" href="/style.css?v=2026102201">
 </head>
 <body>
 
@@ -221,12 +221,14 @@
   <div class="modal">
     <button type="button" class="modal-x" data-close aria-label="Close" title="Close"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-x"></use></svg></button>
     <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-timer"></use></svg></span>
-    <h2>Time zone</h2>
+    <h2>Site settings</h2>
     <p><span>Days, hours, the weekly report and alerts follow this time zone for</span> <b id="tzSite"></b></p>
     <p>Stored data does not change — switching back and forth is safe.</p>
     <p class="muted small">Unique visitors per day are an approximation outside UTC: the anonymous visitor ID changes at midnight UTC.</p>
     <div id="tzErr" class="err"></div>
     <select id="tzSelect" class="tz-select"></select>
+    <label class="check" style="display:flex;gap:8px;align-items:flex-start;margin:14px 0 4px;text-align:left"><input type="checkbox" id="dcFilter"> <span>Ignore visits from cloud and hosting networks (scrapers). The IP is checked on arrival and never stored. iCloud Private Relay is let through; commercial VPNs and cloud desktops are not counted.</span></label>
+    <p id="dcInfo" class="muted small" style="margin:0 0 10px;text-align:left"></p>
     <button class="btn" id="saveTz">Save</button>
     <button class="btn ghost" id="cancelTz" style="margin-top:10px">Cancel</button>
   </div>
@@ -389,8 +391,8 @@
 </div>
 
 <div class="tip" id="tip"></div>
-<script src="/i18n.js?v=2.2.3"></script>
-<script src="/account.js?v=2.5.6"></script>
-<script src="/app.js?v=2.7.2"></script>
+<script src="/i18n.js?v=2.2.6"></script>
+<script src="/account.js?v=2.5.9"></script>
+<script src="/app.js?v=2.7.3"></script>
 </body>
 </html>

package/server.js

@@ -24,6 +24,8 @@ for (const dir of [...new Set([process.cwd(), __dirname])]) {
 }
 
