{
 "slug": "umami",
 "name": "Umami",
 "tagline": "Privacy-friendly web analytics without cookies",
 "category": "analytics-bi",
 "use_cases": [
  "web-analytics",
  "privacy",
  "google-analytics-alternative"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Umami Software, Inc.",
  "url": "https://umami.is",
  "license": "MIT",
  "license_url": "https://github.com/umami-software/umami/blob/master/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "3.4.1",
   "last_build": "2026-10-24",
   "entity_id": "prod-epjwlrwsai652",
   "ami_alias": "/aws/service/marketplace/prod-epjwlrwsai652/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-gxdw26zzwww7u",
   "recommended_instance_type": "t3.small",
   "price_usd_per_hour": 0.03,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "3.4.1",
   "last_build": "2026-10-25",
   "offer_id": "umami",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:umami:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.umami?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/umami/",
  "json": "https://lynxroute.com/products/umami/product.json"
 },
 "release_notes": [
  {
   "version": "3.4.1",
   "title": "Umami 3.4.1",
   "notes": "* Umami updated 3.4.0 -> 3.4.1, a security hotfix release. MIT unchanged\n* Security: Next.js 16.4.2 fixes a critical remote code execution in next/og, SSRF in image optimization, cache poisoning and an information disclosure issue; React 19.3.1\n* Container base moves to Node 22.23.4 with the October 2026 Node.js security fixes\n* Fixes an OAuth credential leak in the Model Context Protocol packages and raises the floors of vulnerable transitive dependencies\n* No schema migrations\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-24",
    "azure": "2026-10-25"
   }
  },
  {
   "version": "3.4.0",
   "title": "Umami 3.4.0",
   "notes": "* Umami 3.4.0 - privacy-friendly, open-source web analytics (minor update from 3.3.1). MIT unchanged\n* Annotations: add dated all-day or time-specific notes to website charts to mark launches, campaigns and other events, with markers shown on the chart\n* Model Context Protocol endpoint for read-only analytics access from compatible assistants, covering traffic, events, sessions, funnels, goals, journeys, retention, attribution, revenue, performance, segments and annotations. Disabled by default; set MCP_ENABLED=1 to enable /mcp\n* Account API keys under Settings, plus a typed API client generated from the OpenAPI contracts and generated endpoint documentation\n* New website-scoped analytics endpoints with dedicated saved funnel, goal, performance and UTM resources; legacy report APIs and existing saved report definitions are preserved\n* Session property filters can be saved in segments; the tracker accepts a data-distinct-id attribute to set a visitor identity; New Taiwan Dollar and Icelandic Krona revenue currencies and Georgian and Azerbaijani translations added\n* Security: partial two-factor tokens are rejected for authenticated API access, authenticated sessions are bound to password fingerprints, deleted teams are excluded from access checks and their join codes invalidated, and reports can no longer be reassigned to another website on update\n* Fixes PostgreSQL and ClickHouse timezone inconsistencies, separates sessions for identified visitors sharing an IP address and user agent, and preserves commas in regular-expression filter values\n* Adds the 25_add_annotation and 26_add_api_key schema migrations, which apply automatically\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-20",
    "azure": "2026-09-21"
   }
  },
  {
   "version": "3.3.1",
   "title": "Umami 3.3.1",
   "notes": "* Umami 3.3.1 - privacy-friendly, open-source web analytics (patch update from 3.3.0). MIT unchanged\n* Hardens two-factor authentication when TWO_FACTOR_ENCRYPTION_KEY is missing or invalid, with safer API enforcement and clearer configuration feedback\n* Fixes event property filtering so fields and values respect the selected event name, preserves events without a matching session record, and stabilises relational event pagination\n* Preserves the root path when REMOVE_TRAILING_SLASH is enabled, and resets tracker visit state when a session drifts\n* Adds the 24_lowercase_username migration, which normalises usernames carried over from pre-3.2 installations\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23",
