fix(analytics): bypass gatekeeper and middleware for tracking endpoints

chore: cms branding scripts
2026-02-06 23:16:52 +01:00 · 2026-02-06 23:11:57 +01:00
4 changed files with 45 additions and 15 deletions
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,19 +28,24 @@ services:
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-web.rule=Host(`${TRAEFIK_HOST}`) && !PathPrefix(`/.well-known/acme-challenge/`)"
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-web.entrypoints=web"
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-web.middlewares=redirect-https"
-      # HTTPS router
-      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.rule=Host(`${TRAEFIK_HOST}`)"
+      # HTTPS router (Protected)
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.rule=Host(`${TRAEFIK_HOST}`) && !PathPrefix(`/stats`, `/errors`)"
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.entrypoints=websecure"
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.tls.certresolver=le"
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.tls=true"
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.service=${PROJECT_NAME:-klz-cables}"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.middlewares=${PROJECT_NAME:-klz-cables}-ratelimit,${PROJECT_NAME:-klz-cables}-forward,${AUTH_MIDDLEWARE:-compress}"
+
+      # HTTPS router (Unprotected - for Analytics & Errors)
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.rule=Host(`${TRAEFIK_HOST}`) && PathPrefix(`/stats`, `/errors`)"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.service=${PROJECT_NAME:-klz-cables}"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-unprotected.middlewares=${PROJECT_NAME:-klz-cables}-ratelimit,${PROJECT_NAME:-klz-cables}-forward,compress"
+
      - "traefik.http.services.${PROJECT_NAME:-klz-cables}.loadbalancer.server.port=80"
      - "traefik.http.services.${PROJECT_NAME:-klz-cables}.loadbalancer.server.scheme=http"
-      # Forwarded Headers
-      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
-      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
-      # Middlewares
-      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.middlewares=${PROJECT_NAME:-klz-cables}-ratelimit,${PROJECT_NAME:-klz-cables}-forward,${AUTH_MIDDLEWARE:-compress}"
      - "traefik.docker.network=infra"

      # Gatekeeper Router (to show the login page)
@@ -50,6 +55,10 @@ services:
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-gatekeeper.tls=true"
      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-gatekeeper.service=${PROJECT_NAME:-klz-cables}-gatekeeper"

+      # Forwarded Headers
+      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
+
      # Middleware Definitions
      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.${PROJECT_NAME:-klz-cables}-ratelimit.ratelimit.burst=50"
--- a/middleware.ts
+++ b/middleware.ts
@@ -62,5 +62,5 @@ export default function middleware(request: NextRequest) {

 export const config = {
  // Match only internationalized pathnames
-  matcher: ['/((?!api|_next|_vercel|health|.*\\..*).*)', '/', '/(de|en)/:path*'],
+  matcher: ['/((?!api|_next|_vercel|stats|errors|health|.*\\..*).*)', '/', '/(de|en)/:path*'],
 };
--- a/package.json
+++ b/package.json
@@ -74,7 +74,11 @@
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests",
    "test:og": "vitest run tests/og-image.test.ts",
-    "cms:bootstrap": "DIRECTUS_URL=http://localhost:8055 npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:local": "DIRECTUS_URL=http://localhost:8055 npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:testing": "DIRECTUS_URL=https://cms.testing.klz-cables.com npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:staging": "DIRECTUS_URL=https://cms.staging.klz-cables.com npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:branding:prod": "DIRECTUS_URL=https://cms.klz-cables.com npx tsx --env-file=.env scripts/setup-directus-branding.ts",
+    "cms:bootstrap": "npm run cms:branding:local",
    "pdf:datasheets": "tsx ./scripts/generate-pdf-datasheets.ts",
    "pdf:datasheets:legacy": "tsx ./scripts/generate-pdf-datasheets-pdf-lib.ts",
    "cms:push:staging": "./scripts/sync-directus.sh push staging",
--- a/scripts/setup-directus-branding.ts
+++ b/scripts/setup-directus-branding.ts
@@ -124,14 +124,31 @@ async function setupBranding() {
            --v-input-border-radius: 12px !important;
            --v-input-background-color: #f8f9fa !important;
        }
+
+        /* Inject Headline via CSS to avoid raw HTML display in public_note */
+        .public-view .form::before {
+            content: 'Sustainable Energy. Industrial Reliability.';
+            display: block;
+            text-align: center;
+            font-size: 18px;
+            font-weight: 700;
+            color: #ffffff;
+            margin-bottom: 8px;
+        }
+
+        .public-view .form::after {
+            content: 'KLZ INFRASTRUCTURE ENGINE';
+            display: block;
+            text-align: center;
+            font-size: 11px;
+            font-weight: 600;
+            letter-spacing: 0.1em;
+            color: rgba(255, 255, 255, 0.5);
+            margin-top: 24px;
+        }
        `;

-    const publicNote = `
-        <div style="font-family: 'Inter', sans-serif; text-align: center; margin-top: 24px;">
-            <p style="color: rgba(255,255,255,0.7); font-size: 14px; margin-bottom: 4px; font-weight: 500;">KLZ INFRASTRUCTURE ENGINE</p>
-            <h1 style="color: #ffffff; font-size: 18px; font-weight: 700; margin: 0;">Sustainable Energy. <span style="color: #82ed20;">Industrial Reliability.</span></h1>
-        </div>
-        `;
+    const publicNote = '';

    await client.request(
      updateSettings({
Author	SHA1	Message	Date
Marc Mintel	d5eb20a341	fix(analytics): bypass gatekeeper and middleware for tracking endpoints Some checks failed Build & Deploy KLZ Cables / 🔍 Prepare Environment (push) Successful in 7s Details Build & Deploy KLZ Cables / 🧪 Quality Assurance (push) Successful in 1m37s Details Build & Deploy KLZ Cables / 🏗️ Build App (push) Successful in 9m13s Details Build & Deploy KLZ Cables / 🚀 Deploy (push) Successful in 28s Details Build & Deploy KLZ Cables / ⚡ PageSpeed (push) Failing after 2m44s Details Build & Deploy KLZ Cables / 🔔 Notifications (push) Successful in 2s Details	2026-02-06 23:16:52 +01:00
Marc Mintel	333111f03b	chore: cms branding scripts	2026-02-06 23:11:57 +01:00