 const PORT = parseInt(process.env.PORT) || 3920;
+// Bind address. Default loopback (put TLS in front); the Docker image sets HOST=0.0.0.0 inside the container.
+const HOST = process.env.HOST || '127.0.0.1';
 const WEB_PASSWORD = process.env.WEB_PASSWORD || 'tacilytics';
 const API_KEY = process.env.API_KEY || ''; // for agents / CLI (Bearer token)
 const SESSION_SECRET = process.env.SESSION_SECRET || crypto.randomBytes(16).toString('hex');
@@ -145,11 +147,45 @@ const norm = (d) => String(d || '').toLowerCase().replace(/^www\./, '').replace(
 if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'timezone')) db.exec("ALTER TABLE sites ADD COLUMN timezone TEXT NOT NULL DEFAULT 'UTC'");
 // paused sites collect nothing (hosting: trial over / subscription ended). Only an unlimited admin or owner can pause.
 if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'paused')) db.exec('ALTER TABLE sites ADD COLUMN paused INTEGER NOT NULL DEFAULT 0');
+// datacenter filter (2.5): drop visits from cloud / hosting networks (IP checked on arrival, never stored). On by default.
+if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'dc_filter')) db.exec('ALTER TABLE sites ADD COLUMN dc_filter INTEGER NOT NULL DEFAULT 1');
 const getSiteByDomain = db.prepare('SELECT * FROM sites WHERE domain = ?');
 const insSite = db.prepare("INSERT OR IGNORE INTO sites (domain, name, created, timezone) VALUES (?, ?, ?, COALESCE(?, 'UTC'))");
 const allSites = db.prepare('SELECT * FROM sites ORDER BY domain');
 const insEvent = db.prepare(`INSERT INTO events (site_id, ts, day, path, source, referrer, country, tz, browser, os, device, lang, name, utm_medium, utm_campaign, dur, props, vh, platform, app_version)
   VALUES (@site_id, @ts, @day, @path, @source, @referrer, @country, @tz, @browser, @os, @device, @lang, @name, @utm_medium, @utm_campaign, @dur, @props, @vh, @platform, @app_version)`);
+// visit source (2.5): like GA/Plausible/Matomo, the source belongs to the VISIT, not to each page view.
+// A page view without an third-party referrer and without UTM (an internal click, a reload) inherits the
+// source of the same visitor's previous page view within 30 minutes. Server-side only (visitor hash),
+// so strict mode reads nothing new on the device.
+const VISIT_GAP = 30 * 60000;
+// The visitor hash is salted per UTC day, so a visit never spans two days: `day` is exact and lets
+// SQLite use idx_events_vh instead of scanning every event of the site in the window.
+const lastSource = db.prepare('SELECT source, utm_medium, utm_campaign FROM events INDEXED BY idx_events_vh WHERE site_id = ? AND vh = ? AND day = ? AND name IS NULL AND ts >= ? ORDER BY id DESC LIMIT 1');
+// → { source, medium, campaign }. UTM medium / campaign travel with an inherited source; a page
+// view with its own UTM keeps its own. A return from a payment provider keeps the visit's source
+// (the raw referrer column still has the host).
+function visitSource(siteId, vh, day, ts, utm, referrer, domain, medium, campaign) {
+  if (utm) return { source: utm, medium, campaign };
+  if (referrer) {
+    let h = '';
+    try { h = norm(new URL(referrer).hostname); } catch {}
+    if (h && h !== domain && !isPaymentHost(h)) return { source: h, medium, campaign };
+    if (h && h !== domain) {
+      const prev = lastSource.get(siteId, vh, day, ts - VISIT_GAP);
+      return prev ? { source: prev.source, medium: medium || prev.utm_medium, campaign: campaign || prev.utm_campaign } : { source: h, medium, campaign };
+    }
+  }
+  if (medium || campaign) {
+    // internal link with its own utm_medium / campaign but no source: keep the visit's source, use the own medium (like GA)
+    let own = false;
+    try { own = !!referrer && norm(new URL(referrer).hostname) === domain; } catch {}
+    const prev = own ? lastSource.get(siteId, vh, day, ts - VISIT_GAP) : null;
+    return { source: (prev && prev.source) || 'Direct', medium, campaign };
+  }
+  const prev = lastSource.get(siteId, vh, day, ts - VISIT_GAP);
+  return prev ? { source: prev.source || 'Direct', medium: prev.utm_medium, campaign: prev.utm_campaign } : { source: 'Direct', medium: null, campaign: null };
+}
 // engagement: attach a visit duration (seconds) to the visitor's most recent pageview for that path.
 const updDur = db.prepare(`UPDATE events SET dur = MAX(COALESCE(dur, 0), @dur), scroll = CASE WHEN @scroll IS NULL THEN scroll ELSE MAX(COALESCE(scroll, 0), @scroll) END WHERE id = (
   SELECT id FROM events WHERE site_id = @site_id AND vh = @vh AND name IS NULL AND path = @path AND ts >= @since
@@ -216,9 +252,14 @@ function appPlatform(b) {
 
