{"slug": "show-hn-open-source-and-ai-native-web-analytics", "title": "Show HN: Open-source and AI native web analytics", "summary": "OpenLabs-so released OpenAnalytics, an open-source, AI-native web analytics platform self-hostable under AGPL-3.0, featuring a lightweight tracker, ClickHouse-based storage, and an AI assistant, with a hosted instance at getopen.so. The monorepo includes apps for tracking, collection, querying, and a dashboard, and supports page views, funnels, revenue analytics, and an MCP server. Self-hosting requires a Linux host with Docker, four DNS records, and about 4 GB of RAM, with installation via a single docker compose command.", "body_md": "Open-source, privacy-first web analytics. One lightweight tracker script, no cookies, no cross-site profiles, aggregate-only reads — self-hostable on your own hardware under AGPL-3.0.\n\nA hosted instance runs at ** getopen.so**, operated by the\nauthors: the same code, someone else's servers.\n\n▶ ** Watch the dashboard in motion**,\na tour of these same screens on YouTube.\n\nThe product, as one pnpm monorepo:\n\n| App | Role |\n|---|---|\n`apps/tracker` |\nThe browser snippet — a few KiB, with a byte budget CI enforces |\n`apps/collector` |\nIngest: validates, sanitizes, rate-limits, enqueues |\n`apps/worker` |\nDrains the queue into ClickHouse; sessions, rollups, exports, mail, deletions |\n`apps/api` |\nControl plane: auth, sites, keys, sharing, event definitions, funnels, widgets, revenue, AI assistant, MCP |\n`apps/query-gateway` |\nThe only process allowed to read ClickHouse; verifies signed query envelopes |\n`apps/realtime` |\nThe SSE stream behind the live dashboard |\n`apps/web` |\nThe dashboard (Next.js) |\n`apps/cli` |\n`oa` — site setup, stats, device-flow login |\n`packages/*` |\ndomain, postgres (+migrations), clickhouse (+migrations), redis, auth, contracts (OpenAPI), observability, integrations, migrations, testkit |\n\nStores: **Postgres** (control plane), **ClickHouse** (events and rollups),\n**Valkey ×2** (one durable event queue, one losable realtime cache).\n\nWhat it does, in one list: page views, custom and attribute-driven events,\nsessions, web vitals, funnels, per-site retention, embeddable widgets, public\nshare links, revenue analytics from *your* Stripe account, CSV/JSON import and\nexport, an MCP server, and a CLI.\n\n**Who is on the site now**, from a presence cache rather than a table scan.\nNames are generated per visitor and mean nothing outside the day they were\nminted.\n\n**Where one visitor went**, session by session. The identity behind a trail is\na salted hash that rotates every night, so the trail is as long as a visit and\nnever as long as a person.\n\n**Where they are**, at city level and only when a site opts in. The lookup runs\nagainst a database on your own disk and never leaves the host.\n\nArchitecture rules CI enforces, not conventions:\n\n`apps/web`\n\nmay import only`packages/contracts`\n\n— the OpenAPI document is the single seam between frontend and backend.- ClickHouse is reachable only through the query gateway, which verifies Ed25519-signed query envelopes minted by the api.\n- The tracker has a hard byte budget; a change that exceeds it fails CI.\n- The Postgres schema this repository builds contains no billing tables, and a CI job asserts that against a real database rather than a file list.\n\n** SELF-HOSTING.md** is the guide: a generator script, one\n\n`docker compose up -d`\n\n, automatic TLS, and an explanation of every secret and\nevery failure mode. Requirements are a Linux host with Docker, four DNS records\nand about 4 GB of RAM.**Installing is a pull, not a build.** A release publishes ten images to\n`ghcr.io/openlabs-so/openanalytics`\n\n, so a fresh host is a few minutes and needs\nno toolchain on it.\n\n**Point four names at the host before you start.** Certificates are issued on\nthe first boot and issuance fails without them, half an hour later and nowhere\nnear the cause:\n\n```\napp.example.com   api.example.com   c.example.com   rt.example.com\ngit clone https://github.com/OpenLabs-so/openanalytics\ncd openanalytics\ngit checkout \"$(git tag -l 'v*' --sort=-v:refname | sed '/-/d' | head -1)\"   # newest release, not main\ncd infra/selfhost\n./generate-secrets.sh --domain example.com --email you@example.com --with-geoip\ndocker compose pull && docker compose up -d\n# then open https://app.example.com and create the first account\n```\n\n**The checkout is where the version is chosen, and it is chosen once.