Perimattic Managed Self-Hosted Web Analytics Suite

This AMI runs a self-hosted web analytics suite with MariaDB 11.8 on Ubuntu 24.04 LTS. It measures visits to your websites and apps with reports on pages, referrers, goals, e-commerce, events, devices and real-time visitors, with a tracking script, a tracking API, user and permission management and privacy settings such as IP anonymisation. Your data stays on your own server. The upstream vendor image (Apache variant), release 5.14.2, is pinned together with MariaDB 11.8.9 and baked into the AMI, so first start does not depend on a registry.

What Perimattic adds

Installation completed for you: a fresh install lets the first visitor run the installation wizard and become the super user. During first-login setup this AMI completes the wizard itself, on the loopback port, before the site is published: database, tables, a super user (user name admin, your email address and a random 24-character password generated on your server) and a sample website. It then switches the installer off, so the wizard is gone, and checks that the password works, that a wrong password is refused, that anonymous API calls are refused and that exactly one real account exists. The database passwords are generated per instance; there are no default or shared credentials in the image.

Configured for production behind Apache: trusted_hosts is your domain, force_ssl is on, visitor addresses come from Apache's X-Forwarded-For, IP anonymisation is on, and browser-triggered archiving is replaced by a cron job on the server that runs the archiver every 15 minutes (the host's cron service is required and is checked by the tests). Internet features are switched off (enable_internet_features = 0, enable_auto_update = 0), so the plugin marketplace, update checks and downloads from the vendor's servers are off, and the GeoIP database is not downloaded.

HTTPS: Apache is configured as a reverse proxy and a free Let's Encrypt certificate is requested for your domain with certbot. The application listens only on the loopback interface and MariaDB is reachable only inside the Docker network. The configuration file holding the database password is readable only by its owner and group.

Patched base: Ubuntu 24.04 LTS built through an automated EC2 Image Builder pipeline, with security updates applied at build time.

What you should know

The tracker is public by design: the tracking endpoint and the tracking script must be reachable by your visitors' browsers, so they are open and accept page views for any site ID. Reports and the API need a login or a token.

The vendor's commercial premium plugins are not part of this image, and the plugin marketplace is switched off, so they cannot be installed from it. The built-in features are available.

No mail server is configured, so reports, invitations and password-reset emails cannot be sent until you add SMTP settings under Administration (use port 587 or 465: Amazon EC2 blocks outbound port 25). Without a GeoIP database visitor country and city are not resolved until you add one in the geolocation settings.

The suite is moderate: about 125 to 290 MB of memory for the application and about 140 to 150 MB for MariaDB in our tests, so a t3.small (2 GB) is the recommended starting size for small sites; busy sites need more.

Licence and attribution

Built on the open-source Matomo (GPL-3.0-or-later; the upstream repository lists a few separately licensed libraries, for example the JavaScript tracker under the BSD licence). The image is unmodified and the source is at github.com/matomo-org/matomo. Not affiliated with, endorsed by, or sponsored by InnoCraft Ltd or the Matomo project; Matomo is a trademark of its owner. MariaDB Server is released under GPL-2.0.

Getting Started Launch the AMI and open ports 22, 80 and 443 in the security group SSH in and answer the setup prompts (domain and admin email) Open https://your-domain  and sign in as admin with the password printed at the end of setup Add your website and paste the tracking code into your pages

A domain name with an A record pointing at the instance is required, because the site is served over HTTPS.

This AMI is built and supported by Perimattic.

Book a free setup consultation at https://cal.com/gaurav-pareek-perimattic/marketplace-setup-consultations  or email us at aws-support@perimattic.com .

Support Managed and supported by Perimattic, a cloud infrastructure company with 13+ years of experience serving global clients. We offer free setup assistance, custom integrations, infrastructure consulting, and 24/7 support.