fix(analytics): bypass gatekeeper and middleware for tracking endpoints

.env

@@ -2,7 +2,7 @@
 NODE_ENV=production
 NEXT_PUBLIC_BASE_URL=https://klz-cables.com
 UMAMI_API_ENDPOINT=https://analytics.infra.mintel.me
-UMAMI_WEBSITE_ID=59a7db94-0100-4c7e-98ef-99f45b17f9c3
+NEXT_PUBLIC_UMAMI_WEBSITE_ID=59a7db94-0100-4c7e-98ef-99f45b17f9c3
 SENTRY_DSN=https://c10957d0182245b1a2a806ac2d34a197@errors.infra.mintel.me/1
 LOG_LEVEL=info
 

.env.example

@@ -20,7 +20,7 @@ TARGET=development
 # Analytics (Umami)
 # ────────────────────────────────────────────────────────────────────────────
 # Optional: Leave empty to disable analytics
-UMAMI_WEBSITE_ID=
+NEXT_PUBLIC_UMAMI_WEBSITE_ID=
 UMAMI_API_ENDPOINT=https://analytics.infra.mintel.me
 
 # ────────────────────────────────────────────────────────────────────────────

.env.production

@@ -12,7 +12,7 @@ NODE_ENV=production
 NEXT_PUBLIC_BASE_URL=https://klz-cables.com
 
 # Analytics (Umami)
-UMAMI_WEBSITE_ID=
+NEXT_PUBLIC_UMAMI_WEBSITE_ID=
 UMAMI_API_ENDPOINT=https://analytics.infra.mintel.me
 
 # Error Tracking (GlitchTip/Sentry)

.gitea/workflows/deploy.yml

@@ -198,7 +198,7 @@ jobs:
           IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
           TARGET:    ${{ needs.prepare.outputs.target }}
           NEXT_PUBLIC_BASE_URL:          ${{ needs.prepare.outputs.next_public_base_url }}
-          UMAMI_WEBSITE_ID:  ${{ needs.prepare.outputs.target == 'production' && secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID  || (needs.prepare.outputs.target == 'staging' && secrets.STAGING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.TESTING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID) }}
+          NEXT_PUBLIC_UMAMI_WEBSITE_ID:  ${{ needs.prepare.outputs.target == 'production' && secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID  || (needs.prepare.outputs.target == 'staging' && secrets.STAGING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.TESTING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID) }}
           UMAMI_API_ENDPOINT:  ${{ needs.prepare.outputs.target == 'production' && secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL  || (needs.prepare.outputs.target == 'staging' && secrets.STAGING_NEXT_PUBLIC_UMAMI_SCRIPT_URL  || secrets.TESTING_NEXT_PUBLIC_UMAMI_SCRIPT_URL  || secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL) }}
           DIRECTUS_URL:                  ${{ needs.prepare.outputs.directus_url }}
         run: |
@@ -206,7 +206,7 @@ jobs:
             --pull \
             --platform linux/arm64 \
             --build-arg NEXT_PUBLIC_BASE_URL="$NEXT_PUBLIC_BASE_URL" \
-            --build-arg UMAMI_WEBSITE_ID="$UMAMI_WEBSITE_ID" \
+            --build-arg NEXT_PUBLIC_UMAMI_WEBSITE_ID="$NEXT_PUBLIC_UMAMI_WEBSITE_ID" \
             --build-arg UMAMI_API_ENDPOINT="$UMAMI_API_ENDPOINT" \
             --build-arg NEXT_PUBLIC_TARGET="$TARGET" \
             --build-arg DIRECTUS_URL="$DIRECTUS_URL" \
@@ -231,7 +231,7 @@ jobs:
       ENV_FILE:             ${{ needs.prepare.outputs.env_file }}
       TRAEFIK_HOST:         ${{ needs.prepare.outputs.traefik_host }}
       NEXT_PUBLIC_BASE_URL:          ${{ needs.prepare.outputs.next_public_base_url }}
-      UMAMI_WEBSITE_ID:  ${{ needs.prepare.outputs.target == 'production' && secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID  || (needs.prepare.outputs.target == 'staging' && secrets.STAGING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.TESTING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID) }}
+      NEXT_PUBLIC_UMAMI_WEBSITE_ID:  ${{ needs.prepare.outputs.target == 'production' && secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID  || (needs.prepare.outputs.target == 'staging' && secrets.STAGING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.TESTING_NEXT_PUBLIC_UMAMI_WEBSITE_ID  || secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID) }}
       UMAMI_API_ENDPOINT:  ${{ needs.prepare.outputs.target == 'production' && secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL  || (needs.prepare.outputs.target == 'staging' && secrets.STAGING_NEXT_PUBLIC_UMAMI_SCRIPT_URL  || secrets.TESTING_NEXT_PUBLIC_UMAMI_SCRIPT_URL  || secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL) }}
       SENTRY_DSN:                    ${{ secrets.SENTRY_DSN                    || vars.SENTRY_DSN                    || (needs.prepare.outputs.target == 'production' && secrets.SENTRY_DSN                    || (needs.prepare.outputs.target == 'staging' && secrets.STAGING_SENTRY_DSN                    || secrets.TESTING_SENTRY_DSN                    || secrets.SENTRY_DSN)) }}
       MAIL_HOST:                     ${{ secrets.MAIL_HOST || vars.MAIL_HOST || (needs.prepare.outputs.target == 'production' && (secrets.MAIL_HOST || vars.MAIL_HOST) || (needs.prepare.outputs.target == 'staging' && (secrets.STAGING_MAIL_HOST || vars.STAGING_MAIL_HOST) || (secrets.TESTING_MAIL_HOST || vars.TESTING_MAIL_HOST) || (secrets.MAIL_HOST || vars.MAIL_HOST))) }}
@@ -273,7 +273,7 @@ jobs:
           NODE_ENV=production
           NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
           NEXT_PUBLIC_TARGET=$TARGET
-          UMAMI_WEBSITE_ID=$UMAMI_WEBSITE_ID
+          NEXT_PUBLIC_UMAMI_WEBSITE_ID=$NEXT_PUBLIC_UMAMI_WEBSITE_ID
           UMAMI_API_ENDPOINT=$UMAMI_API_ENDPOINT
           SENTRY_DSN=$SENTRY_DSN
           LOG_LEVEL=$( [[ "$TARGET" == "testing" || "$TARGET" == "development" ]] && echo "debug" || echo "info" )

