implemented cross-domain matomo tracking on nginx level

README.md

@@ -33,29 +33,11 @@ This software shipts the following tools which are natively setup on the server:
 - [Backups Cleanup](./roles/cleanup-backups-timer/README.md) - Cleans up old backups
 - [Btrfs Health Check](./roles/health-btrfs/README.md) - Checks the health of Btrfs file systems
 - [Docker Health Check](./roles/health-docker-container/) - Checks the health of docker containers
-- [Docker Reverse Proxy](./roles/docker-reverse-proxy/README.md) - Docker Reverse Proxy Solution
+- [Docker Reverse Proxy](./roles/nginx-docker-reverse-proxy/README.md) - Docker Reverse Proxy Solution
 - [Docker Volume Backup](./roles/backup-docker-to-local/) - Backup Solution for Docker Volumes
 - [Pull Primary Backups](./roles/backup-remote-to-local/README.md) - Pulls the backups from another server and stores them
 - [Wireguard](./roles/wireguard/README.md) - Integrates the server in an wireguard vpn
 
-### Server Administration
-
-#### Cleanup docker
-``bash
-docker stop $(docker ps -aq); docker rm $(docker ps -aq); docker volume rm $(docker volume ls -q);
-``
-
-#### Restart
-
-To mercifull restart the server and to prevent data lost type in: 
-
-``bash
-docker stop $(docker ps -a -q) && systemctl stop docker && shutdown -r +2 "The system will shutdown in 2 minutes"
-``
-
-May it's neccessary to restart some of the the docker containers manual afterwards. 
-
-
 ## Personal Computers
 
 This playbooks offers the setup of Manjaro GNOME clients.
@@ -84,6 +66,13 @@ Run:
 ansible-galaxy collection install -r requirements.yml
 ```
 
+## Addidional Parameters
+
+- activate_all_timers (bool): Activates matomo tracking on all html pages
+- nginx_matomo_tracking_active (bool): Activates matomo tracking on all html pages
+
+The role specific parameters are descriped in the readme.md of the roles
+
 ## Author
 
 Kevin Veen-Birkenbach  

group_vars/all

@@ -29,4 +29,9 @@ size_percent_cleanup_disc_space:              90
 path_administrator_home:                      "/home/administrator/"
 path_administrator_scripts:                   "{{path_administrator_home}}scripts/"
 path_docker_volumes:                          "{{path_administrator_home}}volumes/docker/"
-path_docker_compose_files:                    "{{path_administrator_home}}docker-compose/"
+path_docker_compose_files:                    "{{path_administrator_home}}docker-compose/"
+
+# Runtime Variables
+activate_all_timers (bool):     false   # Activates all timers, independend if the handlers had been triggered
+nginx_matomo_tracking_active:   false   # Activates matomo tracking on all html pages
+execute_updates:                true    # Executes updates

playbook.yml

@@ -1,9 +1,11 @@
 ---
-- name:   general setup
+- name: general setup
   hosts:  all
   become: true
+  tasks:
   roles:
-    - update
+    - role: update
+      when: execute_updates is true
 
 - name: servers host setup
   hosts: servers
@@ -36,7 +38,7 @@
 
 # Native Webserver Roles
 - name: setup nginx-homepages
-  hosts: nginx-homepage
+  hosts: homepage
   become: true
   roles:
    -  role: nginx-homepage

roles/docker-akaunting/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-akaunting/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: register directory

roles/docker-attendize/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-attendize/tasks/main.yml

@@ -7,13 +7,13 @@
 
 - name: configure {{domain}}.conf
   template: 
-    src: roles/docker-reverse-proxy/templates/domain.conf.j2 
+    src: roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 
     dest: /etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 #- name: configure {{ mail_interface_domain }}.conf
 #  template: 
-#    src: roles/docker-reverse-proxy/templates/domain.conf.j2 
+#    src: roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 
 #    dest: /etc/nginx/conf.d/{{ mail_interface_domain }}.conf
 #  vars:
 #    http_port: "{{ mail_interface_http_port }}"

roles/docker-baserow/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-baserow/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "create {{docker_compose_path}}"