    "azure": "2026-09-06"
   }
  },
  {
   "version": "3.3.0",
   "title": "Umami 3.3.0",
   "notes": "* Umami 3.3.0 - privacy-friendly, open-source web analytics (minor update from 3.2.0)\n* Two-factor authentication for self-hosted installs: TOTP setup with QR code or manual key, backup codes for account recovery, a 2FA step in the login flow, team-level enforcement, and rate limiting with HTTP 429 on repeated failed attempts\n* Session identity stitching - sessions are linked once a visitor is identified, giving a single view of activity across devices and visits\n* Property filtering, board cloning, sparklines and improved bounce detection, plus a broad set of security, performance and UI fixes\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-08-17",
    "azure": "2026-08-18"
   }
  },
  {
   "version": "3.2.0",
   "title": "Umami 3.2.0",
   "notes": "* Umami 3.2.0 - privacy-friendly, open-source web analytics (minor update from 3.1.0; adds click/scroll heatmaps, session replay improvements, richer event/session property reporting)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-06-26",
    "azure": "2026-07-11"
   }
  },
  {
   "version": "3.1.0",
   "title": "Umami 3.1.0",
   "notes": "* Umami 3.1.0 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Seeded admin:umami credential rotated to a random 24-character password at first boot\n* Per-instance PostgreSQL 15 password and APP_SECRET generated at first boot\n* Umami app bound to 127.0.0.1:3000 and reachable only through Nginx with TLS\n* PostgreSQL 15 inside the Docker compose bridge - no host port mapping\n* UFW firewall pre-configured (TCP 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-05-21",
    "azure": "2026-05-21"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.4.1",
   "aws": "2026-10-24",
   "azure": "2026-10-25"
  },
  {
   "version": "3.4.0",
   "aws": "2026-09-20",
   "azure": "2026-09-21"
  },
  {
   "version": "3.3.1",
   "aws": "2026-08-23",
   "azure": "2026-09-06"
  },
  {
   "version": "3.3.0",
   "aws": "2026-08-17",
   "azure": "2026-08-18"
  },
  {
   "version": "3.2.0",
   "aws": "2026-06-26",
   "azure": "2026-07-11"
  },
  {
   "version": "3.1.0",
   "aws": "2026-05-21",
   "azure": "2026-05-21"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-epjwlrwsai652/latest \\\n  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer umami --plan payg-gen2\naz vm create -g my-rg -n umami --size Standard_D2s_v3 \\\n  --image lynxroute:umami:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Umami is an open-source, privacy-friendly, self-hosted web analytics platform - a lightweight alternative to Google Analytics and Plausible. It is a Next.js + Node 22 application backed by PostgreSQL 15. It tracks pageviews, sessions, events, referrers, devices, and custom events without setting cookies and without storing personal data, which removes the need for cookie consent banners on most jurisdictions (GDPR, CCPA, PECR). Owners manage multiple sites in one dashboard, share read-only public pages, define custom event tracking, build their own dashboards via Boards, and capture optional session replay. Integrates with any website by pasting a small JavaScript snippet into the <head> - no SDK, no build step, no third-party tracking pixel. Persists pageviews, sessions, events, and dashboards in PostgreSQL 15. MIT license, no vendor lock-in. Self-hosting puts your visitor data entirely under your control, eliminates per-pageview SaaS pricing, and keeps every event on infrastructure you own.",
  "image_adds": "Security hardening:\n* Seeded admin:umami credential rotated to a random 24-character password at first boot - written to /root/umami-credentials.txt, the rotation verified to no longer authenticate before the image accepts traffic\n* Umami app bound to 127.0.0.1:3000 only - reachable through the Nginx reverse proxy with TLS, never directly exposed on the host network\n* PostgreSQL 15 inside the Docker compose bridge - no host port mapping, never reachable on 0.0.0.0:5432\n* Per-instance PostgreSQL password and APP_SECRET generated at first boot - never baked into the image\n* Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, hardened cipher suite, security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)\n* UFW firewall pre-configured - only TCP 22, 80, 443 exposed\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}