Tags

Release 1.4.0

- **Change defaults for `-listen`** (#336)

  The default for the `-listen` flag changed from `localhost:8081` to `:443`,
  which is probably a better and less confusing default for most people. There
  is also some more detailed docs available in `goatcounter help listen`.

- Set Cache-Control header for static files (#348)

  The `Cache-Control` header is now set for static files. Since the "cache
  busting" happens based on the goatcounter version it's now recommended to set
  this if you're compiling GoatCounter yourself. See the updated README for
  instructions.

- Add multi-factor auth (#306)

  TOTP-based multi-factor auth is now supported.

- Better export, export API, add import feature (#316, #318, #329)

  You can now import the CSV exports, useful for migrating from self-hosted to
  goatcounter.com or vice versa, or for migrating from other systems. There is a
  web interface and a `goatcounter import` command.

  The export now supports a "pagination cursor", so you can export only rows you
  didn't previously export. This is especially useful with the new export API.
  which should make it easy to sync GoatCounter data with another external
  platform.

  See http://goatcounter.com/api for details on the export API.

- API for sending pageviews (#357)

  Doing that with the regular `/count` is actually quite painful, as you quickly
  run in to ratelimits, need to set specific headers, etc. Adding an API
  endpoint for that makes things much easier.

- API for creating and editing additional sites (#361)

- Some redesigns (#324, #315, #321 #320)

  The "Totals" is now placed below the Pages; I think it makes more sense there.
  The Y-axis for the totals is now also independent. There's also been a quite a
  few restylings.

- Add "text view" mode (#359)

  View your data as a simple table without too much graphics; only the main
  "Pages" overview is implemented for now.

- Make it easier to skip your own views (#290)

  Previously this required adding custom code, but now loading any page with
  `#toggle-goatcounter` added will enable/disable the GoatCounter tracking for
  that browser.

- Can now manage "additional sites" from self-hosted GoatCounter (#363)

  This wasn't possible before for no other reason than laziness on my part 🙃

- public/count.js is now ISC licensed (#309)

  Previously the EUPL applied, which is fairly restrictive and may prevent
  people from including/self-hosting the count.js script.

- Add `goatcounter db` command

  This is mostly useful for writing deploy scripts: `goatcounter db
  schema-sqlite` prints the SQLite schema, `schema-pgsql` prints the PostgreSQL
  schema, and `goatcounter db test` tests if the database exists.

- Session hashes are no longer persisted to the database

  This is kind of an internal change, but session hashes are now stored in
  memory only and never recorded to the database. There's no real reason to
  persistently store this information, and this is a (small) privacy/GDPR
  compliance improvement.

Set some server http timeouts

When using GoatCounter directly internet-facing it's liable to keep
connections around for far too long, exhausting the max. number of open
file descriptors, especially with "idle" HTTP/2 connections which,
unlike HTTP/1.1 Keep-Alive don't have an explicit timeout.

This isn't much of a problem if you're using a proxy in front of it, as
most will have some timeouts set by default (unlike Go, which has no
timeouts at all by default).

For the backend interface, keeping a long timeout makes sense; it
reduces overhead on requests (TLS setup alone can be >200ms), but for
the /count request we typically want a much shorter timeout.

Unfortunately, configuring timeouts per-endpoint isn't really supported
at this point, although some possible workarounds are mentioned in [1],
it's all pretty ugly.
We can add "Connection: close" to just close the connection, which is
probably much better for almost all cases than keeping a connection open
since most people only visit a single page, and keeping a connection
open in the off-chance they click somewhere again probably isn't really
worth it.

And setting *any* timeout is better than setting *no* timeout at all!

---

In the email conversation about this, the other person mentioned that
some connections linger for hours, so there *may* be an additional
problem either in the Go library or in GoatCounter, since this is a
really long time for a connection to stay open. Then again, it could
also be weird scripts or malicious users 🤔

[1]: https://github.com/golang/go/issues/16100