roles/docker-bigbluebutton/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-elk/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-elk/tasks/main.yml

@@ -4,7 +4,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: create elasticsearch-sysctl.conf

roles/docker-funkwhale/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-funkwhale/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "create {{docker_compose_path}}"

roles/docker-gitea/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-gitea/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}} https
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "create {{path_docker_compose_folder}}"

roles/docker-jenkins/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-jenkins/tasks/main.yml

@@ -2,7 +2,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "docker jenkins"

roles/docker-joomla/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-joomla/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "create {{path_docker_compose_folder}}"

roles/docker-mailu/meta/main.yml

@@ -1,3 +1,3 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy
 - systemd_notifier

roles/docker-mailu/tasks/main.yml

@@ -6,7 +6,7 @@
 - name: configure {{domain}}.conf
   vars:
     client_max_body_size: "31M"
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "create {{path_docker_compose_files}}mailu"

roles/docker-mastodon/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-mastodon/templates/mastodon.conf.j2

@@ -8,6 +8,11 @@ server {
 
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
+  {% if nginx_matomo_tracking_active | default(False) %}
+    {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
+  {% endif %}
+
+
   keepalive_timeout    70;
   sendfile             on;
   client_max_body_size 80m;
@@ -23,7 +28,7 @@ server {
 
   add_header Strict-Transport-Security "max-age=31536000";
 
-  {% include 'roles/docker-reverse-proxy/templates/proxy_pass.conf.j2' %}
+  {% include 'roles/nginx-docker-reverse-proxy/templates/proxy_pass.conf.j2' %}
 
   location /api/v1/streaming {
     proxy_set_header Host $host;

roles/docker-matomo/README.md

@@ -18,7 +18,7 @@ This Ansible role deploys a Matomo analytics platform instance using Docker.
 
 ## Dependencies
 
-- `docker-reverse-proxy`: An Ansible role for configuring the reverse proxy.
+- `nginx-docker-reverse-proxy`: An Ansible role for configuring the reverse proxy.
 
 ## Example Playbook
 

roles/docker-matomo/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-matomo/tasks/main.yml

@@ -4,7 +4,7 @@
 
 - name: configure {{domain}}.conf
   template: 
-    src:  "roles/docker-reverse-proxy/templates/domain.conf.j2"
+    src:  "roles/nginx-docker-reverse-proxy/templates/domain.conf.j2"
     dest: "/etc/nginx/conf.d/{{domain}}.conf"
   notify: restart nginx
 

roles/docker-mediawiki/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-mediawiki/tasks/main.yml

@@ -2,7 +2,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "docker mediawiki"

roles/docker-mybb/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-mybb/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: create data folder

roles/docker-nextcloud/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-nextcloud/templates/nextcloud.conf.j2

@@ -4,6 +4,10 @@ server
 
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
+  {% if nginx_matomo_tracking_active | default(False) %}
+    {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
+  {% endif %}
+
   # Remove X-Powered-By, which is an information leak
   fastcgi_hide_header X-Powered-By;
 
@@ -15,7 +19,7 @@ server
   client_body_buffer_size 400M;
   fastcgi_buffers 64 4K;
 
-  {% include 'roles/docker-reverse-proxy/templates/proxy_pass.conf.j2' %}
+  {% include 'roles/nginx-docker-reverse-proxy/templates/proxy_pass.conf.j2' %}
 
   location ^~ /.well-known {
     rewrite ^/\.well-known/host-meta\.json  /public.php?service=host-meta-json  last;

roles/docker-peertube/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-peertube/templates/peertube.conf.j2

@@ -8,6 +8,11 @@ server {
 
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
+  {% if nginx_matomo_tracking_active | default(False) %}
