INFRA-517: Phase 2

.github/workflows/dev-build.yml

@@ -1,7 +1,8 @@
-### This is the Terraform-generated dev-build.yml workflow for the docker-matomo-dev app repository ###
-### If this is a Lambda repo, uncomment the FUNCTION line at the end of the document     ###
-### If the container requires any additional pre-build commands, uncomment and edit      ###
-### the PREBUILD line at the end of the document.                                        ###
+### This is the Terraform-generated dev-build.yml workflow for the          ###
+### docker-matomo-dev app repository.                                       ###
+### If this is a Lambda repo, uncomment the FUNCTION line at the end of the ###
+### document. If the container requires any additional pre-build commands,  ###
+### uncomment and edit the PREBUILD line at the end of the document.        ###
 name: Dev Container Build and Deploy
 on:
   workflow_dispatch:
@@ -11,8 +12,15 @@ on:
     paths-ignore:
       - '.github/**'
 
+permissions: read-all
+
 jobs:
   deploy:
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
+
     name: Dev Container Deploy
     uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-dev.yml@main
     secrets: inherit

.github/workflows/prod-promote.yml

@@ -1,13 +1,22 @@
-### This is the Terraform-generated prod-promote.yml workflow for the docker-matomo-prod repository. ###
-### If this is a Lambda repo, uncomment the FUNCTION line at the end of the document.         ###
+### This is the Terraform-generated prod-promote.yml workflow for the       ###
+### docker-matomo-prod repository.                                          ###
+### If this is a Lambda repo, uncomment the FUNCTION line at the end of the ###
+### document.                                                               ###
 name: Prod Container Promote
 on:
   workflow_dispatch:
   release:
     types: [published]
 
+permissions: read-all
+
 jobs:
   deploy:
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
+
     name: Prod Container Promote
     uses: mitlibraries/.github/.github/workflows/ecr-shared-promote-prod.yml@main
     secrets: inherit

.github/workflows/stage-build.yml

@@ -1,7 +1,8 @@
-### This is the Terraform-generated dev-build.yml workflow for the docker-matomo-stage app repository ###
-### If this is a Lambda repo, uncomment the FUNCTION line at the end of the document     ###
-### If the container requires any additional pre-build commands, uncomment and edit      ###
-### the PREBUILD line at the end of the document.                                        ###
+### This is the Terraform-generated dev-build.yml workflow for the          ###
+### docker-matomo-stage app repository.                                     ###
+### If this is a Lambda repo, uncomment the FUNCTION line at the end of the ###
+### document. If the container requires any additional pre-build commands,  ###
+### uncomment and edit the PREBUILD line at the end of the document.        ###
 name: Stage Container Build and Deploy
 on:
   workflow_dispatch:
@@ -11,8 +12,15 @@ on:
     paths-ignore:
       - '.github/**'
 
+permissions: read-all
+
 jobs:
   deploy:
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
+
     name: Stage Container Deploy
     uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-stage.yml@main
     secrets: inherit

.gitignore

@@ -1,2 +1,3 @@
 .env
 **/.DS_Store
+temp/

Dockerfile

@@ -14,9 +14,16 @@ COPY ./files/plugin-HeatmapSessionRecording-5.2.3/ /var/www/html/plugins/Heatmap
 # Add the UsersFlow plugin
 COPY ./files/plugin-UsersFlow-5.0.5/ /var/www/html/plugins/UsersFlow
 
-# Preconfigure settings
+# Our custom configuration settings
 COPY ./files/config.ini.php /var/www/html/config/config.ini.php
 
+# The HeatmapSessionRecording and UsersFlow update the matomo.js and piwik.js
+# files when they are activated. Those updates have been captured and we
+# pre-load them here (we put them in /usr/src because the entrypoint.sh is what
+# actually builds the /var/www/html folder as a Docker VOLUME)
+COPY --chmod=0644 ./files/post_premium_plugins_matomo.js /usr/src/matomo/matomo.js
+COPY --chmod=0644 ./files/post_premium_plugins_piwik.js /usr/src/matomo/piwik.js
+
 # Address "public" directories problem
 COPY --chmod=0644 --chown=root:root ./files/lang-htaccess /var/www/html/lang/.htaccess
 COPY --chmod=0644 --chown=root:root ./files/config-htaccess /var/www/html/config/.htaccess

