tacilytics 2.4.1 → 2.5.0

package/README.md

@@ -14,7 +14,11 @@
 ![No tracking](https://img.shields.io/badge/IPs%20stored-never-67e8f9)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-4ade80)
 
-<img src="docs/dashboard.png" width="820" alt="Tacilytics dashboard" />
+**[▶ Live demo](https://demo.tacilytics.com)** · **[Website](https://tacilytics.com)** · **[Hosted cloud](https://cloud.tacilytics.com)** · **[Quick start](#quick-start)**
+
+<a href="https://demo.tacilytics.com"><img src="docs/dashboard.png" width="820" alt="Tacilytics dashboard — open the live demo" /></a>
+
+<sub>The demo shows a fictional shop with generated data. No real visitors.</sub>
 
 </div>
 
@@ -29,7 +33,7 @@
 - 🚦 **Campaigns & funnels.** Full UTM (`source` / `medium` / `campaign`), entry & exit pages, **goal conversion rates** and **custom event properties**.
 - ⏱️ **Engagement time** — average time-on-page, measured privately (visible seconds only, no extra identifier).
 - 🤖 **Bots & crawlers dropped** automatically, so your numbers stay honest.
-- ⚡ **~2 KB tracker**, SPA-aware (tracks `pushState` / `popstate` route changes), optional **DNT / Global Privacy Control** honoring.
+- ⚡ **~5 KB tracker** (gzip, 14 KB raw, includes the strict mode, goals and revenue), SPA-aware (tracks `pushState` / `popstate` route changes), optional **DNT / Global Privacy Control** honoring.
 - 🗓️ **Data minimisation built in** — optional auto-purge of raw events after a retention window you choose.
 - 🎯 **Custom events & goals**, **live visitors**, **trends**, **custom date ranges**, **CSV export**.
 - 🛰️ **Agent-ready:** a clean `/api/v1` REST API (with segmentation params) + a `tacilytics` CLI (with `--json`).
@@ -47,6 +51,16 @@ npx tacilytics serve      # http://127.0.0.1:3920 — data/ and .env live in thi
 Or install it globally: `npm i -g tacilytics`, then `tacilytics serve`.
 Set your own `WEB_PASSWORD`, `SESSION_SECRET`, `INGEST_SALT` and `API_KEY` in a `.env` file in that folder (see [`.env.example`](.env.example)).
 
+**With Docker:**
+
+```bash
+git clone https://github.com/Open-Cosmic-Software/tacilytics.git && cd tacilytics
+cp .env.example .env     # set WEB_PASSWORD, SESSION_SECRET, INGEST_SALT, API_KEY
+docker compose up -d     # http://127.0.0.1:3920 — data lives in the tacilytics-data volume
+```
+
+The container listens on `0.0.0.0` inside, compose publishes it on `127.0.0.1` only. Outside Docker, set `HOST` to change the bind address.
+
 **From source:**
 
 ```bash
@@ -321,6 +335,28 @@ devices. You get the 95 % that matters (how many, which pages, from where) witho
 the same approach as Plausible/Fathom. Whether you still need consent depends on your
 jurisdiction and setup; strict mode (`data-strict`) reduces the device reads further.
 
+**Sources per visit.** Like GA, Plausible and Matomo, the source belongs to the visit: an internal
+click or a reload inherits the source of the same visitor's previous page view within 30 minutes,
+instead of showing up as *Direct*. This happens on the server (daily visitor hash), so strict mode
+works the same and nothing extra is read on the device.
+
+**Bots and scrapers.** Known crawler, AI-scraper and HTTP-library user agents are dropped. Scrapers
+that pretend to be a normal browser usually run in a cloud: by default, visits from cloud and hosting
+networks are ignored too (list: [X4BNet/lists_vpn](https://github.com/X4BNet/lists_vpn) *datacenter*,
+MIT, downloaded once a day — no visitor data leaves your server). The IP is checked on arrival and
+never stored. iCloud Private Relay runs on the same cloud networks, so Apple's published egress list is
+downloaded too and always let through; without it the filter stays off (with a fixed local list via
+`TACILYTICS_DATACENTER_FILE` it runs anyway — set `TACILYTICS_RELAY_FILE` too, the server warns at start).
+A list that looks wrong (an IPv4 range shorter than /8 or IPv6 shorter than /24, more than 25 % of IPv4
+or 0.1 % of global IPv6, a known residential address inside) is refused, and a failed download of either
+list is retried with backoff. The site settings show how many hits were ignored today and grey the
+switch out while the filter is not running. Honest trade-off: commercial VPNs, Opera's built-in VPN and
+cloud desktops (Windows 365, AVD) are not counted either — for B2B sites consider switching it off.
+If more than half of a site's hits in an hour are dropped (or all of at least 5 on a small site), the
+server log warns (usually a proxy setup: check `TRUST_PROXY`). Switch it off per site in the site
+settings (clock button), or for the whole server
+with `TACILYTICS_DATACENTER=off`.
+
 ## Light mode & German
 
 Settings → Security → **Appearance**: *Theme* (System / Light / Dark) and *Language* (Automatic / English / Deutsch), saved per browser. *System* follows the device's light/dark setting live; *Automatic* picks German when the browser is German. Your data (paths, sources, event names) is never translated.
@@ -372,6 +408,9 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 | `SMTP_URL` / `REPORT_FROM` | — | Mail server + sender for the weekly report |
 | `REPORT_HOUR_UTC` | `6` | Monday hour (UTC) the weekly report goes out; it covers the last 7 full days in each site's time zone |
 | `AUDIT_RETENTION_DAYS` | `365` | How long the team activity log is kept (min. 30) |
+| `TACILYTICS_DATACENTER` | on | `off` disables the cloud / hosting network filter server-wide (no list download) |
+| `TACILYTICS_DATACENTER_FILE` | — | Use local range lists instead of the daily download (comma-separated paths, CIDR per line), e.g. for offline installs |
+| `TACILYTICS_RELAY_FILE` | — | Local copy of Apple's iCloud Private Relay egress CSV (with a local datacenter list) |
 | `DATA_RETENTION_DAYS` | `0` | `0` = keep forever; `>0` purges raw events older than N days, daily (data minimisation) |
 
 ## Privacy & security
@@ -392,17 +431,28 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 - All visitor-supplied values are HTML-escaped before they reach the DOM.
 - Run behind TLS; keep `.env` at `chmod 600`.
