How to Install Fathom Privacy-Focused Website Analytics on Debian 11

Fathom is privacy-focused web analytics that delivers clean and concise data about your websites. It's a simple website analytics software that provides insightful reporting and metrics about your sites. Fathom is created as an alternative to Google Analytics, but it doesn't invade users' privacy and doesn’t compromise visitor data. It's GDPR compliant, with no cookie banners required.

Fathom is available in two versions, the open-source version that can be installed on your server, and the pro version that you can purchase from the official Fathom website. Notable Fathom website analytics users are IBM, Laravel, GitHub, Hoshicord, BOSCH, McLaren, VueJS, and many more.

This tutorial shows you how to install Fathom Privacy-Focused Website Analytics on a Debian 11 server. You'll perform Fathom installation with PostgreSQL as the database, Nginx web server as the reverse proxy, and also secure Fathom with SSL/TLS certificates via Certbot and Letsencrypt.

Along the way, you'll also learn how to set up authentication on PostgreSQL, create a database and user, and add systemd services to a Linux system.

Prerequisites

To complete this tutorial, you must have the following requirements:

• A Debian 11 server - This example uses a Debian server with the hostname 'fathome-server'.
• A non-root user with sudo/root administrator privileges.
• A domain name pointed to a server IP address - This example uses a sub-domain 'fathom.howtoforge.local'.

That's it. Let's start the Fathom installation.

Installing PostgreSQL Server

Fathom is a simple privacy-focused web analytics built with Golang Preact. On a default installation, Fathom uses SQLite as the database, but also possible to use RDBMS such as MySQL/MariaDB and PostgreSQL.

For this example, you'll be running Fathom with PostgreSQL. So, you'll now install and configure PostgreSQL on your Debian server.

To get started, run the below apt command to update and refresh your Debian package index.

sudo apt update

Now install PostgreSQL packages via the apt command below. This will install the default PostgreSQL server package from the Debian 11 repository, which is PostgreSQL 13.

sudo apt install postgresql

When prompted, input y to confirm and press ENTER to proceed.

After PostgreSQL is installed, you'll be required to set up authentication for the server. To achieve this, you need to modify PostgreSQL config files that are available in the '/etc/postgresql/13/main/' directory (default PostgreSQL on Debian).

Open the file '/etc/postgresql/13/main/postgresql.conf' using your preferred text/code editor. This example uses nano as the default editor.

sudo nano /etc/postgresql/13/main/postgresql.conf

Uncomment the 'password_encryption' parameter and change the default value to 'scram-sha-256'.

password_encryption = scram-sha-256

Save and close the '/etc/postgresql/13/main/postgresql.conf' file when finished. For nano users, press Ctrl+x, then y, and press ENTER.

Next, open the PostgreSQL authentication config file '/etc/postgresql/13/main/pg_hba.conf' using the following nao editor.

sudo nano /etc/postgresql/13/main/pg_hba.conf

Change the default authentication method for the host '127.0.0.1/32' and '::1/128' to 'scram-sha-256'. This will specify the authentication method using 'scram-sha-256' for any connection from localhost to the PostgreSQL server.

When using parameter '-h 127.0.0.1', you'll be connected to PostgreSQL as the host and will be using the scram-sha-256 authentication. When you only use the 'psql' command without specifying the PostgreSQL host, you'll be connected as the local connection and using the 'peer' authentication method.

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# "local" is for Unix domain socket connections only
local   all             all                                     peer
# IPv4 local connections:
host    all             all             127.0.0.1/32            scram-sha-256
# IPv6 local connections:
host    all             all             ::1/128                 scram-sha-256

Save and close the '/etc/postgresql/13/main/pg_hba.conf' file when you're done.

Next, run the below systemctl command utility to restart the PostgreSQL server and apply the changes.

sudo systemctl restart postgresql

Then verify the PostgreSQL server to ensure that it's enabled and running.

sudo systemctl is-enabled postgresql
sudo systemctl status postgresql

If PostgreSQL is running and enabled, you'll see the output on your terminal.

