Add Plausible to your Terraform CloudFront distribution

Stock blog image 1

At Vicktor we take data very serious, that's why we have fully adopted Plausible as a simple and privacy-friendly Google Analytics alternative.

"Plausible is lightweight and open source web analytics. No cookies and fully compliant with GDPR, CCPA and PECR. Made and hosted in the EU, powered by European-owned cloud infrastructure 🇪🇺."

For our infrastructure-as-code we use Terraform in order to manage a lot of Amazon Web Services resources. CloudFront is the CDN we use which sits in front of all our websites.

With the instructions below you should be able to setup Plausible into your infrastructure in a best practice way and make use of your own domain name to prevent adblockers block plausible events.

The first step is to add plausible.io as an origin into the aws_cloudfront_distribution resource:

origin {
  domain_name = "plausible.io"
  origin_id   = "PlausibleOrigin"

  custom_origin_config {
    http_port              = 80
    https_port             = 443
    origin_protocol_policy = "https-only"
    origin_ssl_protocols   = ["TLSv1.2"]
  }
}

Now use the PlausibleOrigin to add the following cache behaviors:

ordered_cache_behavior {
  path_pattern     = "/js/script.*"
  allowed_methods  = ["GET", "HEAD"]
  cached_methods   = ["GET", "HEAD"]
  compress         = false
  target_origin_id = "PlausibleOrigin"

  forwarded_values {
    query_string = false
    headers      = ["none"]

    cookies {
      forward = "none"
    }
  }

  viewer_protocol_policy = "https-only"

  min_ttl     = 0
  default_ttl = 0
  max_ttl     = 0
}

ordered_cache_behavior {
  path_pattern     = "/api/event"
  allowed_methods  = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
  cached_methods   = ["GET", "HEAD"]
  compress         = false
  target_origin_id = "PlausibleOrigin"

  forwarded_values {
    query_string = false
    headers      = ["referer", "user-agent"]

    cookies {
      forward = "none"
    }
  }

  viewer_protocol_policy = "https-only"

  min_ttl     = 0
  default_ttl = 0
  max_ttl     = 0
}

Finally you can use your own domain in the script tag, like:

<script defer data-domain="vicktor.nl" src="https://vicktor.nl/js/script.js"></script>

Tip: if you use Wagtail, you should definitely checkout our wagtail-analytics package which makes adding Plausible (with custom domains) very easy per site.