 
-## Tacilytics vs. Google Analytics
+## How it compares
 
-| | Tacilytics | Google Analytics |
-|---|---|---|
-| Cookies | ❌ none | ✅ yes |
-| Reads from the device | a few (time zone, language, window size, one localStorage flag); none in strict mode | ✅ a lot |
-| Works without any script on the visitor's device | ✅ server mode | ❌ |
-| Stores IPs / personal data | ❌ never | ✅ yes |
-| Self-hosted, you own the data | ✅ | ❌ |
-| Weight | ~2 KB | ~45 KB+ |
-| Setup | 1 script + 1 process | tag manager, config… |
+An honest overview. Plausible and Umami are good projects; pick what fits you.
+
+| | Tacilytics | Plausible CE | Umami | Google Analytics 4 |
+|---|---|---|---|---|
+| Cookies | ❌ none | ❌ none | ❌ none | ✅ yes |
+| IPs leave your server | ❌ never | ❌ | ❌ | ✅ sent to Google |
+| No script on the device at all | ✅ server mode | ❌ | ❌ | ❌ |
+| Strict mode (no device reads) | ✅ | ❌ | ❌ | ❌ |
+| Mobile app SDK | ✅ Flutter | ❌ | ❌ | ✅ |
+| Runs on | Node + SQLite file | Elixir + Postgres + ClickHouse | Node + Postgres/MySQL | Google |
+| Tracker size (gzip) | ~5 KB | ~1 KB | ~2 KB | ~45 KB+ |
+| Built for big traffic (millions/day) | ⚠️ not yet, SQLite | ✅ | ✅ | ✅ |
+| Self-hosted, you own the data | ✅ | ✅ | ✅ | ❌ |
+| Licence | MIT | AGPL | MIT | proprietary |
+
+*As of October 2026, to the best of our knowledge. Spot a mistake? Please [open an issue](https://github.com/Open-Cosmic-Software/tacilytics/issues).*
+
+## Contributing
+
+Issues, ideas and pull requests are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md). Security reports go [privately](SECURITY.md).
 
 ## Credits
 
@@ -410,6 +460,8 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 - Brand marks: [Simple Icons](https://simpleicons.org) (CC0). Brand names and logos are trademarks of their owners; see `public/assets/DISCLAIMER-simple-icons.md`. Windows and Edge have no free official mark, so a neutral icon is shown.
 - Flags: [flag-icons](https://flagicons.lipis.dev) (MIT)
 - Font: [Inter](https://rsms.me/inter/) (SIL OFL 1.1), self-hosted
+- Datacenter ranges: [X4BNet/lists_vpn](https://github.com/X4BNet/lists_vpn) (MIT), downloaded at runtime, not bundled
+- iCloud Private Relay egress ranges: published by Apple (`mask-api.icloud.com`), downloaded at runtime as an allowlist
 
 ## License
 

package/auth.js

@@ -226,17 +226,25 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     res.on('finish', () => {
       if (res.statusCode < 200 || res.statusCode >= 300) return;
       try {
-        const a = res.locals.audit || {};
+        // one row per named action (a single save can change several things, e.g. time zone + filter)
+        const list = res.locals.audits && res.locals.audits.length ? res.locals.audits : [{}];
         const route = req.route ? req.route.path : req.path;
-        const action = a.action || `${req.method} ${route}`;
-        const actor = a.actor !== undefined ? a.actor : actorOf(req.principal);
-        insAudit.run(Date.now(), actor, action, a.target == null ? null : String(a.target).slice(0, 200), clientIp(req));
+        const ts = Date.now();
+        for (const a of list) {
+          const action = a.action || `${req.method} ${route}`;
+          const actor = a.actor !== undefined ? a.actor : actorOf(req.principal);
+          insAudit.run(ts, actor, action, a.target == null ? null : String(a.target).slice(0, 200), clientIp(req));
+        }
       } catch (e) { console.error('audit log:', e.message); }
     });
     next();
   });
   setInterval(() => db.prepare('DELETE FROM audit_log WHERE ts < ?').run(Date.now() - AUDIT_DAYS * 864e5), 6 * 3600e3).unref();
-  const audit = (res, action, target, actor) => { res.locals.audit = { action, target, ...(actor !== undefined ? { actor } : {}) }; };
+  const audit = (res, action, target, actor) => {
+    const a = { action, target, ...(actor !== undefined ? { actor } : {}) };
+    res.locals.audit = a;
+    (res.locals.audits || (res.locals.audits = [])).push(a);
+  };
   if (hasUsers() && !process.env.TACILYTICS_ORIGIN) {
     console.warn('⚠️  TACILYTICS_ORIGIN is not set. Passkeys use the request host, so they break if the dashboard is reached under another host/port or behind a proxy without X-Forwarded-Proto. Set it to the public dashboard URL.');
   }

package/datacenter.js

@@ -0,0 +1,232 @@
+'use strict';
+// Datacenter IP check (2.5). Scrapers that pretend to be a normal Chrome on a Mac pass every
+// user-agent filter, but people do not browse from cloud servers. Like Plausible, the visitor IP is
+// checked once on arrival against public lists of hosting / cloud networks and never stored.
+//
+// List: X4BNet/lists_vpn "datacenter" output (MIT, https://github.com/X4BNet/lists_vpn), refreshed once
+// a day into the data directory. Nothing about visitors leaves the server: we only download the list.
+// If no list is available (offline install, first start without network) the check is off and every
+// visit counts — losing real visitors is worse than counting a few bots.
+const fs = require('fs');
+const net = require('net');
+
+const DEFAULT_URLS = [
+  'https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv4.txt',
+  'https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv6.txt',
+];
+// iCloud Private Relay runs on Akamai / Fastly / Cloudflare networks that the datacenter list contains.
+// Those are real Safari visitors, so Apple's published egress ranges are an allowlist checked first.