Makefile

@@ -1,12 +1,12 @@
 .PHONY: help dist-dev publish-dev dist-stage publish-stage
 SHELL=/bin/bash
 ### This is the Terraform-generated header for docker-matomo-dev. If  ###
-###   this is a Lambda repo, uncomment the FUNCTION line below  ###
-###   and review the other commented lines in the document.     ###
+###   this is a Lambda repo, uncomment the FUNCTION line below        ###
+###   and review the other commented lines in the document.           ###
 ECR_NAME_DEV:=docker-matomo-dev
 ECR_URL_DEV:=222053980223.dkr.ecr.us-east-1.amazonaws.com/docker-matomo-dev
 # FUNCTION_DEV:=
-### End of Terraform-generated header                            ###
+### End of Terraform-generated header                                 ###
 
 help: ## Print this message
 	@awk 'BEGIN { FS = ":.*##"; print "Usage:  make <target>\n\nTargets:" } \

docs/HowTos/HOWTO-migrate-from-legacy-AWS.md

@@ -21,12 +21,12 @@ Before getting started, make sure that you have access to the `root` password fo
 
 ### Legacy AWS
 
-In the legacy Stage/Prod account, log in to the `efs-access-matomo-<env>` EC2 instance (`<env>` is either `stage` or `prod` depending on the database being backed up). Requires AWS CLI v2, AWS Session-Manager Plugin for AWSCLI.
+In the legacy Stage/Prod account, log in to the `matomo-efs-mgmt` EC2 instance (`<env>` is either `stage` or `prod` depending on the database being backed up). Requires AWS CLI v2, AWS Session-Manager Plugin for AWSCLI.
 
 To capture the InstanceID of the EC2 instance to connect to, run the following command:
 
 ```bash
-aws ec2 describe-instances --filters "Name=tag:Name,Values=efs-access-matomo-<env>" --query "Reservations[*].Instances[*].[InstanceId]" --output text
+aws ec2 describe-instances --filters "Name=tag:Name,Values=matomo-efs-mgmt" --query "Reservations[*].Instances[*].[InstanceId]" --output text
 ```
 
 To capture the RDS_ENDPOINT for the database, run the following command:

docs/HowTos/HOWTO-premium-plugins.md

@@ -23,7 +23,7 @@ In the end, the premium plugin installation is a two-pass process.
 ### High level overview
 
 1. Install license key (via UI or CLI) so that it is in the database.
-2. Go through a dev -> stage -> prod deployment cycle of the container to install the plugin folder(s) into the container and update the `config.ini.php` file with new line(s) in the `[PluginsInstalled]` section.
+2. Go through a dev -> stage -> prod deployment cycle of the container to install the plugin folder(s) into the container.
 3. Activate the new plugin(s) (via UI or CLI) so that any database changes are properly executed.
 4. Go through a dev -> stage -> prod deployment cycle of the container to match the updated `config.ini.php` file on the server.
 
@@ -41,20 +41,20 @@ According to the support team at Matomo, the premium license key can be installe
 
 This needs to be done on each of the stage & prod instances of Matomo.
 
-#### 2. Install plugin
+#### 2. Install the plugin files
 
-In this phase, the files are installed in the container and the `config.ini.php` is updated to match the installation. This will **not** activate the plugins, it will just make them visible in the UI. The only new lines in the `config.ini.php` should be in the `[PluginsInstalled]` section.
+In this phase, the files are installed in the container *but no changes are made to the `config.ini.php` file. This will **not** activate the plugins, it will just make them visible in the UI.
 
-#### 3. Activate plugin
+#### 3. Activate the plugin
 
-Once the plugin is installed, it's time to activate it. In the UI, it's just a matter of clicking the `Activate` link for the plugin. For the CLI, the command is
+Once the plugin files are installed in the container, it's time to activate the plugin. In the UI, it's just a matter of clicking the `Activate` link for the plugin. For the CLI, the command is
 
 ```bash
 ./console plugin:activate [<plugin>...]
 ```
 
 This will change the `config.ini.php` file on the container. It is **very** important to capture these changes and put them back in the `config.ini.php` in the container (see step 4).
 
