How to Install Fathom Privacy Focused Web Analytics on Debian 12

This tutorial exists for these OS versions

Debian 12 (Bookworm)
Debian 11 (Bullseye)

Fathom is privacy-focused web analytics that delivers clean and concise data about your websites. It's a simple website analytics program that provides insightful reporting and metrics about your sites. Fathom is created as an alternative to Google Analytics, but it doesn't invade users' privacy and doesn’t compromise visitor data. It's GDPR compliant with no cookie banners required.

Fathom is available in two versions, the open-source version that can be installed on your server, and the pro version that you can purchase from the official Fathom website. Notable Fathom website analytics users are IBM, Laravel, GitHub, Hoshicord, BOSCH, McLaren, VueJS, and many more.

In this guide, we'll go over the Fathom Privacy Focused Web Analytics installation on the Debian 12 server step-by-step. We'll over the Fathom installation with PostgreSQL as the database and Nginx as the reverse proxy. Furthermore, we'll also secure Fathom with SSL/TLS certificates from Letsencrypt.

Prerequisites

Before proceeding, ensure you have the following:

A Debian 12 server.
A non-root user with administrator privileges.
A domain name pointed to a server IP address.

Installing Dependencies

Fathom is a privacy-focused web analytics built on top of Golang and Preact. It supports databases such as PostgreSQL, MySQL, and SQLite, and can be run with Nginx reverse proxy. Now you will install package dependencies for Fathom, such as PostgreSQL, Nginx, Certbot, and UFW (Uncomplicated Firewall).

First, execute the apt command below to update your Debian repository.

sudo apt update

Now install dependencies by executing the following command. With this, you will install the PostgreSQL server, Nginx web server, Certbot, Nginx Certbot plugin, and UFW (Uncomplicated Firewall).

sudo apt install postgresql nginx certbot python3-certbot-nginx ufw

Type y to proceed with the installation.

After dependencies are installed, you will ensure that every dependency is available on your system.

Verify the postgresql service using the command below to ensure that the service is running and enabled.

sudo systemctl is-enabled postgresql
sudo systemctl status postgresql

The following result will be shown on your terminal, which indicates that postgresql is running and enabled.

Next, verify the nginx service by executing the following command.

sudo systemctl is-enabled nginx
sudo systemctl status nginx

A similar output will be printed on your terminal that indicates the nginx service is running and enabled.

Lastly, verify the certbot by executing the following command. This will locate the binary executable file of certbot and check the current certbot version that is installed on your system.

which certbot
certbot --version

The displayed output will show you that Certbot 2.1 is installed at /usr/bin/certbot.

Configuring Firewall

After installing dependencies, you will configure UFW to secure your Debian machine. You will open ports for SSH, HTTP, and HTTPS on your system.

Execute the following command to open ports for SSH, HTTP, and HTTPS protocols. The OpenSSH profile will open port 22/tcp, and the WWW Full profile will open both HTTP and HTTPS - ports 80 and 443.

sudo ufw allow OpenSSH
sudo ufw allow "WWW Full"

Now run the below command to start and enable UFW on your Debian system.

sudo ufw enable

Type y to proceed with the confirmations. When successful, you should get the message "Firewall is active and enabled on system startup".

Lastly, verify the UFW status using the command below.

sudo ufw status

The output active indicates that UFW is running and enabled, you should also see the OpenSSH and WWW Full profiles added to UFW.

Creating PostgreSQL Database and User

In the following step, you will create a new PostgreSQL database and user that Fathom will use. To do that, you must log in to the PostgreSQL server via the psql command line.

Execute the following command to log in to the PostgreSQL server.

sudo -u postgres psql

Create a new database fathomdb and user fathom using the following PostgreSQL queries. be sure to change the password in the following query.

CREATE USER fathom WITH CREATEDB CREATEROLE PASSWORD 'password';
CREATE DATABASE fathomdb OWNER fathom;

Now execute the following queries to verify the list of available databases and users on the PostgreSQL server.

\du
\l

If the database and user are created, the following output will be presented:

Type quit to exit from the PostgreSQL server.

After creating the database and user, execute the following command to log in to PostgreSQL with user fathom and database fathomdb. Input the password for your database user when prompted.

sudo -u postgres psql -U fathom -h 127.0.0.1 -d fathomdb

Once connected to the PostgreSQL server, execute the following query to verify your connection.

\conninfo

After executing the command, the following output will be shown, which indicates that you're connected to the database fathomdb with user fathom.

Type quit again to exit from the PostgreSQL server.

Downloading Fathom Binary File

Fathom is written in Golang and Preact, and it's available as a single binary file that you can easily download and install on your system.

Visit the Fathom GitHub page and grab the download URL for the Fathom binary package. Then, download it via the wget command below. In this example, you will download Fathom 1.3.1.

wget https://github.com/usefathom/fathom/releases/download/v1.3.1/fathom_1.3.1_linux_amd64.tar.gz

Once downloaded, extract the Fathom binary package to /usr/local/bin/fathom and make it executable via the following command.

tar -C /usr/local/bin -xzf fathom_1.3.1_linux_amd64.tar.gz
chmod +x /usr/local/bin/fathom

Lastly, run the following command to verify the fathom binary file location and the current fathom version that you've downloaded.

which fathom
fathom --version

The following output shows you Fathom 1.3.1 is installed on /usr/local/bin/fathom.

Configuring Fathom

In the following step, you will configure Fathom by:

Integrating Fathom with PostgreSQL database.
Running Fathom in the background as a systemd service.
Adding administrator user for your Fathom installation.

Integration with PostgreSQL as Database

Fathom supports multiple databases, such as SQLite (default), MySQL, and MariaDB. In this section, you will set up the Fathom installation directory and integrate Fathom with PostgreSQL database server.