+const RELAY_URL = 'https://mask-api.icloud.com/egress-ip-ranges.csv';
+
+// sanity limits: a broken or hostile list must never be able to drop everyone
+const MIN_BITS_V4 = 8;
+const MIN_BITS_V6 = 24; // the real list's largest IPv6 prefix is /24
+const MAX_V4_SHARE = 0.25; // today ~9 % of the IPv4 space
+const MAX_V6_SHARE = 0.001; // of global unicast 2000::/3, today ~12 ppm
+// residential / ISP addresses that must never be inside a datacenter list (Telekom, Vodafone, Comcast, Telekom v6)
+// IPv6: Telekom, Vodafone, T-Mobile, 1&1, O2
+const CANARIES = ['79.192.0.1', '84.150.3.3', '91.64.1.1', '73.0.0.1',
+  '2003::1', '2a02:8108::1', '2a01:598::1', '2001:16b8::1', '2a02:3030::1'];
+
+function v4ToInt(ip) {
+  const p = ip.split('.');
+  return ((+p[0] << 24) >>> 0) + (+p[1] << 16) + (+p[2] << 8) + +p[3];
+}
+function v6ToBig(ip) {
+  // expand "::" and an embedded IPv4 tail, then read 8 groups of 16 bits
+  let s = ip.toLowerCase();
+  const v4 = s.match(/(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4) { const n = v4ToInt(v4[1]); s = s.slice(0, -v4[1].length) + ((n >>> 16).toString(16)) + ':' + ((n & 0xffff).toString(16)); }
+  const [head, tail] = s.split('::');
+  const h = head ? head.split(':') : [];
+  const t = tail !== undefined ? (tail ? tail.split(':') : []) : [];
+  const groups = tail !== undefined ? [...h, ...Array(8 - h.length - t.length).fill('0'), ...t] : h;
+  let x = 0n;
+  for (const g of groups) x = (x << 16n) + BigInt(parseInt(g || '0', 16));
+  return x;
+}
+
+// parse "a.b.c.d/nn" and "x::/nn" lines into sorted, merged [start, end] ranges
+function parseList(text, { minV4 = MIN_BITS_V4, minV6 = MIN_BITS_V6 } = {}) {
+  const v4 = []; const v6 = [];
+  for (const raw of String(text).split('\n')) {
+    const line = raw.split('#')[0].trim();
+    if (!line) continue;
+    const [addrRaw, bitsS, extra] = line.split(',')[0].trim().split('/');
+    const addr = addrRaw.trim();
+    if (extra !== undefined) continue;
+    if (bitsS !== undefined && !/^\d{1,3}$/.test(bitsS)) continue; // "1.2.3.4/" must not become /0
+    const kind = net.isIP(addr);
+    if (kind === 4) {
+      const bits = bitsS === undefined ? 32 : +bitsS;
+      if (!(bits >= minV4 && bits <= 32)) continue;
+      const size = 2 ** (32 - bits);
+      const start = Math.floor(v4ToInt(addr) / size) * size;
+      v4.push([start, start + size - 1]);
+    } else if (kind === 6) {
+      const bits = bitsS === undefined ? 128 : +bitsS;
+      if (!(bits >= minV6 && bits <= 128)) continue;
+      const host = 128n - BigInt(bits);
+      const start = (v6ToBig(addr) >> host) << host;
+      v6.push([start, start + (1n << host) - 1n]);
+    }
+  }
+  const merge = (arr) => {
+    arr.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+    const out = [];
+    for (const r of arr) {
+      const last = out[out.length - 1];
+      if (last && r[0] <= last[1] + (typeof r[0] === 'bigint' ? 1n : 1)) { if (r[1] > last[1]) last[1] = r[1]; } else out.push([r[0], r[1]]);
+    }
+    return out;
+  };
+  return { v4: merge(v4), v6: merge(v6) };
+}
+
+function inRanges(ranges, x) {
+  let lo = 0; let hi = ranges.length - 1;
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1;
+    if (x < ranges[mid][0]) hi = mid - 1;
+    else if (x > ranges[mid][1]) lo = mid + 1;
+    else return true;
+  }
+  return false;
+}
+
+function v4Share(l) { let n = 0; for (const [a, b] of l.v4) n += b - a + 1; return n / 2 ** 32; }
+// share of global unicast 2000::/3 (2^125 addresses), counted only for the part inside it
+function v6Share(l) {
+  const lo = 0x2n << 124n; const hi = lo + (1n << 125n) - 1n;
+  let n = 0n;
+  for (const [a, b] of l.v6) { const s = a > lo ? a : lo; const e = b < hi ? b : hi; if (e >= s) n += e - s + 1n; }
+  return Number((n * 1000000n) >> 125n) / 1e6;
+}
+
+// Reject a whole list that looks wrong instead of trusting it. Returns an error text or null.
+function validate(l) {
+  if (!l.v4.length && !l.v6.length) return 'no ranges';
+  const share = v4Share(l);
+  if (share > MAX_V4_SHARE) return `covers ${(share * 100).toFixed(1)} % of IPv4 (limit ${MAX_V4_SHARE * 100} %)`;
+  const share6 = v6Share(l);
+  if (share6 > MAX_V6_SHARE) return `covers ${(share6 * 100).toFixed(3)} % of global IPv6 (limit ${MAX_V6_SHARE * 100} %)`;
+  for (const c of CANARIES) if (lookup(l, c)) return 'contains residential address ' + c;
+  return null;
+}
+function lookup(l, ip) {
+  const kind = net.isIP(ip);
+  if (kind === 4) return inRanges(l.v4, v4ToInt(ip));
+  if (kind === 6) return inRanges(l.v6, v6ToBig(ip));
+  return false;
+}
+// Apple relay CSV: "prefix,country,region,city,". Relay prefixes are small, no minimum length.
+// One pass over the ~12 MB file: keep only the prefix column and count the well-formed lines.