 // ── UA parsing + bot filter ─────────────────────────────────────────────────
 const BOT_RE = /bot|crawl|spider|slurp|bing|google|yandex|baidu|duckduck|facebookexternal|embedly|quora|pinterest|slackbot|telegrambot|whatsapp|twitter|discordbot|preview|monitor|uptime|pingdom|lighthouse|headless|phantom|curl|wget|python-requests|axios|node-fetch|go-http/i;
+// more non-browser clients (2.5): AI / dataset scrapers and HTTP libraries without "bot" in the name
+// Split so native apps can still use a plain HTTP client: apps (with `pf`) are only checked against
+// BOT_RE + BOT_SCRAPER_RE, websites additionally against BOT_LIB_RE (React Native / OkHttp apps send `okhttp/4.x`).
+const BOT_SCRAPER_RE = /third-partyagent|facebookcatalog|datasets|scrapy|ia_archiver|archive\.org|dataprovider|selenium|puppeteer|playwright/i;
+const BOT_LIB_RE = /okhttp|java\/|libwww|httpx|aiohttp|httpclient|python-urllib|^mozilla\/5\.0$/i;
 function parseUA(ua) {
   ua = ua || '';
-  if (!ua || BOT_RE.test(ua)) return null; // drop bots/crawlers entirely
+  if (!ua || BOT_RE.test(ua) || BOT_SCRAPER_RE.test(ua) || BOT_LIB_RE.test(ua)) return null; // drop bots/crawlers entirely
   let browser = 'Other', os = 'Other', device = 'Desktop';
   if (/iPad/i.test(ua) || (/Tablet/i.test(ua) && !/Mobile/i.test(ua))) device = 'Tablet';
   else if (/Mobi|Android|iPhone|iPod/i.test(ua)) device = 'Mobile';
@@ -250,6 +291,33 @@ const { createDaySalt, dayStr } = require('./day-salt.js');
 // Daily salt: fresh random secret per UTC day in data/.day-salt (0600), never in the DB.
 // Rules and the single-process note live in day-salt.js.
 const SALT_FILE = path.join(path.dirname(DB_PATH), '.day-salt');
+const dc = require('./datacenter.js').createDatacenterCheck({ dir: path.dirname(DB_PATH) });
+dc.start();
+// A wrong proxy setup (TRUST_PROXY too low, proxy on a cloud box, server mode forwarding its own IP)
+// would make EVERY hit look like a datacenter and vanish. Count per site and hour (numbers only, no
+// IPs) and warn loudly when most of a site's traffic is being dropped.
+const dcStats = new Map();
+// per UTC day, numbers only: shown in the dashboard ("N hits from cloud networks ignored today"), so a
+// Cloud customer who never sees the server log still notices a 100 % drop. Lost on restart, that is fine.
+const dcToday = new Map();
+function dcDropped(site, dropped) {
+  const now = Date.now();
+  const hour = Math.floor(now / 3600000);
+  let st = dcStats.get(site.id);
+  if (!st || st.hour !== hour) { st = { hour, total: 0, dropped: 0, warned: false }; dcStats.set(site.id, st); }
+  st.total++; if (dropped) st.dropped++;
+  const day = dayStr(now);
+  let d = dcToday.get(site.id);
+  if (!d || d.day !== day) { d = { day, total: 0, dropped: 0 }; dcToday.set(site.id, d); }
+  d.total++; if (dropped) d.dropped++;
+  // big sites: most of the hour dropped. Small sites (a few hits an hour) never reach 20, so also warn
+  // when every one of at least 5 hits was dropped.
+  if (!st.warned && ((st.total >= 20 && st.dropped / st.total > 0.5) || (st.total >= 5 && st.dropped === st.total))) {
+    st.warned = true;
+    console.warn(`⚠️  datacenter filter: ${st.dropped} of ${st.total} hits for ${site.domain} this hour came from cloud / hosting networks and were not counted. If that is not a bot wave, check TRUST_PROXY (and the ip you send in server mode), or switch the filter off for this site.`);
+  }
+  return dropped;
+}
 const todaysSalt = createDaySalt(SALT_FILE);
 // one-time cleanup of the short-lived DB table from 03934ed: zero the pages, flush the WAL
 db.pragma('secure_delete = ON');
@@ -330,7 +398,7 @@ function collect(req, res) {
   // A bot-looking UA is still dropped, so the bot filter cannot be bypassed by just adding `pf`.
   const rawUa = req.headers['user-agent'] || '';
   let ua = parseUA(rawUa);
-  if (platform && rawUa && !BOT_RE.test(rawUa)) {
+  if (platform && rawUa && !BOT_RE.test(rawUa) && !BOT_SCRAPER_RE.test(rawUa)) {
     const dv = String(b.dv || '').toLowerCase();
     ua = { browser: 'App', os: APP_PLATFORMS[platform], device: dv === 'tablet' ? 'Tablet' : dv === 'desktop' ? 'Desktop' : (platform === 'android' || platform === 'ios') ? 'Mobile' : 'Desktop' };
   }
@@ -365,17 +433,16 @@ function collect(req, res) {
     if (dur > 0 || sc != null) updDur.run({ site_id: site.id, vh, path: pth, dur, scroll: sc, since: ts - 6 * 3600000 });
     return res.status(204).end();
   }
+  // after the bot / DNT / internal / engagement exits: only hits that would really be counted enter the statistics.
+  // (Engagement beacons from a datacenter IP only update a row that never existed, so they need no check.)
+  if (site.dc_filter && dcDropped(site, dc.isDatacenter(ip))) return res.status(204).end(); // cloud / hosting network: not a person
 