Dockerfile

@@ -26,7 +26,6 @@ ENV NEXT_TELEMETRY_DISABLED=1
 # These are baked into the client bundle during build
 ARG NEXT_PUBLIC_BASE_URL
 ARG NEXT_PUBLIC_BASE_URL
-ARG UMAMI_WEBSITE_ID
 ARG NEXT_PUBLIC_UMAMI_WEBSITE_ID
 ARG UMAMI_API_ENDPOINT
 ARG UMAMI_SCRIPT_URL
@@ -35,7 +34,7 @@ ARG NEXT_PUBLIC_TARGET
 ARG DIRECTUS_URL
 
 ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
-ENV UMAMI_WEBSITE_ID=${UMAMI_WEBSITE_ID:-$NEXT_PUBLIC_UMAMI_WEBSITE_ID}
+ENV NEXT_PUBLIC_UMAMI_WEBSITE_ID=$NEXT_PUBLIC_UMAMI_WEBSITE_ID
 ENV UMAMI_API_ENDPOINT=${UMAMI_API_ENDPOINT:-${UMAMI_SCRIPT_URL:-$NEXT_PUBLIC_UMAMI_SCRIPT_URL}}
 ENV NEXT_PUBLIC_TARGET=$NEXT_PUBLIC_TARGET
 ENV DIRECTUS_URL=$DIRECTUS_URL

docker-compose.yml

@@ -28,19 +28,24 @@ services:
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-web.rule=Host(`${TRAEFIK_HOST}`) && !PathPrefix(`/.well-known/acme-challenge/`)"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-web.entrypoints=web"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-web.middlewares=redirect-https"
-      # HTTPS router
-      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.rule=Host(`${TRAEFIK_HOST}`)"
+      # HTTPS router (Protected)
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.rule=Host(`${TRAEFIK_HOST}`) && !PathPrefix(`/stats`, `/errors`)"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.entrypoints=websecure"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.tls.certresolver=le"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.tls=true"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.service=${PROJECT_NAME:-klz-cables}"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.middlewares=${PROJECT_NAME:-klz-cables}-ratelimit,${PROJECT_NAME:-klz-cables}-forward,${AUTH_MIDDLEWARE:-compress}"
+
+      # HTTPS router (Unprotected - for Analytics & Errors)
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.rule=Host(`${TRAEFIK_HOST}`) && PathPrefix(`/stats`, `/errors`)"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.service=${PROJECT_NAME:-klz-cables}"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.middlewares=${PROJECT_NAME:-klz-cables}-ratelimit,${PROJECT_NAME:-klz-cables}-forward,compress"
+
       - "traefik.http.services.${PROJECT_NAME:-klz-cables}.loadbalancer.server.port=80"
       - "traefik.http.services.${PROJECT_NAME:-klz-cables}.loadbalancer.server.scheme=http"
-      # Forwarded Headers
-      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
-      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
-      # Middlewares
-      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.middlewares=${PROJECT_NAME:-klz-cables}-ratelimit,${PROJECT_NAME:-klz-cables}-forward,${AUTH_MIDDLEWARE:-compress}"
       - "traefik.docker.network=infra"
 
       # Gatekeeper Router (to show the login page)
@@ -50,6 +55,10 @@ services:
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-gatekeeper.tls=true"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-gatekeeper.service=${PROJECT_NAME:-klz-cables}-gatekeeper"
 