+function parseRelay(text) {
+  const t = String(text);
+  const out = [];
+  let lines = 0;
+  let i = 0;
+  let comma = -1; // reused across lines: a file without commas must not rescan to the end for every line
+  if (t.charCodeAt(0) === 0xfeff) i = 1; // byte-order mark
+  while (i < t.length) {
+    let nl = t.indexOf('\n', i); if (nl < 0) nl = t.length;
+    if (comma < i && comma !== -2) { comma = t.indexOf(',', i); if (comma < 0) comma = -2; }
+    if (comma > i && comma < nl) {
+      const prefix = t.slice(i, comma);
+      if (/^[0-9a-fA-F:.]+\/\d{1,3}$/.test(prefix)) { out.push(prefix); lines++; }
+    }
+    i = nl + 1;
+  }
+  const r = parseList(out.join('\n'), { minV4: 0, minV6: 0 });
+  r.lines = lines;
+  return r;
+}
+
+function createDatacenterCheck({ dir, mode = process.env.TACILYTICS_DATACENTER, files = process.env.TACILYTICS_DATACENTER_FILE,
+  relayFile = process.env.TACILYTICS_RELAY_FILE, log = console } = {}) {
+  let list = { v4: [], v6: [] };
+  let relay = { v4: [], v6: [] };
+  let loaded = false;
+  let loadedAt = 0;
+  let retryMs = 5 * 60000;
+  const off = String(mode || '').toLowerCase() === 'off';
+  const P = require('path');
+  const cache = dir ? P.join(dir, '.datacenter-ranges.txt') : null;
+  const relayCache = dir ? P.join(dir, '.relay-ranges.csv') : null;
+  const say = (k, m) => { if (log[k]) log[k]('datacenter check: ' + m); };
+
+  function use(text, from) {
+    const l = parseList(text);
+    const bad = validate(l);
+    if (bad) { say('warn', `list from ${from} rejected (${bad})` + (loaded ? ', keeping the last list' : ', filter stays off')); return false; }
+    list = l; loaded = true; loadedAt = Date.now();
+    say('info', `${l.v4.length} IPv4 + ${l.v6.length} IPv6 ranges (${from}, ${(v4Share(l) * 100).toFixed(1)} % of IPv4)`);
+    return true;
+  }
+  function useRelay(text, from) {
+    const r = parseRelay(text);
+    if (r.lines < 100) { say('warn', `relay list from ${from} too short, ignored`); return false; }
+    relay = { v4: r.v4, v6: r.v6 };
+    say('info', `${r.v4.length} IPv4 + ${r.v6.length} IPv6 iCloud Private Relay ranges allowed (${from})`);
+    return true;
+  }
+  const writeCache = (f, text) => { if (!f) return; const tmp = f + '.tmp'; fs.writeFileSync(tmp, text, { mode: 0o600 }); fs.renameSync(tmp, f); };
+  async function get(u) {
+    const r = await fetch(u, { signal: AbortSignal.timeout(30000) });
+    if (!r.ok) throw new Error(u + ' → HTTP ' + r.status);
+    return r.text();
+  }
+  let timer = null;
+  function schedule(ms) { if (timer) clearTimeout(timer); timer = setTimeout(refresh, ms); if (timer.unref) timer.unref(); }
+  async function refresh() {
+    if (off) return;
+    let ok = true;
+    try {
+      const text = (await Promise.all(DEFAULT_URLS.map(get))).join('\n');
+      if (use(text, 'download')) writeCache(cache, text); else ok = false;
+    } catch (e) { ok = false; say('warn', 'refresh failed (' + e.message + ')' + (loaded ? ', keeping the last list' : ', filter stays off until a list loads')); }
+    try { const t = await get(RELAY_URL); if (useRelay(t, 'download')) writeCache(relayCache, t); else ok = false; } catch (e) { ok = false; say('warn', 'relay list refresh failed (' + e.message + ')'); }
+    // without the relay allowlist the filter is off, so a missing relay list is a failure too
+    if (!relay.v4.length && !relay.v6.length) ok = false;
+    // retry with backoff while something failed, otherwise once a day
+    if (ok) { retryMs = 5 * 60000; schedule(24 * 3600 * 1000); } else { schedule(retryMs); retryMs = Math.min(retryMs * 4, 6 * 3600 * 1000); }
+  }
+  function start() {
+    if (off) { say('info', 'off (TACILYTICS_DATACENTER=off)'); return; }
+    if (relayFile) { try { useRelay(fs.readFileSync(relayFile, 'utf8'), 'file'); } catch (e) { say('warn', 'relay file: ' + e.message); } }
+    if (files) {
+      // fixed local list (offline installs, tests): no download
+      if (!relayFile) say('warn', 'TACILYTICS_DATACENTER_FILE without TACILYTICS_RELAY_FILE: iCloud Private Relay visitors inside the list will be dropped');
+      try { use(String(files).split(',').map((f) => fs.readFileSync(f.trim(), 'utf8')).join('\n'), 'file'); } catch (e) { say('warn', 'list file: ' + e.message); }
+      return;
+    }
+    let fresh = false;
+    let relayOk = false;
+    if (relayCache && fs.existsSync(relayCache)) { try { relayOk = useRelay(fs.readFileSync(relayCache, 'utf8'), 'cache'); } catch {} }
+    if (cache && fs.existsSync(cache)) {
+      try {
+        // clamp: a cache file with a future mtime must not give a negative age (timer overflow)
+        const age = Math.max(0, Date.now() - fs.statSync(cache).mtimeMs);
+        if (use(fs.readFileSync(cache, 'utf8'), 'cache')) { loadedAt = Date.now() - age; fresh = relayOk && age < 24 * 3600 * 1000; }
+        if (age > 7 * 24 * 3600 * 1000) say('warn', `cached list is ${Math.round(age / 86400000)} days old`);
+      } catch {}
+    }
+    if (fresh) schedule(Math.max(1000, 24 * 3600 * 1000 - (Date.now() - loadedAt))); else refresh();
+  }
+  function isDatacenter(ip) {
+    if (!loaded) return false;
+    let s = String(ip || '').split('%')[0].toLowerCase();
+    if (s.startsWith('::ffff:') && net.isIPv4(s.slice(7))) s = s.slice(7);
+    if (!net.isIP(s)) return false;
+    // without Apple's relay allowlist the datacenter list would drop iCloud Private Relay users
+    // (Akamai / Fastly egress): then the filter stays off. Only a fixed local list may run without it.
+    if (!relay.v4.length && !relay.v6.length && !files) return false;
+    if (lookup(relay, s)) return false; // iCloud Private Relay = a real person
+    return lookup(list, s);
+  }
+  // active = the filter really drops something right now (list loaded and, unless a fixed file is used, the relay allowlist too)
+  const active = () => !off && loaded && (!!files || relay.v4.length > 0 || relay.v6.length > 0);
+  return { start, refresh, isDatacenter, get loaded() { return loaded; }, get loadedAt() { return loadedAt; }, get active() { return active(); }, get off() { return off; } };
+}
+
+module.exports = { createDatacenterCheck, _test: { parseList, parseRelay, validate, inRanges, v4ToInt, v6ToBig, v6Share, MIN_BITS_V6 } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tacilytics",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "Privacy-first, cookieless analytics for websites and apps. Self-hosted: one Node process, one SQLite file.",
   "main": "server.js",
   "type": "commonjs",
@@ -49,6 +49,7 @@
     "server.js",
     "cli.js",
     "day-salt.js",
+    "datacenter.js",
     "auth.js",
     "importers.js",
     "report.js",

package/public/app.js

@@ -145,13 +145,16 @@
   function showTz() { var s = currentSite(); $('tzName').textContent = s ? String(s.timezone || 'UTC').replace(/_/g, ' ') : 'UTC'; $('tzBtn').classList.toggle('hide', !s); }
   $('tzBtn').onclick = function () {
     var s = currentSite(); if (!s) return;
-    $('tzSite').textContent = s.domain; $('tzErr').textContent = ''; fillTz($('tzSelect'), s.timezone || 'UTC');
+    $('tzSite').textContent = s.domain; $('tzErr').textContent = ''; fillTz($('tzSelect'), s.timezone || 'UTC'); $('dcFilter').checked = s.dc_filter !== 0; $('dcFilter').disabled = s.dc_active === false;
+    $('dcFilter').parentNode.style.opacity = s.dc_active === false ? '0.55' : '';
+    $('dcInfo').textContent = s.dc_active === false ? 'The filter is not running on this server right now (switched off, or the network lists have not loaded yet). Every visit is counted.'