With the PostgreSQL server running and enabled, you'll then start to create a new PostgreSQL database and user for Fathom web analytics.

Setting up PostgreSQL Database and User

In this step, you will set up the password for the default PostgreSQL user 'postgres' via the PostgreSQL shell. Then, you'll create a new database and user that will be used for the Fathom web analytics installation.

Log in to the PostgreSQL shell via the below command. With the 'sudo -u postgres 'psql' command, it means that you will execute the 'psql' command as the user 'postgres'.

cd /var/lib/postgresql
sudo -u postgres psql

After logging in, you should be connected to the default 'postgres' database and your PostgreSQL prompt should become 'postgres=#'.

Now run the below query to create a new password for the default PostgreSQL user 'postgres'. Be sure to change the password in the following query.

ALTER USER postgres WITH PASSWORD 'PostgresP@ssw0rd';

Next, run the following PostgreSQL queries to create a new PostgreSQL user and database. In this example, you'll create a new PostgreSQL user 'fathom' with the database 'fathomdb'.

CREATE USER fathom WITH CREATEDB CREATEROLE PASSWORD 'p4ssw0rdFathom';
CREATE DATABASE fathomdb OWNER fathom;

Lastly, run the below query to verify the list of databases and users on your PostgreSQL server.

\l
\du

Listing databases on PostgreSQL server via '\l' query -And you can see the new database 'fathomdb' is created.

Listing users on PostgreSQL via '\du' query - You can see the new PostgreSQL user 'fathom' added to the PostgreSQL.

At this point, you've now installed and configured the PostgreSQL server. In the next step, you'll start Fathom installation.

Downloading Fathom Binary

Fathom is a small and simple application written in Go and it comes as a single binary file that you can execute anywhen on your Linux system.

Now you'll download Fathom to your Debian server.

Visit the Fathom release page on GitHub and select the preferred version for your installation. This example will be using the latest Fathom version v1.3.0, which is the latest version during this writing.

Download Fathom binary file using the wget command below.

wget https://github.com/usefathom/fathom/releases/download/v1.3.0-rc.1/fathom_1.3.0-rc.1_linux_amd64.tar.gz

Once downloaded, run the tar command below to extract Fathom to the '/usr/local/bin' directory. Then, make the 'fathom' binary file executable via the chmod command.

tar -C /usr/local/bin -xzf fathom_1.3.0-rc.1_linux_amd64.tar.gz
chmod +x /usr/local/bin/fathom

Lastly, the below command to ensure that you can execute the 'fathom' binary file. Then, verify the 'fathom' version.

which fathom
fathom --version

When the command is successful, you should see the full path of the 'fathom' binary file '/usr/local/bin/fathom'. Also, you will see the Fathom version on your terminal.

With the Fathom downloaded, you'll next configure the installation of Fathom web analytics.

Configuring Fathom Web Analytics

In this step, you will set up the installation of Fathom web analytics. You will set up the data directory, set up the PostgreSQL database with Fathom, and lastly, you will run Fathom as a systemd service.

By running Fathom as a systemd service, you can easily manage to Fathom via the systemctl command utility. You can start, enable, and verify the status of Fathom via systemctl.

First, run the below command to create a new user 'fathom' on your Debian system. Also, be sure to set up the password for your new user.

sudo useradd -m -s /bin/bash fathom
sudo passwd fathom

Now run the below command to log in to the new user 'fathom' and start configuring the Fathom installation.

su - fathom

First, run the below command to generate a random string that will be used as the 'FATHOM_SECRET'. Be sure to copy the generated output.

head /dev/urandom | tr -dc A-Za-z0-9 | head -c 20 ; echo ''

Now create a new '~/data' directory and move the working directory into it. Then, create a new file '.env' via the below nano editor command.

mkdir -p ~/data; cd ~/data
nano .env

Add the following lines to the file. Be sure to change the details of the PostgreSQL database and user, and also replace the 'FATHOM_SECRET" with your generated string on top.