** The\ngenerator reads the tag back out of the tree it is standing in and points `.env`\n\nat that release's images, printing which it picked and why; on a branch, on\n`main`\n\n, or with no git at all it writes the build defaults instead. That is not\na convenience — the compose file, the env templates and the migrations ship\n*with* the images, so a release's images against another tree is a configuration\nnobody has tested.\n\nImages are amd64. On arm64, or to run a branch, build the ten here instead:\nsame compose file, one flag, about ten minutes and swap on a 4 GB box. Later,\n`./upgrade.sh`\n\nmoves between releases and takes the snapshot `./rollback.sh`\n\nneeds, because **migrations do not go down**: the way back is a restore, and a\nrestore discards what arrived after the upgrade. It tells you that before it\nstarts, not at rollback time when you no longer have a choice.\n[RELEASING.md](/OpenLabs-so/openanalytics/blob/main/RELEASING.md) is what a version number here means.\n\nTo run it from source instead — for development, or to slot the services into\ninfrastructure you already have — follow\n[Running from source](/OpenLabs-so/openanalytics/blob/main/SELF-HOSTING.md#running-from-source). **The order matters\nand one obvious order does not work:** the migration runners are compiled\noutput, so `pnpm run build`\n\ncomes before `pnpm run migrate:postgres`\n\n.\n\n`infra/selfhost/env/*.env.example`\n\ndocuments every variable each service reads,\nand there is one file per service on purpose — the environment schema forbids\nsome keys to some services, so a single shared `.env`\n\ncannot be correct. The\nAI assistant (`OPENAI_API_KEY`\n\n) and object storage are optional: unset, those\nsurfaces disable themselves and everything else runs.\n\nRun the test suite the way CI does:\n\n```\npnpm run test          # unit + contract + tracker, no infrastructure needed\npnpm run verify        # everything CI checks, including boundaries and the size budget\n```\n\nNo cookies, no fingerprinting, no cross-site identifiers. Visitor identity is a daily-rotating salted hash; raw IP addresses are never stored. Do Not Track and Global Privacy Control are honored at the collector, before anything is written. City-level geolocation is opt-in per site.\n\nGeolocation is resolved locally against a database on your own disk — no lookup\never leaves the host. None is bundled (a 60 MB download, and stale within a month);\n`infra/selfhost/geoip/fetch-dbip.sh`\n\ndownloads one.\n\nIP Geolocation by DB-IP —\n\n[https://db-ip.com]— used under[CC BY 4.0].\n\n**Pull requests are merged here, with your name on the commit.** This\nrepository used to receive periodic exports from a private monorepo, and a\nmerged PR was flattened by the next one; that ended in August 2026. A bot asks\nyou to sign the [CLA](/OpenLabs-so/openanalytics/blob/main/CLA.md) once — it is not an assignment, you keep your\ncopyright — and there is no DCO sign-off on top of it.\n\n[CONTRIBUTING.md](/OpenLabs-so/openanalytics/blob/main/CONTRIBUTING.md) has the setup, the ground rules CI enforces,\nand where to start.\n[Discussions](https://github.com/OpenLabs-so/openanalytics/discussions) are for\nquestions and for ideas worth talking through first.\n\nSecurity reports: [SECURITY.md](/OpenLabs-so/openanalytics/blob/main/SECURITY.md) — please not a public issue.\n\nCode: [AGPL-3.0](/OpenLabs-so/openanalytics/blob/main/LICENSE). If you run a modified OpenAnalytics as a network\nservice, the AGPL requires you to offer your modified source to its users.\n\nThe \"OpenAnalytics\" name and the hosted service's domain identify the instance\nits authors operate and are **not** part of the license grant. A self-hosted\ninstance runs the software, not the brand.", "url": "https://wpnews.pro/news/show-hn-open-source-and-ai-native-web-analytics", "canonical_source": "https://github.com/OpenLabs-so/openanalytics", "published_at": "2026-08-14 18:17:42+00:00", "updated_at": "2026-08-14 18:41:28.013010+00:00", "lang": "en", "topics": ["ai-products", "developer-tools", "ai-infrastructure"], "entities": ["OpenLabs-so", "OpenAnalytics", "ClickHouse", "Postgres", "Valkey", "getopen.so", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/show-hn-open-source-and-ai-native-web-analytics", "markdown": "https://wpnews.pro/news/show-hn-open-source-and-ai-native-web-analytics.md", "text": "https://wpnews.pro/news/show-hn-open-source-and-ai-native-web-analytics.txt", "jsonld": "https://wpnews.pro/news/show-hn-open-source-and-ai-native-web-analytics.jsonld"}}