+      : s.dc_dropped_today ? s.dc_dropped_today + ' of ' + s.dc_seen_today + ' hits from cloud networks ignored today (UTC).' : '';
     $('tzModal').classList.remove('hide'); $('tzSelect').focus();
   };
   $('cancelTz').onclick = function () { closeModal($('tzModal'), { force: true }); };
   $('saveTz').onclick = function () {
     var s = currentSite(); if (!s) return;
-    api('/api/sites/' + s.id, { method: 'PATCH', body: JSON.stringify({ timezone: $('tzSelect').value }) }).then(function (r) {
+    api('/api/sites/' + s.id, { method: 'PATCH', body: JSON.stringify($('dcFilter').disabled ? { timezone: $('tzSelect').value } : { timezone: $('tzSelect').value, dcFilter: $('dcFilter').checked }) }).then(function (r) {
       if (r.error) { $('tzErr').textContent = r.error; return; }
       closeModal($('tzModal'), { force: true });
       loadSites().then(load);

package/public/i18n.js

@@ -131,10 +131,12 @@
     'Tacilytics · open source ·': 'Tacilytics · Open Source ·',
     '· open source ·': '· Open Source ·',
     'Discard your changes?': 'Änderungen verwerfen?',
-    'Time zone': 'Zeitzone',
+    'Time zone': 'Zeitzone', 'Site settings': 'Website-Einstellungen',
+    'The filter is not running on this server right now (switched off, or the network lists have not loaded yet). Every visit is counted.': 'Der Filter läuft auf diesem Server gerade nicht (ausgeschaltet oder die Netzlisten sind noch nicht geladen). Jeder Besuch wird gezählt.',
     'Time zone (days start at midnight here)': 'Zeitzone (hier beginnt der Tag um Mitternacht)',
     'Time zone of this site — days start at midnight here': 'Zeitzone dieser Website, hier beginnt der Tag um Mitternacht',
     'Days, hours, the weekly report and alerts follow this time zone for': 'Tage, Stunden, Wochenbericht und Alarme richten sich nach dieser Zeitzone für',
+    'Ignore visits from cloud and hosting networks (scrapers). The IP is checked on arrival and never stored. iCloud Private Relay is let through; commercial VPNs and cloud desktops are not counted.': 'Besuche aus Cloud- und Hosting-Netzen ignorieren (Scraper). Die IP wird beim Eintreffen geprüft und nie gespeichert. iCloud Private Relay wird durchgelassen, kommerzielle VPNs und Cloud-Desktops werden nicht gezählt.',
     'Stored data does not change — switching back and forth is safe.': 'Gespeicherte Daten ändern sich nicht, Hin- und Herwechseln ist gefahrlos.',
     'Unique visitors per day are an approximation outside UTC: the anonymous visitor ID changes at midnight UTC.': 'Eindeutige Besucher pro Tag sind außerhalb von UTC eine Näherung: Die anonyme Besucher-ID wechselt um Mitternacht UTC.',
     'Unknown time zone': 'Unbekannte Zeitzone',
@@ -166,6 +168,7 @@
     [/^Days from (.+) on already have own data — imported numbers count only before that day\.$/, 'Ab $1 gibt es schon eigene Daten. Importierte Zahlen zählen nur vor diesem Tag.'],
     [/^Left the site \(([\d.,]+k?)\)$/, 'Seite verlassen ($1)'],
     [/^(\d+)% deep$/, '$1 % tief'],
+    [/^(\d+) of (\d+) hits from cloud networks ignored today \(UTC\)\.$/, '$1 von $2 Aufrufen aus Cloud-Netzen heute ignoriert (UTC).'],
     [/^(.+) — ([\d.,]+k?) measured views$/, '$1 · $2 gemessene Aufrufe'],
     [/^· ([\d.,]+k?) sessions, top paths, 30-min session window$/, '· $1 Sitzungen, häufigste Wege, Sitzungsfenster 30 Min.'],
     [/^([\d.,]+) searches · ([\d.,]+)% without results$/, '$1 Suchen · $2 % ohne Treffer'],

package/public/index.html

@@ -9,7 +9,7 @@
 <meta name="theme-color" content="#071114">
 <link rel="preload" href="/assets/fonts/inter-latin-wght-normal.woff2" as="font" type="font/woff2" crossorigin>
 <script src="/theme.js?v=1"></script>
-<link rel="stylesheet" href="/style.css?v=2.5.0.5">
+<link rel="stylesheet" href="/style.css?v=2026102201">
 </head>
 <body>
 
@@ -221,12 +221,14 @@
   <div class="modal">
     <button type="button" class="modal-x" data-close aria-label="Close" title="Close"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-x"></use></svg></button>
     <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-timer"></use></svg></span>
-    <h2>Time zone</h2>
+    <h2>Site settings</h2>
     <p><span>Days, hours, the weekly report and alerts follow this time zone for</span> <b id="tzSite"></b></p>
     <p>Stored data does not change — switching back and forth is safe.</p>
     <p class="muted small">Unique visitors per day are an approximation outside UTC: the anonymous visitor ID changes at midnight UTC.</p>
     <div id="tzErr" class="err"></div>
     <select id="tzSelect" class="tz-select"></select>
+    <label class="check" style="display:flex;gap:8px;align-items:flex-start;margin:14px 0 4px;text-align:left"><input type="checkbox" id="dcFilter"> <span>Ignore visits from cloud and hosting networks (scrapers). The IP is checked on arrival and never stored. iCloud Private Relay is let through; commercial VPNs and cloud desktops are not counted.</span></label>
+    <p id="dcInfo" class="muted small" style="margin:0 0 10px;text-align:left"></p>
     <button class="btn" id="saveTz">Save</button>
     <button class="btn ghost" id="cancelTz" style="margin-top:10px">Cancel</button>
   </div>
@@ -389,8 +391,8 @@
 </div>
 
 <div class="tip" id="tip"></div>
-<script src="/i18n.js?v=2.2.5"></script>
+<script src="/i18n.js?v=2.2.6"></script>
 <script src="/account.js?v=2.5.9"></script>
-<script src="/app.js?v=2.7.2"></script>
+<script src="/app.js?v=2.7.3"></script>
 </body>
 </html>

package/server.js

@@ -24,6 +24,8 @@ for (const dir of [...new Set([process.cwd(), __dirname])]) {
 }
 
 const PORT = parseInt(process.env.PORT) || 3920;
+// Bind address. Default loopback (put TLS in front); the Docker image sets HOST=0.0.0.0 inside the container.