Also, if you're running Fathomn on production, ensure to change the 'FATHOM_DEBUG' to 'false'. You can also set 'FATHOM_DATABASE_SSLMODE' if you're using databases with secure SSL/TLS connections. This example is using the same server as Fathom, so the 'FATHOM_DATABASE_SSLMODE' is set to 'disable'.

FATHOM_GZIP=true
FATHOM_DEBUG=true
FATHOM_DATABASE_DRIVER="postgres"
FATHOM_DATABASE_NAME="fathomdb"
FATHOM_DATABASE_USER="fathom"
FATHOM_DATABASE_PASSWORD="p4ssw0rdFathom"
FATHOM_DATABASE_HOST="127.0.0.1"
FATHOM_DATABASE_SSLMODE="disable"
FATHOM_SECRET="13tUIGpjCY9miJcSWW6S"

Save and close the '.env' file when finished.

Now type exit to log out from the 'fathom' user and get back to the root session.

Next, create a new systemd service file '/etc/systemd/system/fathom.service' using the nano editor command below.

sudo nano /etc/systemd/system/fathom.service

Add the following lines to the file. With this, you will run Fathom web analytics in localhost with the default port '8080', and the data directory for Fathom is configured to '/home/fathom/data'.

[Unit]
Description=Starts the fathom server
Requires=network.target
After=network.target

[Service]
Type=simple
User=fathom
Restart=always
RestartSec=3
WorkingDirectory=/home/fathom/data
ExecStart=/usr/local/bin/fathom server

[Install]
WantedBy=multi-user.target

Save and exit the file when finished.

Now run the below command to reload the systemd manager and apply the new service file 'fathom.service'.

sudo systemctl daemon-reload

After that, start and enable the 'fathom' service using the following systemctl command.

sudo systemctl start fathom
sudo systemctl enable fathom

Verify the 'fathom' service to ensure that the service is running.

sudo systemctl status fathom

You should receive an output like this - The status of the fathom service is running and it's now enabled, which means the service will be run automatically upon the bootup.

Creating Fathom Admin user

With the Fathom is running as a systemd service, you'll now ready to create a new admin user for your Fathom installation.

To create a Fathom admin user, you must be in the Fathom data directory. So, run the below command to log in as a 'fathom' user. Then, move the working directory to '~/data'.

su - fathom
cd ~/data

Run the below fathom command to add a new administrator user for Fathom web analytics. Be sure to change the email address and password in the following command line.

fathom user add --email="[email protected]" --password="AliceFathomP4ssw0rd"

If successful, you will receive an output similar to this. You can see the message that shows you the status connection to the PostgreSQL 'fathomdb' database and the new admin user '[email protected]' is created.

At this point, you've now finished the Fathom installation with the PostgreSQL database server. You've also created an administrator user for Fathom.

In the next step, you'll install and set up Nginx as a reverse proxy for Fathom web analytics that runs on localhost with default port 8080.

Installing and Configuring Nginx as a Reverse Proxy

In this step, you'll install the Nginx web server and set up the Nginx server block that will be used as a reverse proxy for Fathom web analytics.

Run the below apt command to install the Nginx package to your Debian server. When prompted, input y to confirm and press ENTER to proceed.

sudo apt install nginx

After Nginx is installed, create a new server bloc config file '/etc/nginx/sites-available/fathom' using the below nano editor command.

sudo nano /etc/nginx/sites-available/fathom

Add the following lines to the and be sure to change the domain name with your domain.

server {
    listen 80;
    server_name fathom.howtoforge.local;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:8080; 
    }
}

Save the file and exit the editor when finished.

Next, run the below command to activate the Nginx server block '/etc/nginx/sites-available/fathom'. Then, verify the Nginx configuration to ensure that you have proper Nginx configurations.

sudo ln -s /etc/nginx/sites-available/fathom /etc/nginx/sites-enabled/
sudo nginx -t

If successful, you'll see an output such as 'test is successful - syntax ok' in your terminal.

Now run the below systemctl command utility to restart the Nginx service and apply the changes.

sudo systemctl restart nginx

After that, verify the Nginx service to ensure t