+      # Forwarded Headers
+      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
+
       # Middleware Definitions
       - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-ratelimit.ratelimit.average=100"
       - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-ratelimit.ratelimit.burst=50"

lib/config.ts

@@ -27,9 +27,9 @@ function createConfig() {
 
     analytics: {
       umami: {
-        websiteId: env.UMAMI_WEBSITE_ID,
+        websiteId: env.NEXT_PUBLIC_UMAMI_WEBSITE_ID,
         apiEndpoint: env.UMAMI_API_ENDPOINT,
-        enabled: Boolean(env.UMAMI_WEBSITE_ID),
+        enabled: Boolean(env.NEXT_PUBLIC_UMAMI_WEBSITE_ID),
       },
     },
 

lib/env.ts

@@ -15,7 +15,7 @@ export const envSchema = z
     NEXT_PUBLIC_TARGET: z.enum(['development', 'testing', 'staging', 'production']).optional(),
 
     // Analytics
-    UMAMI_WEBSITE_ID: z.preprocess(preprocessEmptyString, z.string().optional()),
+    NEXT_PUBLIC_UMAMI_WEBSITE_ID: z.preprocess(preprocessEmptyString, z.string().optional()),
     UMAMI_API_ENDPOINT: z.preprocess(
       preprocessEmptyString,
       z.string().url().default('https://analytics.infra.mintel.me'),
@@ -82,7 +82,8 @@ export function getRawEnv() {
     NODE_ENV: process.env.NODE_ENV,
     NEXT_PUBLIC_BASE_URL: process.env.NEXT_PUBLIC_BASE_URL,
     NEXT_PUBLIC_TARGET: process.env.NEXT_PUBLIC_TARGET,
-    UMAMI_WEBSITE_ID: process.env.UMAMI_WEBSITE_ID || process.env.NEXT_PUBLIC_UMAMI_WEBSITE_ID,
+    NEXT_PUBLIC_UMAMI_WEBSITE_ID:
+      process.env.NEXT_PUBLIC_UMAMI_WEBSITE_ID || process.env.UMAMI_WEBSITE_ID,
     UMAMI_API_ENDPOINT:
       process.env.UMAMI_API_ENDPOINT ||
       process.env.UMAMI_SCRIPT_URL ||

lib/mail/mailer.test.ts

@@ -47,7 +47,7 @@ describe('mailer', () => {
       });
 
       expect(result.success).toBe(false);
-      expect((result.error as Error).message).toContain('MAIL_HOST is not configured');
+      expect(result.error).toContain('MAIL_HOST is not configured');
 
       // Restore host
       (config.mail as any).host = originalHost;

middleware.ts

@@ -62,5 +62,5 @@ export default function middleware(request: NextRequest) {
 
 export const config = {
   // Match only internationalized pathnames
-  matcher: ['/((?!api|_next|_vercel|health|.*\\..*).*)', '/', '/(de|en)/:path*'],
+  matcher: ['/((?!api|_next|_vercel|stats|errors|health|.*\\..*).*)', '/', '/(de|en)/:path*'],
 };

package.json

@@ -74,7 +74,11 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests",
     "test:og": "vitest run tests/og-image.test.ts",
-    "cms:bootstrap": "DIRECTUS_URL=http://localhost:8055 npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:local": "DIRECTUS_URL=http://localhost:8055 npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:testing": "DIRECTUS_URL=https://cms.testing.klz-cables.com npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:staging": "DIRECTUS_URL=https://cms.staging.klz-cables.com npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:prod": "DIRECTUS_URL=https://cms.klz-cables.com npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:bootstrap": "npm run cms:branding:local",
     "pdf:datasheets": "tsx ./scripts/generate-pdf-datasheets.ts",
     "pdf:datasheets:legacy": "tsx ./scripts/generate-pdf-datasheets-pdf-lib.ts",
     "cms:push:staging": "./scripts/sync-directus.sh push staging",

scripts/setup-directus-branding.ts

@@ -124,14 +124,31 @@ async function setupBranding() {
             --v-input-border-radius: 12px !important;
             --v-input-background-color: #f8f9fa !important;
         }
+
+        /* Inject Headline via CSS to avoid raw HTML display in public_note */
+        .public-view .form::before {
+            content: 'Sustainable Energy. Industrial Reliability.';
+            display: block;
+            text-align: center;
+            font-size: 18px;
+            font-weight: 700;
+            color: #ffffff;
+            margin-bottom: 8px;
+        }
+
+        .public-view .form::after {
+            content: 'KLZ INFRASTRUCTURE ENGINE';
+            display: block;
+            text-align: center;
+            font-size: 11px;
+            font-weight: 600;
+            letter-spacing: 0.1em;
+            color: rgba(255, 255, 255, 0.5);
+            margin-top: 24px;
+        }
         `;
 
-    const publicNote = `
-        <div style="font-family: 'Inter', sans-serif; text-align: center; margin-top: 24px;">
-            <p style="color: rgba(255,255,255,0.7); font-size: 14px; margin-bottom: 4px; font-weight: 500;">KLZ INFRASTRUCTURE ENGINE</p>
-            <h1 style="color: #ffffff; font-size: 18px; font-weight: 700; margin: 0;">Sustainable Energy. <span style="color: #82ed20;">Industrial Reliability.</span></h1>
-        </div>
-        `;
+    const publicNote = '';
 
     await client.request(
       updateSettings({