   // referrer → source host
   let referrer = String(b.r || b.referrer || '').slice(0, 512);
-  let source = 'Direct';
   const utm = String(b.s || b.utm || '').slice(0, 60);
-  if (utm) source = utm;
-  else if (referrer) {
-    try { const h = norm(new URL(referrer).hostname); if (h && h !== domain) source = h; } catch {}
-  }
-  const utmMedium = String(b.um || b.utm_medium || '').slice(0, 60).trim() || null;
-  const utmCampaign = String(b.uc || b.utm_campaign || '').slice(0, 80).trim() || null;
+  const vs = visitSource(site.id, vh, day, ts, utm, referrer, domain,
+    String(b.um || b.utm_medium || '').slice(0, 60).trim() || null, String(b.uc || b.utm_campaign || '').slice(0, 80).trim() || null);
+  const source = vs.source; const utmMedium = vs.medium; const utmCampaign = vs.campaign;
   const tz = strict ? null : (String(b.tz || '').slice(0, 60) || null);
   const lang = strict ? acceptLang(req.headers['accept-language']) : (String(b.l || b.lang || '').slice(0, 12).split(',')[0] || null);
   const name = String(b.n || b.name || '').slice(0, 80).trim() || null; // custom event / goal
@@ -402,6 +469,7 @@ const { auth, requireRole, siteAllowed, audit, grantSite, isLimited } = setupAut
   allSiteIds: () => db.prepare('SELECT id FROM sites').all().map((r) => r.id),
 });
 const adminOnly = requireRole('admin');
+const ROLE_RANK = { viewer: 1, admin: 2, owner: 3 };
 
 // share-token auth: read-only stats access scoped to exactly one site.
 // Accepted as ?share=<token>; the handler must check siteOk(req, site).
@@ -420,7 +488,14 @@ const NO_SITE = { error: 'You have no access to this site' };
 function newToken() { return crypto.randomBytes(24).toString('hex'); }
 
