site: first-party, cookieless visit stats (self-hosted Umami at storebound.dev/s/, Do Not Track respected) with events for copy buttons, desktop downloads per OS, the teaser (play, 50 %, complete) and outbound docs / git / npm links; a privacy note in the footer; docs/site-analytics.md and tools/vds/ configs to rebuild the server side; scrub allows a page's public stats website id

tools/vds/apache-stats.crt.fyi.conf

@@ -0,0 +1,26 @@
+# stats.crt.fyi: the Umami dashboard (/opt/umami, 127.0.0.1:3920). Behind Cloudflare (*.crt.fyi wildcard DNS + cert).
+<VirtualHost *:80>
+  ServerName stats.crt.fyi
+  Redirect permanent / https://stats.crt.fyi/
+</VirtualHost>
+<VirtualHost *:443>
+  ServerName stats.crt.fyi
+  SSLEngine on
+  SSLCertificateFile /etc/letsencrypt/live/crt.fyi/fullchain.pem
+  SSLCertificateKeyFile /etc/letsencrypt/live/crt.fyi/privkey.pem
+  Include /etc/letsencrypt/options-ssl-apache.conf
+  Header always set Strict-Transport-Security "max-age=63072000"
+  Header always set X-Robots-Tag "noindex, nofollow"
+  ProxyRequests Off
+  ProxyPreserveHost On
+  RemoteIPHeader CF-Connecting-IP
+  # RemoteIPTrustedProxy lines from https://www.cloudflare.com/ips-v4 and ips-v6 (docs/site-analytics.md)
+  Include /etc/apache2/cloudflare-trusted-proxies.conf
+  RequestHeader set X-Sb-Client "expr=%{REMOTE_ADDR}"
+  RequestHeader set X-Forwarded-Proto "https"
+  Header always set Cache-Control "no-store"
+  ProxyPass / http://127.0.0.1:3920/ retry=0 timeout=60
+  ProxyPassReverse / http://127.0.0.1:3920/
+  ErrorLog  ${APACHE_LOG_DIR}/stats.crt.fyi-error.log
+  CustomLog ${APACHE_LOG_DIR}/stats.crt.fyi-access.log combined
+</VirtualHost>