-#### 4. Deploy new config.ini.php
+#### 4. Backfill this repo
 
-After capturing the changes to `config.ini.php`, go through another round of dev -> stage -> prod deploys.
+Update the `config.ini.php` file in this repo and go through another dev -> stage -> prod deployment to ensure that the repo code matches the container running in AWS.

files/config.ini.php

@@ -88,81 +88,102 @@
 Plugins[] = "Resolution"
 Plugins[] = "DevicePlugins"
 Plugins[] = "Heartbeat"
-Plugins[] = "Marketplace"
 Plugins[] = "Intl"
+Plugins[] = "Marketplace"
+Plugins[] = "CustomJsTracker"
 Plugins[] = "Tour"
 Plugins[] = "PagePerformance"
 Plugins[] = "CustomDimensions"
 Plugins[] = "FeatureFlags"
 Plugins[] = "MobileAppMeasurable"
 Plugins[] = "CustomVariables"
 Plugins[] = "EnvironmentVariables"
+Plugins[] = "HeatmapSessionRecording"
+Plugins[] = "UsersFlow"
+
 
 [PluginsInstalled]
-PluginsInstalled[] = "Diagnostics"
-PluginsInstalled[] = "Login"
+PluginsInstalled[] = "API"
+PluginsInstalled[] = "Actions"
+PluginsInstalled[] = "Annotations"
+PluginsInstalled[] = "BulkTracking"
+PluginsInstalled[] = "Contents"
 PluginsInstalled[] = "CoreAdminHome"
-PluginsInstalled[] = "UsersManager"
-PluginsInstalled[] = "SitesManager"
-PluginsInstalled[] = "Installation"
-PluginsInstalled[] = "Monolog"
-PluginsInstalled[] = "Intl"
-PluginsInstalled[] = "CorePluginsAdmin"
+PluginsInstalled[] = "CoreConsole"
 PluginsInstalled[] = "CoreHome"
-PluginsInstalled[] = "WebsiteMeasurable"
-PluginsInstalled[] = "IntranetMeasurable"
+PluginsInstalled[] = "CorePluginsAdmin"
+PluginsInstalled[] = "CoreUpdater"
 PluginsInstalled[] = "CoreVisualizations"
-PluginsInstalled[] = "Proxy"
-PluginsInstalled[] = "API"
-PluginsInstalled[] = "Widgetize"
-PluginsInstalled[] = "Transitions"
-PluginsInstalled[] = "LanguagesManager"
-PluginsInstalled[] = "Actions"
+PluginsInstalled[] = "CoreVue"
+PluginsInstalled[] = "CustomDimensions"
+PluginsInstalled[] = "CustomVariables"
+PluginsInstalled[] = "CustomJsTracker"
+PluginsInstalled[] = "DBStats"
 PluginsInstalled[] = "Dashboard"
-PluginsInstalled[] = "MultiSites"
-PluginsInstalled[] = "Referrers"
-PluginsInstalled[] = "UserLanguage"
+PluginsInstalled[] = "DevicePlugins"
 PluginsInstalled[] = "DevicesDetection"
-PluginsInstalled[] = "Goals"
+PluginsInstalled[] = "Diagnostics"
 PluginsInstalled[] = "Ecommerce"
-PluginsInstalled[] = "SEO"
+PluginsInstalled[] = "EnvironmentVariables"
 PluginsInstalled[] = "Events"
-PluginsInstalled[] = "UserCountry"
-PluginsInstalled[] = "GeoIp2"
-PluginsInstalled[] = "VisitsSummary"
-PluginsInstalled[] = "VisitFrequency"
-PluginsInstalled[] = "VisitTime"
-PluginsInstalled[] = "VisitorInterest"
-PluginsInstalled[] = "RssWidget"
+PluginsInstalled[] = "FeatureFlags"
 PluginsInstalled[] = "Feedback"
-PluginsInstalled[] = "TwoFactorAuth"
-PluginsInstalled[] = "CoreUpdater"
-PluginsInstalled[] = "CoreConsole"