 // ── sites management ─────────────────────────────────────────────────────────
-const sitesListHandler = (req, res) => res.json(allSites.all().filter((st) => siteAllowed(req, st.id)));
+// dc_active: the datacenter filter really runs on this server (list + relay allowlist loaded, not switched off).
+// dc_dropped_today / dc_seen_today: hits checked and ignored today (UTC), numbers only.
+function withDcInfo(st) {
+  const d = dcToday.get(st.id);
+  const fresh = d && d.day === dayStr(Date.now());
+  return { ...st, dc_active: dc.active, dc_dropped_today: fresh ? d.dropped : 0, dc_seen_today: fresh ? d.total : 0 };
+}
+const sitesListHandler = (req, res) => res.json(allSites.all().filter((st) => siteAllowed(req, st.id)).map(withDcInfo));
 const sitesCreateHandler = (req, res) => {
   // a site-limited account (a hosting customer) never creates sites itself: the operator does, because sites are what
   // is billed and paused. Otherwise a paused customer could add a fresh, unpaused site and move the snippet (Kiro, 2.3.0).
@@ -460,20 +535,31 @@ app.patch('/api/sites/:id', adminOnly, (req, res) => {
   const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(id);
   if (!site) return res.status(404).json({ error: 'Unknown site' });
   const b = req.body || {};
+  // validate everything first, then write: a 400 must never leave a half-applied (and unaudited) change
+  if (b.paused !== undefined && isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' }); // operator's switch (hosting)
+  if (b.dcFilter !== undefined && typeof b.dcFilter !== 'boolean') return res.status(400).json({ error: 'dcFilter must be true or false' });
+  const setTz = b.timezone !== undefined || (b.paused === undefined && b.dcFilter === undefined);
+  const timezone = setTz ? TZ.validTz(String(b.timezone || '')) : null;
+  if (setTz && !timezone) return res.status(400).json({ error: 'Unknown time zone' });
+  // all writes in one transaction: either every change lands or none
+  db.transaction(() => {
   if (b.paused !== undefined) {
-    // pausing is the operator's switch (hosting: trial or subscription ended), never the customer's
-    if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
     const paused = b.paused ? 1 : 0;
     db.prepare('UPDATE sites SET paused = ? WHERE id = ?').run(paused, id);
     if (paused !== site.paused) audit(res, paused ? 'site.pause' : 'site.resume', site.domain);
   }
-  if (b.timezone !== undefined || b.paused === undefined) {
-    const timezone = TZ.validTz(String(b.timezone || ''));
-    if (!timezone) return res.status(400).json({ error: 'Unknown time zone' });
+  if (b.dcFilter !== undefined) {
+    // the site's own admin may switch it: it only decides which of their own visits are counted
+    const v = b.dcFilter ? 1 : 0;
+    db.prepare('UPDATE sites SET dc_filter = ? WHERE id = ?').run(v, id);
+    if (v !== site.dc_filter) audit(res, v ? 'site.dcfilter.on' : 'site.dcfilter.off', site.domain);
+  }
+  if (setTz) {
     db.prepare('UPDATE sites SET timezone = ? WHERE id = ?').run(timezone, id);
     if (timezone !== site.timezone) audit(res, 'site.timezone', site.domain + ': ' + site.timezone + ' → ' + timezone);
   }
-  res.json(db.prepare('SELECT * FROM sites WHERE id = ?').get(id));
+  })();
+  res.json(withDcInfo(db.prepare('SELECT * FROM sites WHERE id = ?').get(id)));
 });
 app.delete('/api/sites/:id', adminOnly, (req, res) => {
   const id = Number(req.params.id);
@@ -501,7 +587,7 @@ app.get('/api/v1', (_req, res) => res.json({
     'GET /api/v1/stats?site=&period=': 'aggregated stats (period: today|7d|30d|90d|12mo, or from=YYYY-MM-DD&to=YYYY-MM-DD)',
     'GET /api/v1/realtime?site=': 'online count, last-30-min pulse + recent events',
     'GET /api/v1/usage?month=YYYY-MM': 'page views per site in a calendar month (UTC), owner / server key only',
-    'POST /api/v1/hit': 'server mode: report a page view from your web server { domain, path, ip, ua, referrer?, lang?, purpose?, name? } (write key)',
+    'POST /api/v1/hit': 'server mode: report a page view from your web server { domain, path, ip, ua, referrer?, lang?, purpose?, name? } (server-mode key)',
   },
   filters: 'add any of country,source,page,browser,os,device,lang,medium,campaign,goal to /stats to segment',
 }));
@@ -524,9 +610,13 @@ app.post('/api/v1/sites', adminOnly, sitesCreateHandler);
 // exactly like a tracker hit and never stored.
 const net = require('net');
 const PREFETCH_RE = /prefetch|prerender/i;
-// write access needed (admin role or a non-read-only key); a read-only key is a viewer and gets 403
-app.post('/api/v1/hit', adminOnly, (req, res) => {
-  if (rateLimited('h:' + clientIp(req), 6000, 60000)) return res.status(429).json({ error: 'Too many hits' });
+// Who may report: a server-mode key (scope 'hit', recommended, bound to its sites and good for nothing else), or —
+// as in 2.4.0 — a key / sign-in with write access (admin role). A read-only key is a viewer and gets 403.
+app.post('/api/v1/hit', auth, (req, res) => {
+  const p = req.principal;
+  if (p.kind !== 'hitkey' && ROLE_RANK[p.role] < ROLE_RANK.admin) return res.status(403).json({ error: 'Use a server-mode key (Settings → API keys)' });
+  // per key, not per web-server IP: many sites behind one shared-hosting IP must not starve each other
+  if (rateLimited('h:' + (p.keyId != null ? 'k' + p.keyId : p.kind + ':' + (p.user ? p.user.id : '')), 6000, 60000)) return res.status(429).json({ error: 'Too many hits' });
   const b = req.body || {};
   const domain = norm(b.domain || b.d);
   const site = domain && getSiteByDomain.get(domain);
@@ -541,6 +631,9 @@ app.post('/api/v1/hit', adminOnly, (req, res) => {
   const ua = parseUA(rawUa);
   if (!ua) return res.status(204).end(); // bot, crawler, monitor or no user agent
   if (b.dnt === true || b.dnt === '1' || b.gpc === true || b.gpc === '1') return res.status(204).end(); // forwarded DNT / GPC (opt-in on the sending side)
+  // after prefetch / bot / DNT: server mode forwards crawlers too (Googlebot sits in cloud ranges), they must not
+  // inflate the drop statistics and trigger false TRUST_PROXY warnings
+  if (site.dc_filter && dcDropped(site, dc.isDatacenter(ip))) return res.status(204).end(); // cloud / hosting network: not a person
 
