#964905 RFP: goatcounter -- easy, meaningful privacy-friendly web analytics

Package:
wnpp
Source:
wnpp
Submitter:
Antoine Beaupre
Date:
2025-11-29 16:46:54 UTC
Severity:
wishlist
Tags:
#964905#5
Date:
2020-07-11 21:34:00 UTC
From:
To:
* Package name    : goatcounter
  Version         : 1.3.1
  Upstream Author : Martin Tournoij <martin@arp242.net>
* URL             : https://www.goatcounter.com/
* License         : EUPL 1.2
  Programming Lang: Golang
  Description     : easy, meaningful privacy-friendly web analytics

GoatCounter is an open source web analytics platform available as a
hosted service (free for non-commercial use) or self-hosted app. It
aims to offer easy to use and meaningful privacy-friendly web
analytics as an alternative to Google Analytics or Matomo.

There are two ways to run this: as hosted service on goatcounter.com,
free for non-commercial use, or run it on your own server (the source
code is completely Open Source/Free Software, and it can be
self-hosted without restrictions).

Features:

 * Privacy-aware; doesn't track users with unique identifiers and
   doesn't need a GDPR consent notice. Also see the privacy policy.


 * Lightweight and fast; adds just ~5K (~2.5K compressed) of extra
   data to your site. Also has JavaScript-free "tracking pixel"
   option, or you can use it from your application's middleware.

 * Easy; if you've been confused by the myriad of options and
   flexibility of Google Analytics and Matomo that you don't need then
   GoatCounter will be a breath of fresh air.

 * Identify unique visits without cookies using a non-identifiable
   hash (technical details).

 * Keeps useful statistics such as browser information, location, and
   screen size. Keep track of referring sites and campaigns.

 * Accessibility is a high-priority feature, and the interface works
   well with screen readers, no JavaScript, and even text browsers
   (although not all features work equally well without JS).

 * 100% committed to open source; you can see exactly what the code
   does and make improvements.

 * Own your data; you can always export all data and cancel at any
   time.

 * Integrate on your site with just a single script tag

 * The JavaScript integration is a good option for most, but you can
   also use a no-JavaScript image-based tracker or integrate in your
   backend middleware.

 * Fast: can handle about 800 hits/second on a $5/month Linode VPS
   using the default settings.

 * Self-contained binary: everything – including static assets – is in
   a single ~7M statically compiled binary. The only other thing you
   need is a SQLite database file or PostgreSQL connection (no way
   around that).
----

There are many other analytics programs in Debian: goaccess, analog,
webalizer, and probably others. But goatcounter is unique in that it's
one of the few analytics programs that actually makes a genuine
attempt at somewhat anonymizing the data it collects.

I found this program through this LWN article:

https://lwn.net/Articles/822568/

It would be great if some other go team folks would take this on, but
otherwise I might just do it myself in my copious spare time.

It seems the packaging might take some work with dependencies, as
dh-make-golang took its sweet time to just fail with an error:

$ dh-make-golang estimate github.com/zgoat/goatcounter
go get: 25.17 MiBpackage github.com/zgoat/goatcounter/handlers: code in directory /tmp/dh-make-golang269924867/src/github.com/zgoat/goatcounter/handlers expects import "zgo.at/goatcounter/handlers"
go get: 221.47 MiBpackage github.com/zgoat/goatcounter/cmd/check
	imports honnef.co/go/tools/code: cannot find package "honnef.co/go/tools/code" in any of:
	/usr/lib/go-1.11/src/honnef.co/go/tools/code (from $GOROOT)
	/tmp/dh-make-golang269924867/src/honnef.co/go/tools/code (from $GOPATH)
package github.com/zgoat/goatcounter/cmd/check
	imports honnef.co/go/tools/facts: cannot find package "honnef.co/go/tools/facts" in any of:
	/usr/lib/go-1.11/src/honnef.co/go/tools/facts (from $GOROOT)
	/tmp/dh-make-golang269924867/src/honnef.co/go/tools/facts (from $GOPATH)go get: 261.54 MiBpackage github.com/zgoat/goatcounter/cmd/goatcounter
	imports arp242.net/sconfig/handlers/html/template: unrecognized import path "arp242.net/sconfig/handlers/html/template" (parse https://arp242.net/sconfig/handlers/html/template?go-get=1: no go-import meta tags ())
2020/07/11 17:26:52 exit status 1