-PluginsInstalled[] = "ScheduledReports"
-PluginsInstalled[] = "UserCountryMap"
-PluginsInstalled[] = "Live"
-PluginsInstalled[] = "CustomVariables"
-PluginsInstalled[] = "PrivacyManager"
+PluginsInstalled[] = "GeoIp2"
+PluginsInstalled[] = "Goals"
+PluginsInstalled[] = "Heartbeat"
+PluginsInstalled[] = "HeatmapSessionRecording"
 PluginsInstalled[] = "ImageGraph"
-PluginsInstalled[] = "Annotations"
-PluginsInstalled[] = "MobileMessaging"
-PluginsInstalled[] = "Overlay"
-PluginsInstalled[] = "SegmentEditor"
 PluginsInstalled[] = "Insights"
-PluginsInstalled[] = "Morpheus"
-PluginsInstalled[] = "Contents"
-PluginsInstalled[] = "BulkTracking"
-PluginsInstalled[] = "Resolution"
-PluginsInstalled[] = "DevicePlugins"
-PluginsInstalled[] = "Heartbeat"
+PluginsInstalled[] = "Installation"
+PluginsInstalled[] = "Intl"
+PluginsInstalled[] = "IntranetMeasurable"
+PluginsInstalled[] = "JsTrackerInstallCheck"
+PluginsInstalled[] = "LanguagesManager"
+PluginsInstalled[] = "Live"
+PluginsInstalled[] = "Login"
 PluginsInstalled[] = "Marketplace"
-PluginsInstalled[] = "ProfessionalServices"
-PluginsInstalled[] = "Tour"
-PluginsInstalled[] = "EnvironmentVariables"
-PluginsInstalled[] = "CoreVue"
 PluginsInstalled[] = "MobileAppMeasurable"
+PluginsInstalled[] = "MobileMessaging"
+PluginsInstalled[] = "Monolog"
+PluginsInstalled[] = "Morpheus"
+PluginsInstalled[] = "MultiSites"
+PluginsInstalled[] = "Overlay"
 PluginsInstalled[] = "PagePerformance"
-PluginsInstalled[] = "CustomDimensions"
-PluginsInstalled[] = "FeatureFlags"
+PluginsInstalled[] = "PrivacyManager"
+PluginsInstalled[] = "ProfessionalServices"
+PluginsInstalled[] = "Proxy"
+PluginsInstalled[] = "Referrers"
+PluginsInstalled[] = "Resolution"
+PluginsInstalled[] = "RssWidget"
+PluginsInstalled[] = "SEO"
+PluginsInstalled[] = "ScheduledReports"
+PluginsInstalled[] = "SegmentEditor"
+PluginsInstalled[] = "SitesManager"
+PluginsInstalled[] = "TagManager"
+PluginsInstalled[] = "Tour"
+PluginsInstalled[] = "Transitions"
+PluginsInstalled[] = "TwoFactorAuth"
+PluginsInstalled[] = "UserCountry"
+PluginsInstalled[] = "UserCountryMap"
+PluginsInstalled[] = "UserId"
+PluginsInstalled[] = "UserLanguage"
 PluginsInstalled[] = "UsersFlow"
-PluginsInstalled[] = "HeatmapSessionRecording"
+PluginsInstalled[] = "UsersManager"
+PluginsInstalled[] = "VisitFrequency"
+PluginsInstalled[] = "VisitTime"
+PluginsInstalled[] = "VisitorInterest"
+PluginsInstalled[] = "VisitsSummary"
+PluginsInstalled[] = "WebsiteMeasurable"
+PluginsInstalled[] = "Widgetize"
+
+[HeatmapSessionRecording]
+add_tracking_code_only_when_needed = 1
+session_recording_sample_limits = "50,100,250,500,1000,2000,5000"
+load_css_from_db = 1
+max_time_allowed_on_page_column_limit = "9.2233720368548E+18"
+default_heatmap_width = 1920
+
+[UsersFlow]
+UsersFlow_num_max_steps = 10
+UsersFlow_num_max_rows_in_actions = 100
+UsersFlow_num_max_links_per_interaction = 5000