+const HOST = process.env.HOST || '127.0.0.1';
 const WEB_PASSWORD = process.env.WEB_PASSWORD || 'tacilytics';
 const API_KEY = process.env.API_KEY || ''; // for agents / CLI (Bearer token)
 const SESSION_SECRET = process.env.SESSION_SECRET || crypto.randomBytes(16).toString('hex');
@@ -145,11 +147,45 @@ const norm = (d) => String(d || '').toLowerCase().replace(/^www\./, '').replace(
 if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'timezone')) db.exec("ALTER TABLE sites ADD COLUMN timezone TEXT NOT NULL DEFAULT 'UTC'");
 // paused sites collect nothing (hosting: trial over / subscription ended). Only an unlimited admin or owner can pause.
 if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'paused')) db.exec('ALTER TABLE sites ADD COLUMN paused INTEGER NOT NULL DEFAULT 0');
+// datacenter filter (2.5): drop visits from cloud / hosting networks (IP checked on arrival, never stored). On by default.
+if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'dc_filter')) db.exec('ALTER TABLE sites ADD COLUMN dc_filter INTEGER NOT NULL DEFAULT 1');
 const getSiteByDomain = db.prepare('SELECT * FROM sites WHERE domain = ?');
 const insSite = db.prepare("INSERT OR IGNORE INTO sites (domain, name, created, timezone) VALUES (?, ?, ?, COALESCE(?, 'UTC'))");
 const allSites = db.prepare('SELECT * FROM sites ORDER BY domain');
 const insEvent = db.prepare(`INSERT INTO events (site_id, ts, day, path, source, referrer, country, tz, browser, os, device, lang, name, utm_medium, utm_campaign, dur, props, vh, platform, app_version)
   VALUES (@site_id, @ts, @day, @path, @source, @referrer, @country, @tz, @browser, @os, @device, @lang, @name, @utm_medium, @utm_campaign, @dur, @props, @vh, @platform, @app_version)`);
+// visit source (2.5): like GA/Plausible/Matomo, the source belongs to the VISIT, not to each page view.
+// A page view without an third-party referrer and without UTM (an internal click, a reload) inherits the
+// source of the same visitor's previous page view within 30 minutes. Server-side only (visitor hash),
+// so strict mode reads nothing new on the device.
+const VISIT_GAP = 30 * 60000;
+// The visitor hash is salted per UTC day, so a visit never spans two days: `day` is exact and lets
+// SQLite use idx_events_vh instead of scanning every event of the site in the window.
+const lastSource = db.prepare('SELECT source, utm_medium, utm_campaign FROM events INDEXED BY idx_events_vh WHERE site_id = ? AND vh = ? AND day = ? AND name IS NULL AND ts >= ? ORDER BY id DESC LIMIT 1');
+// → { source, medium, campaign }. UTM medium / campaign travel with an inherited source; a page
+// view with its own UTM keeps its own. A return from a payment provider keeps the visit's source
+// (the raw referrer column still has the host).
+function visitSource(siteId, vh, day, ts, utm, referrer, domain, medium, campaign) {
+  if (utm) return { source: utm, medium, campaign };
+  if (referrer) {
+    let h = '';
+    try { h = norm(new URL(referrer).hostname); } catch {}
+    if (h && h !== domain && !isPaymentHost(h)) return { source: h, medium, campaign };
+    if (h && h !== domain) {
+      const prev = lastSource.get(siteId, vh, day, ts - VISIT_GAP);
+      return prev ? { source: prev.source, medium: medium || prev.utm_medium, campaign: campaign || prev.utm_campaign } : { source: h, medium, campaign };
+    }
+  }
+  if (medium || campaign) {
+    // internal link with its own utm_medium / campaign but no source: keep the visit's source, use the own medium (like GA)
+    let own = false;
+    try { own = !!referrer && norm(new URL(referrer).hostname) === domain; } catch {}
+    const prev = own ? lastSource.get(siteId, vh, day, ts - VISIT_GAP) : null;
+    return { source: (prev && prev.source) || 'Direct', medium, campaign };
+  }
+  const prev = lastSource.get(siteId, vh, day, ts - VISIT_GAP);
+  return prev ? { source: prev.source || 'Direct', medium: prev.utm_medium, campaign: prev.utm_campaign } : { source: 'Direct', medium: null, campaign: null };
+}
 // engagement: attach a visit duration (seconds) to the visitor's most recent pageview for that path.
 const updDur = db.prepare(`UPDATE events SET dur = MAX(COALESCE(dur, 0), @dur), scroll = CASE WHEN @scroll IS NULL THEN scroll ELSE MAX(COALESCE(scroll, 0), @scroll) END WHERE id = (
   SELECT id FROM events WHERE site_id = @site_id AND vh = @vh AND name IS NULL AND path = @path AND ts >= @since
@@ -216,9 +252,14 @@ function appPlatform(b) {
 
 // ── UA parsing + bot filter ─────────────────────────────────────────────────
 const BOT_RE = /bot|crawl|spider|slurp|bing|google|yandex|baidu|duckduck|facebookexternal|embedly|quora|pinterest|slackbot|telegrambot|whatsapp|twitter|discordbot|preview|monitor|uptime|pingdom|lighthouse|headless|phantom|curl|wget|python-requests|axios|node-fetch|go-http/i;
+// more non-browser clients (2.5): AI / dataset scrapers and HTTP libraries without "bot" in the name
+// Split so native apps can still use a plain HTTP client: apps (with `pf`) are only checked against
+// BOT_RE + BOT_SCRAPER_RE, websites additionally against BOT_LIB_RE (React Native / OkHttp apps send `okhttp/4.x`).