   const ts = Date.now();
   const day = dayStr(ts);
@@ -556,17 +649,17 @@ app.post('/api/v1/hit', adminOnly, (req, res) => {
 
   const referrer = String(b.referrer || b.r || '').slice(0, 512);
   const q = url.searchParams;
-  let source = 'Direct';
   const utm = String(q.get('utm_source') || q.get('ref') || '').slice(0, 60).trim();
-  if (utm) source = utm;
-  else if (referrer) { try { const h = norm(new URL(referrer).hostname); if (h && h !== domain) source = h; } catch {} }
+  const vs = visitSource(site.id, vh, day, ts, utm, referrer, domain,
+    String(q.get('utm_medium') || '').slice(0, 60).trim() || null, String(q.get('utm_campaign') || '').slice(0, 80).trim() || null);
+  const source = vs.source;
   const name = String(b.name || b.n || '').slice(0, 80).trim() || null; // optional server-side goal (e.g. Purchase)
   insEvent.run({
     site_id: site.id, ts, day, path: pth, source, referrer: referrer || null,
     country: null, tz: null, browser: ua.browser, os: ua.os, device: ua.device,
     lang: acceptLang(b.lang), name,
-    utm_medium: String(q.get('utm_medium') || '').slice(0, 60).trim() || null,
-    utm_campaign: String(q.get('utm_campaign') || '').slice(0, 80).trim() || null,
+    utm_medium: vs.medium,
+    utm_campaign: vs.campaign,
     dur: null, props: name ? sanitizeProps(b.props) : null, vh, platform: null, app_version: null,
   });
   res.status(204).end();
@@ -1471,4 +1564,4 @@ if (process.env.TACILYTICS_TEST_HOOKS === '1') {
 app.all(/^\/(api|auth)(\/|$)/, (_req, res) => res.status(404).json({ error: 'Not found' }));
 app.get('*', sendIndex);
 
-app.listen(PORT, '127.0.0.1', () => console.log(`Tacilytics on http://127.0.0.1:${PORT}${RETENTION_DAYS ? ` · retention ${RETENTION_DAYS}d` : ''}${DIGEST_WEBHOOK_URL ? ` · digest ${DIGEST_HOUR_UTC}:00 UTC` : ''}`));
+app.listen(PORT, HOST, () => console.log(`Tacilytics on http://${HOST}:${PORT}${RETENTION_DAYS ? ` · retention ${RETENTION_DAYS}d` : ''}${DIGEST_WEBHOOK_URL ? ` · digest ${DIGEST_HOUR_UTC}:00 UTC` : ''}`));