+    {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
+  {% endif %}
+
+
   ##
   # Application
   ##

roles/docker-pixelfed/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-pixelfed/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "create {{docker_compose_path}}"

roles/docker-roulette-wheel/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-roulette-wheel/tasks/main.yml

@@ -3,7 +3,7 @@
   command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
 
 - name: configure {{domain}}.conf
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
   notify: restart nginx
 
 - name: "create {{docker_compose_path}}"

roles/docker-wordpress/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-wordpress/tasks/main.yml

@@ -7,7 +7,7 @@
   vars:
     client_max_body_size: "{{wordpress_max_upload_size}}"
     domain: "{{item}}"
-  template: src=roles/docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{ item }}.conf
+  template: src=roles/nginx-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{ item }}.conf
   loop: "{{domains}}"
   notify: restart nginx
 

roles/docker-yourls/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- docker-reverse-proxy
+- nginx-docker-reverse-proxy

roles/docker-yourls/tasks/main.yml

@@ -4,7 +4,7 @@
 
 - name: configure {{domain}}.conf
   template: 
-    src:  "roles/docker-reverse-proxy/templates/domain.conf.j2"
+    src:  "roles/nginx-docker-reverse-proxy/templates/domain.conf.j2"
     dest: "/etc/nginx/conf.d/{{domain}}.conf"
   notify: restart nginx
 

roles/nginx-docker-reverse-proxy/README.md

@@ -1,4 +1,4 @@
-# role docker-reverse-proxy
+# role nginx-docker-reverse-proxy
 
 Uses nginx as an [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy) for local docker applications.
 

roles/nginx-docker-reverse-proxy/templates/domain.conf.j2

@@ -2,6 +2,11 @@ server
 {
   server_name {{domain}};
 
+  {% if nginx_matomo_tracking_active | default(False) %}
+    {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
+  {% endif %}
+
+
   {% if client_max_body_size is defined %}
     client_max_body_size {{ client_max_body_size }};
   {% endif %}

roles/nginx-homepage/templates/homepage.nginx.conf.j2

@@ -5,6 +5,10 @@ server
   
   {% include 'roles/letsencrypt/templates/ssl_header.j2' %}
 
+  {% if nginx_matomo_tracking_active | default(False) %}
+    {% include 'roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2' %}
+  {% endif %}
+
   charset utf-8;
   
   location /

roles/nginx-matomo-tracking/Readme.md

@@ -0,0 +1,35 @@
+# Nginx Matomo Tracking Role
+
+This Ansible role automates the integration of Matomo tracking code into Nginx-served websites. It simplifies the process of adding the Matomo analytics tracking script and image tracker to all your web pages served through Nginx.
+
+## Features
+- Automated insertion of Matomo tracking script into the `</head>` tag of HTML pages.
+- Integration of a noscript image tracker before the `</body>` tag for tracking users with JavaScript disabled.
+- Configuration to apply changes on every request, ensuring that dynamic content and single-page applications are also tracked.
+
+## Requirements
+- Nginx installed on the target server.
+- Matomo analytics platform set up and accessible.
+
+## Role Variables
+- `matomo_domain`: The domain of your Matomo installation.
+- `base_domain`: The base domain of the website you wish to track.
+- `matomo_site_id`: The site ID configured in your Matomo dashboard.
+
+## Dependencies
+- None. This role is designed to be included in Nginx server block configurations.
+
+## Example Usage
+To enable Matomo tracking on your Nginx website, include the role in your playbook and set the required variables.
+
+```yaml
+- hosts: webserver
+  roles:
+    - { role: nginx-matomo-tracking, matomo_domain: 'matomo.example.com', base_domain: 'example.com', matomo_site_id: '1' }
+```
+
+## Customization
+You can customize the tracking script and the noscript image tracker by editing the `matomo-tracking.js.j2` and `matomo-tracking.conf.j2` templates.
+
+## Author Information
+This role was created in 2023 by Kevin Veen Birkenbach, providing a seamless way to add Matomo analytics to any website served via Nginx.