+const BOT_SCRAPER_RE = /third-partyagent|facebookcatalog|datasets|scrapy|ia_archiver|archive\.org|dataprovider|selenium|puppeteer|playwright/i;
+const BOT_LIB_RE = /okhttp|java\/|libwww|httpx|aiohttp|httpclient|python-urllib|^mozilla\/5\.0$/i;
 function parseUA(ua) {
   ua = ua || '';
-  if (!ua || BOT_RE.test(ua)) return null; // drop bots/crawlers entirely
+  if (!ua || BOT_RE.test(ua) || BOT_SCRAPER_RE.test(ua) || BOT_LIB_RE.test(ua)) return null; // drop bots/crawlers entirely
   let browser = 'Other', os = 'Other', device = 'Desktop';
   if (/iPad/i.test(ua) || (/Tablet/i.test(ua) && !/Mobile/i.test(ua))) device = 'Tablet';
   else if (/Mobi|Android|iPhone|iPod/i.test(ua)) device = 'Mobile';
@@ -250,6 +291,33 @@ const { createDaySalt, dayStr } = require('./day-salt.js');
 // Daily salt: fresh random secret per UTC day in data/.day-salt (0600), never in the DB.
 // Rules and the single-process note live in day-salt.js.
 const SALT_FILE = path.join(path.dirname(DB_PATH), '.day-salt');
+const dc = require('./datacenter.js').createDatacenterCheck({ dir: path.dirname(DB_PATH) });
+dc.start();
+// A wrong proxy setup (TRUST_PROXY too low, proxy on a cloud box, server mode forwarding its own IP)
+// would make EVERY hit look like a datacenter and vanish. Count per site and hour (numbers only, no
+// IPs) and warn loudly when most of a site's traffic is being dropped.
+const dcStats = new Map();
+// per UTC day, numbers only: shown in the dashboard ("N hits from cloud networks ignored today"), so a
+// Cloud customer who never sees the server log still notices a 100 % drop. Lost on restart, that is fine.
+const dcToday = new Map();
+function dcDropped(site, dropped) {
+  const now = Date.now();
+  const hour = Math.floor(now / 3600000);
+  let st = dcStats.get(site.id);
+  if (!st || st.hour !== hour) { st = { hour, total: 0, dropped: 0, warned: false }; dcStats.set(site.id, st); }
+  st.total++; if (dropped) st.dropped++;
+  const day = dayStr(now);
+  let d = dcToday.get(site.id);
+  if (!d || d.day !== day) { d = { day, total: 0, dropped: 0 }; dcToday.set(site.id, d); }
+  d.total++; if (dropped) d.dropped++;
+  // big sites: most of the hour dropped. Small sites (a few hits an hour) never reach 20, so also warn
+  // when every one of at least 5 hits was dropped.
+  if (!st.warned && ((st.total >= 20 && st.dropped / st.total > 0.5) || (st.total >= 5 && st.dropped === st.total))) {
+    st.warned = true;
+    console.warn(`⚠️  datacenter filter: ${st.dropped} of ${st.total} hits for ${site.domain} this hour came from cloud / hosting networks and were not counted. If that is not a bot wave, check TRUST_PROXY (and the ip you send in server mode), or switch the filter off for this site.`);
+  }
+  return dropped;
+}
 const todaysSalt = createDaySalt(SALT_FILE);
 // one-time cleanup of the short-lived DB table from 03934ed: zero the pages, flush the WAL
 db.pragma('secure_delete = ON');
@@ -330,7 +398,7 @@ function collect(req, res) {
   // A bot-looking UA is still dropped, so the bot filter cannot be bypassed by just adding `pf`.
   const rawUa = req.headers['user-agent'] || '';
   let ua = parseUA(rawUa);
-  if (platform && rawUa && !BOT_RE.test(rawUa)) {
+  if (platform && rawUa && !BOT_RE.test(rawUa) && !BOT_SCRAPER_RE.test(rawUa)) {
     const dv = String(b.dv || '').toLowerCase();
     ua = { browser: 'App', os: APP_PLATFORMS[platform], device: dv === 'tablet' ? 'Tablet' : dv === 'desktop' ? 'Desktop' : (platform === 'android' || platform === 'ios') ? 'Mobile' : 'Desktop' };
   }
@@ -365,17 +433,16 @@ function collect(req, res) {
     if (dur > 0 || sc != null) updDur.run({ site_id: site.id, vh, path: pth, dur, scroll: sc, since: ts - 6 * 3600000 });
     return res.status(204).end();
   }
+  // after the bot / DNT / internal / engagement exits: only hits that would really be counted enter the statistics.
+  // (Engagement beacons from a datacenter IP only update a row that never existed, so they need no check.)
+  if (site.dc_filter && dcDropped(site, dc.isDatacenter(ip))) return res.status(204).end(); // cloud / hosting network: not a person
 
   // referrer → source host
   let referrer = String(b.r || b.referrer || '').slice(0, 512);
-  let source = 'Direct';
   const utm = String(b.s || b.utm || '').slice(0, 60);
-  if (utm) source = utm;
-  else if (referrer) {
-    try { const h = norm(new URL(referrer).hostname); if (h && h !== domain) source = h; } catch {}
-  }
-  const utmMedium = String(b.um || b.utm_medium || '').slice(0, 60).trim() || null;
-  const utmCampaign = String(b.uc || b.utm_campaign || '').slice(0, 80).trim() || null;
+  const vs = visitSource(site.id, vh, day, ts, utm, referrer, domain,
+    String(b.um || b.utm_medium || '').slice(0, 60).trim() || null, String(b.uc || b.utm_campaign || '').slice(0, 80).trim() || null);
+  const source = vs.source; const utmMedium = vs.medium; const utmCampaign = vs.campaign;
   const tz = strict ? null : (String(b.tz || '').slice(0, 60) || null);
   const lang = strict ? acceptLang(req.headers['accept-language']) : (String(b.l || b.lang || '').slice(0, 12).split(',')[0] || null);
   const name = String(b.n || b.name || '').slice(0, 80).trim() || null; // custom event / goal
@@ -421,7 +488,14 @@ const NO_SITE = { error: 'You have no access to this site' };
 function newToken() { return crypto.randomBytes(24).toString('hex'); }
 
 // ── sites management ─────────────────────────────────────────────────────────
-const sitesListHandler = (req, res) => res.json(allSites.all().filter((st) => siteAllowed(req, st.id)));
+// dc_active: the datacenter filter really runs on this server (list + relay allowlist loaded, not switched off).
+// dc_dropped_today / dc_seen_today: hits checked and ignored today (UTC), numbers only.
