Matomo

I have been searching online for alternatives to Google Analytics. The result would mean analytics for all my applications and websites, but FREE. I wanted the ability to track the people to access my site and see some minimal analytics for my own purposes without paying an arm and a leg. I used similar paid tool at work, but I wanted to make sure my running costs for things were as low as can be, even if it requires a bit more maintenance work.

Matomo came up frequently in my research, so I decided to give it a try. It is a mature PHP-based application with numerous features for analytics and marketing, serving as a full replacement for Google Analytics! They do offer some premium features, but nothing an average power user should need.

Assumptions

You have knowledge of ports and networking. You know how to use Docker and Docker Compose. You can set up and point your domain to an application. You know how to use environment variables and how to change them. You use another application that handles SSL certificates for your domain. You have the knowledge to adjust the information in this page for your specific use case, as you know everything may not work out-of-the-box on your host.

Setup

Matomo was actually very easy to set up. This is the docker-compose.yml that I used to deploy it to my host.

networks:
  net:
    external: false
services:
  db:
    image: mariadb:10.11 # Or mysql:8.0
    container_name: matomo-db
    command: --max-allowed-packet=64MB
    restart: always
    networks:
      - net
    volumes:
      - /DATA/AppData/matomo/db/:/var/lib/mysql:Z # Persistent storage db
    environment:
      MYSQL_ROOT_PASSWORD: admin # Replace with a strong password
      MARIADB_AUTO_UPGRADE: 1
      MARIADB_DISABLE_UPGRADE_BACKUP: 1

  matomo:
    image: matomo # Official Matomo Docker image
    container_name: matomo
    networks:
      - net
    ports:
      - "83:80" # Map host port 80 to container port 80
      # - "443:443" # Uncomment and configure for SSL if needed
    volumes:
      - /DATA/AppData/matomo/data/:/var/www/html
      # - ./config:/var/www/html/config:rw # Opt: local config directory
    environment:
      MATOMO_DATABASE_HOST: db # Connects to the 'db' service defined above
      MATOMO_DATABASE_USERNAME: root
      MATOMO_DATABASE_PASSWORD: admin # Same as MYSQL_ROOT_PASSWORD
      MATOMO_DATABASE_NAME: piwik # Or your preferred database name
    depends_on:
      - db # Ensures the database starts before Matomo
    restart: always

Once deployed, Matomo walks you through setting up an admin account and setting up your first site. It really is that easy! Once you're logged in and setup we can go about securing Matomo even more. For my use-case, I will continue by setting up Two-Factor Authentication and LDAP Authentication.

We can setup 2FA easily through the Matomo Settings page. Navigate there and then Personal -> Security -> Two-Factor Authentication. After adding in my authentication app, I can now log in and verify it is me.

To add another layer of security we can connect it to our LDAP services. For this we will need to install a plugin to integrate with it. Following the instructions to install the LoginLDAP plugin to Matomo will result in a new settings page option showing up. Navigate to System -> LDAP and fill out the LDAP connection information. Once connected you will have an LDAP login option now on the login page. You cannot remove the main login from Matomo, but with the 2FA it will make it a lot more secure if you only use your LDAP login going forward.