Self-Hosting Cookieless Analytics: The Honest GA4 Counterpoint
I published GA4 on this blog last week. It took ten minutes, cost nothing, and left a faintly guilty aftertaste - the kind you get shipping a cookie banner you would never click through yourself. So before that snippet calcifies into permanent infrastructure, here are the field notes I wish I had read first: what it actually takes to self-host a cookieless alternative on the same modest OVH box that already runs this site under Coolify.
The three candidates
I looked at the three tools everyone keeps recommending, and they sort neatly by how much machine they demand.
- Umami - a Next.js app on PostgreSQL (MySQL was historically supported; Postgres is the path now). MIT licensed, tracker under 2KB, "deploy with Docker in minutes." The featherweight of the group.
- Plausible Community Edition - Elixir/Phoenix with a React dashboard, backed by both PostgreSQL and ClickHouse. AGPLv3 (the JS tracker is MIT to dodge copyleft worries). CE ships roughly twice-yearly releases.
- Rybbit - the newcomer. TypeScript, ClickHouse plus Postgres, wired up with Docker Compose and a Caddy front door. AGPL-3.0. It is the most feature-dense: funnels, retention, web vitals, error tracking, geo, and session replay.
The ClickHouse tax
Here is the number that reframed everything for me. Umami reportedly runs happily in 256-512MB alongside its Postgres, comfortable on a $5 VPS or even a Raspberry Pi. The ClickHouse-backed options are a different animal: reports suggest a practical floor of 2GB RAM, with 4GB recommended, because ClickHouse alone wants around 2GB at idle and spikes during queries. Rybbit's own docs state a minimum 2GB VPS.
ClickHouse is a magnificent column store built to chew through billions of rows. My blog does not have billions of rows. It barely has hundreds of visitors.
That is the crux. Session replay and cohort-retention grids are genuinely lovely, but they are answers to questions a personal blog never asks. Paying a permanent 2GB memory tax on a shared OVH VPS - next to Drupal, PHP-FPM, and a database that actually earns its keep - to learn that twelve people read my last post is poor engineering, however nice the dashboard looks.
What I would actually deploy
For a single blog, Umami is the honest fit. It slots into a Coolify stack without me rethinking my resource budget. The compose service is unremarkable in the best way:
services:
umami:
image: "ghcr.io/umami-software/umami:postgresql-latest"
environment:
DATABASE_URL: "postgresql://umami:pass@db:5432/umami"
DATABASE_TYPE: "postgresql"
APP_SECRET: "replace-with-a-long-random-string"
depends_on:
- db
restart: alwaysThe client side is a single line, and unlike GA4 it needs no consent gate in front of it:
<script defer
src="https://stats.bms.ovh/script.js"
data-website-id="00000000-0000-0000-0000-000000000000"></script>The privacy and GDPR angle
This is where the counterpoint sharpens. All three collect no cookies, no cross-site identifiers, and no personal data by default, so no consent banner is required - the thing GA4 forces on me and my readers. Just as important, the data lives on my hardware in Europe rather than being handed to an ad company. That is a materially better GDPR posture, and it is the same story whether I pick the lightweight or the heavyweight tool.
- Consent: cookieless means the banner disappears - a real UX win.
- Data residency: it stays on my OVH box, under my control.
- Cost of ownership: backups, upgrades, and OOM babysitting are now my job, not Google's.
To see what the maximal end of the spectrum buys you, the Rybbit demo below is worth two minutes - then ask whether you need any of it.
My verdict, unpreachy: GA4 stays for now because it is free and frictionless, but the banner bothers me enough that Umami is next on the Coolify to-do list. The ClickHouse pair are excellent tools I simply do not have the traffic - or the RAM - to justify.