+function withDcInfo(st) {
+  const d = dcToday.get(st.id);
+  const fresh = d && d.day === dayStr(Date.now());
+  return { ...st, dc_active: dc.active, dc_dropped_today: fresh ? d.dropped : 0, dc_seen_today: fresh ? d.total : 0 };
+}
+const sitesListHandler = (req, res) => res.json(allSites.all().filter((st) => siteAllowed(req, st.id)).map(withDcInfo));
 const sitesCreateHandler = (req, res) => {
   // a site-limited account (a hosting customer) never creates sites itself: the operator does, because sites are what
   // is billed and paused. Otherwise a paused customer could add a fresh, unpaused site and move the snippet (Kiro, 2.3.0).
@@ -461,20 +535,31 @@ app.patch('/api/sites/:id', adminOnly, (req, res) => {
   const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(id);
   if (!site) return res.status(404).json({ error: 'Unknown site' });
   const b = req.body || {};
+  // validate everything first, then write: a 400 must never leave a half-applied (and unaudited) change
+  if (b.paused !== undefined && isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' }); // operator's switch (hosting)
+  if (b.dcFilter !== undefined && typeof b.dcFilter !== 'boolean') return res.status(400).json({ error: 'dcFilter must be true or false' });
+  const setTz = b.timezone !== undefined || (b.paused === undefined && b.dcFilter === undefined);
+  const timezone = setTz ? TZ.validTz(String(b.timezone || '')) : null;
+  if (setTz && !timezone) return res.status(400).json({ error: 'Unknown time zone' });
+  // all writes in one transaction: either every change lands or none
+  db.transaction(() => {
   if (b.paused !== undefined) {
-    // pausing is the operator's switch (hosting: trial or subscription ended), never the customer's
-    if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
     const paused = b.paused ? 1 : 0;
     db.prepare('UPDATE sites SET paused = ? WHERE id = ?').run(paused, id);
     if (paused !== site.paused) audit(res, paused ? 'site.pause' : 'site.resume', site.domain);
   }
-  if (b.timezone !== undefined || b.paused === undefined) {
-    const timezone = TZ.validTz(String(b.timezone || ''));
-    if (!timezone) return res.status(400).json({ error: 'Unknown time zone' });
+  if (b.dcFilter !== undefined) {
+    // the site's own admin may switch it: it only decides which of their own visits are counted
+    const v = b.dcFilter ? 1 : 0;
+    db.prepare('UPDATE sites SET dc_filter = ? WHERE id = ?').run(v, id);
+    if (v !== site.dc_filter) audit(res, v ? 'site.dcfilter.on' : 'site.dcfilter.off', site.domain);
+  }
+  if (setTz) {
     db.prepare('UPDATE sites SET timezone = ? WHERE id = ?').run(timezone, id);
     if (timezone !== site.timezone) audit(res, 'site.timezone', site.domain + ': ' + site.timezone + ' → ' + timezone);
   }
-  res.json(db.prepare('SELECT * FROM sites WHERE id = ?').get(id));
+  })();
+  res.json(withDcInfo(db.prepare('SELECT * FROM sites WHERE id = ?').get(id)));
 });
 app.delete('/api/sites/:id', adminOnly, (req, res) => {
   const id = Number(req.params.id);
@@ -546,6 +631,9 @@ app.post('/api/v1/hit', auth, (req, res) => {
   const ua = parseUA(rawUa);
   if (!ua) return res.status(204).end(); // bot, crawler, monitor or no user agent
   if (b.dnt === true || b.dnt === '1' || b.gpc === true || b.gpc === '1') return res.status(204).end(); // forwarded DNT / GPC (opt-in on the sending side)
+  // after prefetch / bot / DNT: server mode forwards crawlers too (Googlebot sits in cloud ranges), they must not
+  // inflate the drop statistics and trigger false TRUST_PROXY warnings
+  if (site.dc_filter && dcDropped(site, dc.isDatacenter(ip))) return res.status(204).end(); // cloud / hosting network: not a person
 
   const ts = Date.now();
   const day = dayStr(ts);
@@ -561,17 +649,17 @@ app.post('/api/v1/hit', auth, (req, res) => {
 
   const referrer = String(b.referrer || b.r || '').slice(0, 512);
   const q = url.searchParams;
-  let source = 'Direct';
   const utm = String(q.get('utm_source') || q.get('ref') || '').slice(0, 60).trim();
-  if (utm) source = utm;
-  else if (referrer) { try { const h = norm(new URL(referrer).hostname); if (h && h !== domain) source = h; } catch {} }
+  const vs = visitSource(site.id, vh, day, ts, utm, referrer, domain,
+    String(q.get('utm_medium') || '').slice(0, 60).trim() || null, String(q.get('utm_campaign') || '').slice(0, 80).trim() || null);
+  const source = vs.source;
   const name = String(b.name || b.n || '').slice(0, 80).trim() || null; // optional server-side goal (e.g. Purchase)
   insEvent.run({
     site_id: site.id, ts, day, path: pth, source, referrer: referrer || null,
     country: null, tz: null, browser: ua.browser, os: ua.os, device: ua.device,
     lang: acceptLang(b.lang), name,
-    utm_medium: String(q.get('utm_medium') || '').slice(0, 60).trim() || null,
-    utm_campaign: String(q.get('utm_campaign') || '').slice(0, 80).trim() || null,
+    utm_medium: vs.medium,
+    utm_campaign: vs.campaign,
     dur: null, props: name ? sanitizeProps(b.props) : null, vh, platform: null, app_version: null,
   });
   res.status(204).end();
@@ -1476,4 +1564,4 @@ if (process.env.TACILYTICS_TEST_HOOKS === '1') {
 app.all(/^\/(api|auth)(\/|$)/, (_req, res) => res.status(404).json({ error: 'Not found' }));
 app.get('*', sendIndex);
 
-app.listen(PORT, '127.0.0.1', () => console.log(`Tacilytics on http://127.0.0.1:${PORT}${RETENTION_DAYS ? ` · retention ${RETENTION_DAYS}d` : ''}${DIGEST_WEBHOOK_URL ? ` · digest ${DIGEST_HOUR_UTC}:00 UTC` : ''}`));
+app.listen(PORT, HOST, () => console.log(`Tacilytics on http://${HOST}:${PORT}${RETENTION_DAYS ? ` · retention ${RETENTION_DAYS}d` : ''}${DIGEST_WEBHOOK_URL ? ` · digest ${DIGEST_HOUR_UTC}:00 UTC` : ''}`));