roles/nginx-matomo-tracking/tasks/main.yml

@@ -0,0 +1,38 @@
+- name: Check if site already exists in Matomo
+  uri:
+    url: "https://{{matomo_domain}}/index.php?module=API&method=SitesManager.getSitesIdFromSiteUrl&url=https://{{base_domain}}&format=json&token_auth={{matomo_auth_token}}"
+    method: GET
+    return_content: yes
+    status_code: 200
+    validate_certs: yes
+  register: site_check
+
+- name: Set fact for site ID if site already exists
+  set_fact:
+    matomo_site_id: "{{ site_check.json[0].idsite }}"
+  when: "(site_check.json | length) > 0"
+
+- name: Add site to Matomo and get ID if not exists
+  uri:
+    url: "https://{{ matomo_domain }}/index.php"
+    method: POST
+    body: "module=API&method=SitesManager.addSite&siteName={{ base_domain }}&urls=https://{{ base_domain }}&token_auth={{ matomo_auth_token }}&format=json"
+    body_format: form-urlencoded
+    status_code: 200
+    return_content: yes
+    validate_certs: yes
+  register: add_site
+  when: "matomo_site_id is not defined"
+
+- name: Set fact for site ID if site was added
+  set_fact:
+    matomo_site_id: "{{ add_site.json.value }}"
+  when: "matomo_site_id is not defined"
+
+- name: Set the Matomo tracking code from a template file
+  set_fact:
+    matomo_tracking_code: "{{ lookup('template', 'matomo-tracking.js.j2') }}"
+
+- name: Set the tracking code as a one-liner
+  set_fact:
+    matomo_tracking_code_one_liner: "{{ matomo_tracking_code | regex_replace('\\n', '') | regex_replace('\\s+', ' ') }}"

roles/nginx-matomo-tracking/templates/matomo-tracking.conf.j2

@@ -0,0 +1,5 @@
+# sub filters to integrate matomo tracking code in nginx websites
+sub_filter '</head>' '<script>{{matomo_tracking_code_one_liner}}</script></head>';
+sub_filter '</body>' '<noscript><p><img src="//matomo.veen.world/matomo.php?idsite={{matomo_site_id}}&rec=1" style="border:0;" alt="" /></p></noscript></body>';
+sub_filter_once off;
+# sub_filter_types text/html; This is standart

roles/nginx-matomo-tracking/templates/matomo-tracking.js.j2

@@ -0,0 +1,14 @@
+var _paq = window._paq = window._paq || [];
+_paq.push(["setCookieDomain", "*.{{base_domain}}"]);
+_paq.push(["setDomains", ["*.{{base_domain}}"]]);
+_paq.push(["enableCrossDomainLinking"]);
+_paq.push(["trackPageView"]);
+_paq.push(["trackAllContentImpressions"]);
+_paq.push(["enableLinkTracking"]);
+(function() {
+  var u="//{{matomo_domain}}/";
+  _paq.push(["setTrackerUrl", u+"matomo.php"]);
+  _paq.push(["setSiteId", "{{matomo_site_id}}"]);
+  var d=document, g=d.createElement("script"), s=d.getElementsByTagName("script")[0];
+  g.async=true; g.src=u+"matomo.js"; s.parentNode.insertBefore(g,s);
+})();                

roles/nginx-matomo-tracking/vars/main.yml

@@ -0,0 +1,2 @@
+matomo_domain: "matomo.{{top_domain}}"
+base_domain: "{{ domain | regex_replace('^(?:.*\\.)?(.+\\..+)$', '\\1') }}"

roles/nginx/tasks/main.yml

@@ -9,6 +9,11 @@
     state: directory
     mode: 0755
 
+- name: Activate NGINX matomo tracking
+  include_role:
+    name: nginx-matomo-tracking
+  when: nginx_matomo_tracking_active and domain is defined
+
 - name: create nginx config file
   template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
   notify: restart nginx