Execute the following command to create a new system user fathom that will be used to run your Fathom installation.

sudo useradd -r -d /opt/fathom fathom

Now create a new home directory /opt/fathom and change the ownership to user fathom. The directory /opt/fathom will be used for storing Fathom installation data.

sudo mkdir -p /opt/fathom
sudo chown -R fathom:fathom /opt/fathom

After that, run the command below to generate a random secret for Fathom. Be sure to copy the output because you will need it for securing fathom.

head /dev/urandom | tr -dc A-Za-z0-9 | head -c 20 ; echo ''

Next, move to the /opt/fathom directory.

cd /opt/fathom

Then, create a new /opt/fathom/data directory and a new file /opt/fathom/data/.env using the following command.

sudo -u fathom mkdir -p /opt/fathom/data
sudo -u fathom nano /opt/fathom/data/.env

Insert the following configuration and be sure to change the details of the PostgreSQL database name, user, and password.

FATHOM_GZIP=true
FATHOM_DEBUG=true
FATHOM_DATABASE_DRIVER="postgres"
FATHOM_DATABASE_NAME="fathomdb"
FATHOM_DATABASE_USER="fathom"
FATHOM_DATABASE_PASSWORD="password"
FATHOM_DATABASE_HOST="127.0.0.1"
FATHOM_DATABASE_SSLMODE="disable"
FATHOM_SECRET="BWTtur9A1qWtXG6656q4"

Save and exit the file when finished.

Lastly, run the following command to ensure that your Fathom configuration is successful.

cd /opt/fathom/data
sudo -u fathom fathom server

After executing the command, Fathom should be running on localhost with default port 8080, and the following output will be printed to your terminal:

Press Ctrl+c to terminate the process.

Running Fathom in the Background as Systemd Service

In the following section, you will create a new systemd service file that will be used to run Fathom in the background. With this, you can easily manage Fathom via the systemctl utility.

Create a new systemd service file /etc/systemd/system/fathom.service using the following nano editor command.

sudo nano /etc/systemd/system/fathom.service

Insert the following configuration into the file.

[Unit]
Description=Starts the fathom server
Requires=network.target
After=network.target

[Service]
Type=simple
User=fathom
Restart=always
RestartSec=3
WorkingDirectory=/opt/fathom/data
ExecStart=/usr/local/bin/fathom server

[Install]
WantedBy=multi-user.target

Save and close the file when you're done.

Next, run the following systemctl command to reload the systemd manager and apply the changes that you've made.

sudo systemctl daemon-reload

Once the systemd manage is reloaded, execute the systemctl command below to start and enable the fathom service. This will run Fathom in the background on localhost with default port 8080.

sudo systemctl start fathom
sudo systemctl enable fathom

Verify the fathom service using the below command to ensure that the service is running and enabled.

sudo systemctl is-enabled fathom
sudo systemctl status fathom

The following output will be presented if fathom is running and enabled.

Adding Fathom Administrator User

Now that Fathom is running in the background as a service, the next section is to create an administrator user for your Fathom installation. This can be done via the fathom command line.

To create a Fathom user, you can run the fathom command line from the fathom data directory.

Move your current working directory to /opt/fathom/data.

cd /opt/fathom/data

Execute the following command to create an administrator user for your Fathom installation. Be sure to change the email address and password with the following command.

sudo -u fathom fathom user add --email="[email protected]" --password="password"

The command will use the .env file to connect to the PostgreSQL server. Once the user is created, you should get the confirmation like the following:

Configuring Nginx as a Reverse Proxy

At this point, you've finished the configuration of Fathom. You will configure Nginx as a reverse proxy for your Fathom installation in the following step. Before going further, ensure that you have a domain name pointed to the server IP address.

Create a new Nginx server block configuration /etc/nginx/sites-available/fathom using the nan editor command below.

sudo nano /etc/nginx/sites-available/fathom

Insert the following configuration and be sure to change the domain name within the server_name option.


server {
    listen 80;
    server_name analytics.howtoforge.local;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:8080; 
    }
}

When you're done, save and exit the file.

Now run the following command to activate the server block file /etc/nginx/sites-available/fathom and verify Nginx syntax.

sudo ln -s /etc/nginx/sites-available/fathom /etc/nginx/sites-enabled/
sudo nginx -t

If you've proper syntax, the output "syntax is ok - test is successful" should be printed to your terminal.

Next, run the following command to restart the Nginx service and apply the changes that you've made. After executing the command, your Fathom installation should be accessible from your domain name.

sudo systemctl restart nginx

Lastly, run the following certbot command to secure Fathom installation with SSL/TLS certificates from Letsencrypt. Be sure to change the domain name and email address details with your information.

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email [email protected] -d analytics.howtoforge.local

Once the process is finished, your SSL/TLS certificates will be available in the /etc/letsencrypt/live/domain.com directory. Also, the Nginx server block file /etc/nginx/sites-available/fathom is configured with HTTPS automatically via the Certbot Nginx plugin.

Accessing Fathom

Launch your preferred web browser and visit the domain name of your Fathom installation, such as http://analytics.howtoforge.local/. You should be redirected automatically to an HTTPS connection and you should get the Fathom login page.

Input your admin email address and password, then click Sign in.

Click Create site to create first tracker.

You should see the tracker code generated by Fathom.

Below details Fathom site analytics.

From here, you can add and set new trackers for your websites.

Conclusion

To conclude, you've completed the installation of Fathom privacy-focused web analytics on the Debian 12 server with PostgreSQL database server and Nginx as a reverse proxy. You've also secured your installation with SSl/TLS certificates from Letsencrypt and configured UFW (Uncomplicated Firewalld on your Debian server. You can add a new tracker and implement it on your websites.