Self-hosted Umami: cookie-free web analytics on your own VPS
Tutorial · · 6 min read
Umami is one of the most popular Google Analytics alternatives for people who want to know how many visits their site gets without tracking anyone. It uses no cookies, stores no personal data and its script weighs a few kilobytes, so in most cases you don't need a consent banner just to measure traffic.
There's a hosted version, but the point is that Umami is open source and you can run it yourself: your visitor data stays on your server and you don't pay per event. All you need is a VPS, a domain and half an hour. With SecuryBlack, a lot less.
What you need
- A VPS with Docker. Umami and its database fit comfortably on a server with 1 GB of RAM. Any Hetzner, OVH or DigitalOcean VPS will do.
- The server connected to SecuryBlack with CromoForge, the agent that deploys your apps. If you don't have it yet, the panel gives you the install command when you add the server.
- A subdomain for the Umami dashboard, for example
stats.yourdomain.com. - Ports 80 and 443 free on the server: that's where the proxy that serves the app over HTTPS listens.
Step 1: point the subdomain at the server
At your domain provider, create an A record named stats with your VPS's public IP. If your server has IPv6, add an AAAA record too.
Do this before creating the app: the HTTPS certificate is requested as soon as the app starts, so the domain must already resolve to your server. You can check it with:
dig +short stats.yourdomain.com
Step 2: create the app from the template
In the panel, go to Apps → New app and choose Template. Select Umami and fill in three fields:
- Name: the app's name in the panel, for example
umami. - Server: the VPS it will run on.
- Domain:
stats.yourdomain.com.
Click Create and deploy. If you're signed in, this link opens the panel with the Umami template selected.
Step 3: what SecuryBlack does under the hood
While you watch the deployment log, CromoForge does on your server what you'd otherwise do by hand with Docker Compose:
- Generates the passwords. The database password and the app's keys are created on the fly and stored encrypted as the app's environment variables. No default passwords left in a
.envfile that you forget to change. - Runs Postgres separately. The database runs in its own container, on a private Docker network shared only with Umami. It publishes no ports, so it's not exposed to the internet and doesn't bypass your firewall.
- Keeps the data in a volume. Your analytics live in a Docker volume that survives every deployment and update.
- Serves the app over HTTPS. Umami only listens on
127.0.0.1. A proxy (Caddy) in front of it requests and renews the Let's Encrypt certificate for you.
Once Umami's healthcheck answers, the deployment turns green and the app is live at https://stats.yourdomain.com.
Step 4: change the admin password right away
Umami always creates the same initial user: admin with the password umami. The SecuryBlack panel reminds you on the app's page, but don't leave it for later: sign in, open your profile from the user menu and change it before doing anything else. Until you do, anyone who finds your subdomain can sign in.
Step 5: add your site and the tracking script
In the Websites section, click Add website and enter your domain. Umami gives you a snippet like this one to paste into your <head>:
<script defer src="https://stats.yourdomain.com/script.js" data-website-id="YOUR-ID"></script>
Publish the change, open your site in another tab and within seconds you'll see the visit in the realtime view.
Updating and maintaining Umami
- Update: click Deploy on the app. CromoForge pulls the latest Umami 3 release and restarts the container; your data stays in its volume. Umami runs its database migrations on startup.
- Watch it: add a SecuryBlack uptime monitor on
https://stats.yourdomain.com/api/heartbeatand you'll be alerted if it stops responding. The server monitoring agent alerts you if the VPS runs low on disk or memory. - Delete it: under Settings → Danger zone. Careful: deleting the app also deletes its volumes, with all your analytics.
What if I'd rather do it by hand?
You can: Umami publishes an official docker-compose.yml with the app and Postgres. You'll have to generate the passwords, avoid publishing the database port (Docker bypasses UFW if you do), put an HTTPS proxy in front and remember to update. The template does exactly that, and keeps the app in the same panel as your servers, backups and monitors.
Conclusion
With Umami on your own VPS you get cookie-free analytics, no event limits and your data at home. With the SecuryBlack template, the work comes down to one DNS record, a three-field form and changing a password. Create your account and try the template on your server.