Build your own first-party analytics box (a personal PostHog)

Build a Node 22 analytics collector skeleton. Requirements:
- Single Express app in server.js, dependencies limited to express, better-sqlite3, and dotenv, listening on port 8787.
- Create events.db beside server.js with an events table: id, site, event_name, path, referrer, utm_source, utm_medium, utm_campaign, country, device_class, properties (JSON text), visitor_id (nullable for now), created_at (ISO 8601).
- POST /e accepts JSON with those fields, requires site and event_name, returns 400 on unknown fields, inserts the row; verify with a curl POST followed by SELECT count(*) from events increasing by 1.
- GET /health returns { ok: true } plus the current row count.
- Port and SQLite path load from .env via dotenv; commit a .env.example, never the real .env.
- Out of scope: authentication, dashboards, ORM libraries, migration tooling, plain prepared statements only.
- Honest pain note: better-sqlite3 compiles native code on install, pin Node 22 or the build fails loudly.

Add tracker.js and route collection through your own domain. Requirements:
- Serve a dependency-free tracker.js under 80 lines from GET /tracker.js on the collector built in the previous step.
- On page load and on history pushState changes, POST a pageview to https://analytics.YOURDOMAIN/e with site, event_name 'pageview', path, referrer, and UTM parameters parsed from the URL.
- Expose window.track(name, props) that sends custom events with properties serialized into the JSON properties column.
- Use navigator.sendBeacon with a fetch keepalive fallback, never block rendering, never set cookies or localStorage.
- Reverse-proxy /e on your subdomain to the collector's /e route so requests never leave your domain.
- Out of scope: click autocapture, SPA routers other than the history API, user ids, consent banner logic.
- Honest pain note: Safari and some extensions strip referrer data, expect blank referrers on a slice of traffic.
- Verify by pasting the snippet on a real page and watching one pageview row arrive with today's date.

Set up anonymous visitor counting with a rotating salt. Requirements:
- Generate a 32-character DAILY_SALT into .env at install time, never commit the real value.
- Inside the /e handler from step 2, compute sha256(current salt + ip + user agent), truncate to 16 hex chars, store as visitor_id, and discard the raw inputs.
- Never write raw IPs or full user agent strings to disk or logs anywhere in the codebase.
- Rotate the salt at 00:00 UTC with an in-process timer and document that day-over-day counts shift slightly as a result.
- Add GET /api/days returning date, distinct visitor_id count, and pageview count for the trailing 30 days.
- Add columns with ALTER TABLE guarded by a existence check so rerunning the migration is harmless.
- Out of scope: fingerprinting libraries, returning-visitor cookies, cross-device identity stitching.
- Verify by browsing your site, then confirm the events table has visitor_id filled in and no ip column exists.

Build the authenticated stats API over the existing events table. Requirements:
- Protect /api/* with basic auth, credentials in DASH_USER and DASH_PASS in .env.
- GET /api/summary?from=YYYY-MM-DD&to=YYYY-MM-DD returns per-day visitors, pageviews, and a bounce proxy (single-page visits divided by total visits).
- GET /api/top?dim=page|referrer|country with from and to returns the top 10 rows with counts.
- GET /api/event?name=signup&prop=plan splits one named event by one property using json_extract on the properties column.
- GET /api/funnel?steps=a,b,c counts distinct visitor_id values reaching each ordered step within the range.
- Parameterize every query and return 400 for malformed dates.
- Out of scope: caching layers, chart rendering, GraphQL.
- Honest pain note: funnel queries over raw rows get slow near 100k events, the nightly rollup planned in a later step is the intended fix.

Build a single-page dashboard consuming the /api endpoints from the previous step. Requirements:
- One file public/dashboard.html with vanilla JavaScript, no framework, no build step, served at / behind the same basic auth.
- Fetch /api/summary, /api/top, /api/event, and /api/funnel using the exact parameter names already defined, no client-side reshaping beyond number formatting.
- Render the daily series as a canvas line chart (uPlot from CDN is acceptable), top lists as tables, the funnel as labeled horizontal bars.
- Include a date range picker with 7, 30, and 90 day presets plus custom from and to inputs.
- Handle empty ranges and missing property values gracefully, never throw on null.
- Out of scope: dark mode, saved views, team accounts, CSV buttons.
- Verify by loading the page in a browser and matching the numbers the API returns via curl.

Add the operations layer that keeps collection alive unattended. Requirements:
- Nightly job at 02:00 UTC building a daily_summary table (day, visitors, pageviews, top_referrer) from events, then deleting raw rows older than RETENTION_DAYS from .env.
- GET /export.csv streams the surviving raw rows as CSV with a header row, gated by the existing basic auth.
- scripts/backup.sh copies events.db to a timestamped file and rsyncs it to an OFFBOX_PATH configured in .env.
- Install analytics.service as a systemd unit running server.js with Restart=always, enabled at boot.
- Append a timestamped heartbeat line to heartbeat.txt every minute so silent stalls become detectable.
- Out of scope: alerting services, multi-node deployments, database replication.
- Honest pain note: pruning raw rows means old funnels lose path-level detail and only summary totals survive, so pick RETENTION_DAYS deliberately.