From 1c69c67dc26bc6acd38feb1162a1003ef791206d Mon Sep 17 00:00:00 2001
From: Wolf Alexanyan <36194593+manager@users.noreply.github.com>
Date: Wed, 12 Aug 2026 19:07:25 +0400
Subject: [PATCH] fix(csp): allow the self-hosted Umami tracker (#178)

The Umami script tag shipped in #176 is blocked by our own CSP: neither
script-src nor connect-src allows analytics.administration.ae, so browsers
refuse to load the tracker and to send events. Adds the host to both.
---
 next.config.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/next.config.js b/next.config.js
index 0721bfe..06fcb6d 100644
--- a/next.config.js
+++ b/next.config.js
@@ -33,6 +33,8 @@ module.exports = withBundleAnalyzer({
       'https://www.googletagmanager.com',
       'https://www.google-analytics.com',
       'https://cdn.mxpnl.com',
+      // Self-hosted Umami tracker.
+      'https://analytics.administration.ae',
     ]
       .filter(Boolean)
       .join(' ');
@@ -42,6 +44,8 @@ module.exports = withBundleAnalyzer({
       isDev ? 'ws:' : '',
       'https://*.keepsimple.io',
       'https://metrics.administration.ae',
+      // Self-hosted Umami event collection.
+      'https://analytics.administration.ae',
       'https://api.mixpanel.com',
       'https://api-js.mixpanel.com',
       'https://www.google-analytics.com',