make fails in a similar way:

anarcat@emma:dist(master)$ dh-make-golang make github.com/zgoat/goatcounter
2020/07/11 17:27:29 Downloading "github.com/zgoat/goatcounter/..."
2020/07/11 17:27:40 Determining upstream version number
2020/07/11 17:27:40 Package version is "1.3.0+git20200711.37ad12d"
can't load package: package github.com/zgoat/goatcounter/handlers: code in directory /tmp/dh-make-golang955010176/src/github.com/zgoat/goatcounter/handlers expects import "zgo.at/goatcounter/handlers"
2020/07/11 17:27:41 Could not create a tarball of the upstream source: [go list -f {{.ImportPath}} {{.Name}} github.com/zgoat/goatcounter/...]: exit status 1

... and indeed, many packages in go.mod point at zgo.at, which is a
repository hosted just for goatcounter...

So, much fun in perspective.

a.

#964905#10
Date:
2020-07-17 17:29:56 UTC
From:
To:
Note that Goatcounter should *not* be shipped in Debian stable,
according to the author:

https://github.com/zgoat/goatcounter/issues/34#issuecomment-659944814

Also, the author recommends using the zgo.at URLs instead of github.com
here:

https://github.com/zgoat/goatcounter/issues/34#issuecomment-659610726

Unfortunately, that still fails:

anarcat@emma:dist(master)$ dh-make-golang estimate zgo.at/goatcounter
go get: 175.92 MiBpackage zgo.at/goatcounter/cmd/check
	imports honnef.co/go/tools/code: cannot find package "honnef.co/go/tools/code" in any of:
	/usr/lib/go-1.11/src/honnef.co/go/tools/code (from $GOROOT)
	/tmp/dh-make-golang182190041/src/honnef.co/go/tools/code (from $GOPATH)
package zgo.at/goatcounter/cmd/check
	imports honnef.co/go/tools/facts: cannot find package "honnef.co/go/tools/facts" in any of:
	/usr/lib/go-1.11/src/honnef.co/go/tools/facts (from $GOROOT)
	/tmp/dh-make-golang182190041/src/honnef.co/go/tools/facts (from $GOPATH)
go get: 215.50 MiBpackage zgo.at/goatcounter/cmd/goatcounter
	imports arp242.net/sconfig/handlers/html/template: unrecognized import path "arp242.net/sconfig/handlers/html/template" (parse https://arp242.net/sconfig/handlers/html/template?go-get=1: no go-import meta tags ())
2020/07/17 13:15:26 exit status 1

The "make" part works a little better, fortunately:

$ dh-make-golang make -allow_unknown_hoster zgo.at/goatcounter
2020/07/17 13:21:35 WARNING: Using "zgo" as canonical hostname for "zgo.at". If that is not okay, please file a bug against dh-make-golang.
2020/07/17 13:21:35 Downloading "zgo.at/goatcounter/..."
2020/07/17 13:21:47 Determining upstream version number
2020/07/17 13:21:47 Package version is "1.3.0+git20200713.d975069"
2020/07/17 13:21:47 Determining dependencies
2020/07/17 13:21:55 Assuming you are packaging a program (because "zgo.at/goatcounter/cmd/check" defines a main package), use -type to override
2020/07/17 13:22:00 Build-Dependency "zgo.at/tz" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/json" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/gadget" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/zhttp" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/isbot" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/zdb" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "github.com/go-chi/chi" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "github.com/zgoat/kommentaar" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/ztest" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/guru" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "code.soquee.net/otp" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/blackmail" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/zli" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "github.com/teamwork/reload" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "honnef.co/go/tools" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "github.com/monoculum/formam" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "github.com/arp242/geoip2-golang" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/zstd" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/zlog" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/zstripe" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/errors" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Build-Dependency "zgo.at/zvalidate" is not yet available in Debian, or has not yet been converted to use XS-Go-Import-Path in debian/control
2020/07/17 13:22:00 Could not determine description for "zgo.at/goatcounter": GET https://api.github.com/repos/zgoat/goatcounter.git: 404 Not Found []
2020/07/17 13:22:00 Could not determine license for "zgo.at/goatcounter": GET https://api.github.com/repos/zgoat/goatcounter.git/license: 404 Not Found []
2020/07/17 13:22:00 Could not determine copyright for "zgo.at/goatcounter": GET https://api.github.com/repos/zgoat/goatcounter.git: 404 Not Found []
2020/07/17 13:22:00 Could not determine license for "zgo.at/goatcounter": GET https://api.github.com/repos/zgoat/goatcounter.git/license: 404 Not Found []
2020/07/17 13:22:00 Could not determine author for "zgo.at/goatcounter": GET https://api.github.com/repos/zgoat/goatcounter.git: 404 Not Found []
2020/07/17 13:22:00 Could not determine description for "zgo.at/goatcounter": GET https://api.github.com/repos/zgoat/goatcounter.git: 404 Not Found []
2020/07/17 13:22:00
2020/07/17 13:22:00 Packaging successfully created in /home/anarcat/dist/t/goatcounter
2020/07/17 13:22:00
2020/07/17 13:22:00 Resolve all TODOs in itp-goatcounter.txt, then email it out:
2020/07/17 13:22:00     sendmail -t < itp-goatcounter.txt
2020/07/17 13:22:00
2020/07/17 13:22:00 Resolve all the TODOs in debian/, find them using:
2020/07/17 13:22:00     grep -r TODO debian
2020/07/17 13:22:00
2020/07/17 13:22:00 To build the package, commit the packaging and use gbp buildpackage:
2020/07/17 13:22:00     git add debian && git commit -a -m 'Initial packaging'
2020/07/17 13:22:00     gbp buildpackage --git-pbuilder
2020/07/17 13:22:00
2020/07/17 13:22:00 To create the packaging git repository on salsa, use:
2020/07/17 13:22:00     dh-make-golang create-salsa-project goatcounter
2020/07/17 13:22:00
2020/07/17 13:22:00 Once you are happy with your packaging, push it to salsa using:
2020/07/17 13:22:00     git remote set-url origin git@salsa.debian.org:go-team/packages/goatcounter.git
2020/07/17 13:22:00     gbp push

It also happens to provide a nice list of missing packages which, in a
more digestable form, looks like this:

 * code.soquee.net/otp
 * github.com/go-chi/chi
 * github.com/monoculum/formam
 * github.com/teamwork/reload
 * github.com/zgoat/kommentaar
 * honnef.co/go/tools

Note that zgoat/kommentaar is a fork of teamwork/kommentaar, something
to keep in mind.

This one is a fork of an existing package in Debian,
golang-github-oschwald-geoip2-golang-dev, we'd need to investigate if
that can be resolved:

 * github.com/arp242/geoip2-golang

The other dependencies are generally sane and could be packaged for Debian.

And those are zgoat-specific libraries, which we could just vendor for
the time being.

 * zgo.at/blackmail
 * zgo.at/errors
 * zgo.at/gadget
 * zgo.at/guru
 * zgo.at/isbot
 * zgo.at/json
 * zgo.at/tz
 * zgo.at/zdb
 * zgo.at/zhttp
 * zgo.at/zli
 * zgo.at/zlog
 * zgo.at/zstd
 * zgo.at/zstripe
 * zgo.at/ztest
 * zgo.at/zvalidate

A.

#964905#15
Date:
2020-08-02 18:03:19 UTC
From:
To:
Some more information about Debian packaging, from upstream.
#964905#20
Date:
2020-08-05 16:58:13 UTC
From:
To:
Control: forward -1 https://github.com/zgoat/goatcounter/issues/368

upstream is also working on a package

#964905#29
Date:
2024-01-13 02:49:15 UTC
From:
To:
On 2020-07-17 13:29:56, Antoine Beaupré wrote:

[...]

This is now really old, but just for kicks I looked around and those are
actually packed now, already:

Which means that goatcounter, as it was 3 years ago (!), would only
require packaging those:

Obviously, we'd need to review this with the latest upstream code, but I
thought that was slightly encouraging.

a.