fix(analytics): serve self-hosted trackers same-origin so CSP stops blocking

A self-hosted Umami/Rybbit domain configured in Settings could never load: the
CSP script-src allowlist is static, and the earlier pass could only add an
admin-visible warning because nginx.conf:58 strips helmet's header and
location / serves the SPA document off disk via try_files -- so helmet can
never govern it in Docker. Verified by reading the config, not inferred; that
kills the "make helmet dynamic" option outright.

Rather than templating the CSP, the tracker is now same-origin. The script and
every endpoint it talks to are served from /api/analytics/tracker/* and
proxied server-side to the configured instance, so script-src 'self' and
connect-src 'self' already cover it. The CSP is unchanged: nothing to
template, no env var, no restart -- it takes effect when Settings is saved.
That also closes A3 structurally rather than by widening a directive.

Endpoint mapping taken from vendor sources, not guessed: Umami's
host || currentScript.src + /api/send, and Rybbit's documented
/track, /site/tracking-config/<id>, /site/<id>/feature-flags/evaluate.
data-host-url is set explicitly so a COLLECT_API_HOST-built Umami cannot
bypass the proxy. Session replay is deliberately NOT proxied: replaying
gallery pages would capture the share token (GHSA-7m6c).

nginx still needed one line, for a non-obvious reason: the static-asset regex
location outranks the plain /api prefix in nginx's matching order, so
/api/analytics/tracker/script.js resolved as a static file. Confirmed
empirically against a real nginx:alpine -- 404 before the ^~ block, 502
(proxied) after, with /assets/app.js and /api/public/settings unchanged.
The native SERVE_FRONTEND install needed no change; helmet already has 'self'
in both directives and the proxy mounts ahead of express.static.

Security boundary, since this makes the server fetch an admin-supplied URL:
closed per-provider path+method allowlist (4 paths), DNS-resolving
isHostAllowed blocking private/internal/metadata addresses in production
(matching the s3Storage prod-only precedent), base rebuilt as
origin + pathname so userinfo/query/fragment cannot smuggle anything,
redirect: 'error', cookie/authorization/referer/host never forwarded, an
HTML upstream response re-served as application/octet-stream + nosniff, and
64KB request / 2MB response / 5s timeout / 120rpm caps. X-Forwarded-For and
User-Agent are forwarded so geo and device attribution survive.
Residual, stated plainly: an unauthenticated rate-limited relay to one
admin-chosen public host on 4 paths, and TOCTOU DNS rebinding is unmitigated
as it is elsewhere in the repo.

The Umami and Rybbit panels now explain they are proxied; the Custom panel
keeps a CSP warning -- it is the one mode with nothing to proxy -- naming both
script-src and connect-src.

Refs testplan REPORT.md A2, A3.

backend/server.js

@@ -258,6 +258,14 @@ app.use('/api', cors(corsOptions));
 // Handle preflight explicitly for API paths
 app.options('/api/*', cors(corsOptions));
 
+// Same-origin proxy for the configured analytics tracker. Mounted HERE, ahead
+// of the body parsers, so the tracker's beacon payload reaches the proxy as a
+// raw buffer (express.json would consume it, and the CSRF Content-Type gate
+// below would 415 a navigator.sendBeacon `text/plain` POST). It carries no
+// PicPeak state and reads no PicPeak credentials — see the route file for the
+// SSRF/path-allowlist model.
+app.use('/api/analytics/tracker', require('./src/routes/analyticsTrackerProxy'));
+
 // Initialize rate limiters (they will be created dynamically)
 let generalRateLimiter;
 let authRateLimiter;

backend/src/__tests__/analyticsTrackerProxy.test.js

@@ -0,0 +1,292 @@
+/**
+ * Contract tests for the same-origin analytics-tracker proxy.
+ *
+ * The proxy exists so an admin-configured self-hosted Umami/Rybbit instance
+ * actually loads under the shipped `script-src 'self'` / `connect-src 'self'`
+ * CSP without anyone hand-editing nginx.conf. Because the upstream base URL
+ * comes from an admin-editable setting, most of what is pinned here is the
+ * SSRF/abuse boundary rather than the happy path: which paths are reachable,
+ * which headers cross the boundary, and what a hostile upstream can make the
+ * browser see.
+ */
+
+const express = require('express');
+const request = require('supertest');
+
+const settings = {};
+
+jest.mock('../utils/appSettings', () => ({
+  getAppSetting: jest.fn(async (key, defaultValue = null) => (
+    Object.prototype.hasOwnProperty.call(settings, key) ? settings[key] : defaultValue
+  )),
+}));
+
+const mockIsHostAllowed = jest.fn(async () => true);
+jest.mock('../utils/networkValidation', () => ({ isHostAllowed: (...a) => mockIsHostAllowed(...a) }));
+
+jest.mock('../utils/logger', () => ({
+  warn: jest.fn(), debug: jest.fn(), info: jest.fn(), error: jest.fn(),
+}));
+
+function buildApp() {
+  // Fresh require per test: the route memoises the resolved upstream for 30s.
+  jest.resetModules();
+  const app = express();
+  app.use('/api/analytics/tracker', require('../routes/analyticsTrackerProxy'));
+  return app;
+}
+
+function upstreamReply(body, { status = 200, contentType = 'text/javascript', headers = {} } = {}) {
+  return new Response(body, { status, headers: { 'content-type': contentType, ...headers } });
+}
+
+let fetchMock;
+
+beforeEach(() => {
+  for (const key of Object.keys(settings)) delete settings[key];
+  mockIsHostAllowed.mockClear();
+  mockIsHostAllowed.mockResolvedValue(true);
+  fetchMock = jest.fn(async () => upstreamReply('/* tracker */'));
+  global.fetch = fetchMock;
+});
+
+describe('analytics tracker proxy — reachability', () => {
+  it('404s when no tracker provider is configured', async () => {
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(404);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('404s when the provider is set but has no URL', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(404);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('serves Umami from the configured instance', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://umami.example.com';
+
+    const res = await request(buildApp()).get('/api/analytics/tracker/script.js').expect(200);
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][0]).toBe('https://umami.example.com/script.js');
+    expect(res.headers['content-type']).toBe('text/javascript; charset=utf-8');
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+    expect(res.text).toBe('/* tracker */');
+  });
+
+  it('honours a legacy umami_enabled install with no explicit provider', async () => {
+    settings.analytics_umami_enabled = true;
+    settings.analytics_umami_url = 'https://umami.example.com';
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(200);
+    expect(fetchMock.mock.calls[0][0]).toBe('https://umami.example.com/script.js');
+  });
+
+  it('maps Rybbit paths onto the upstream /api prefix', async () => {
+    settings.analytics_tracker_provider = 'rybbit';
+    settings.analytics_rybbit_url = 'https://rybbit.example.com/';
+    const app = buildApp();
+
+    await request(app).get('/api/analytics/tracker/script.js').expect(200);
+    expect(fetchMock.mock.calls[0][0]).toBe('https://rybbit.example.com/api/script.js');
+
+    // mockImplementation, not mockResolvedValue: a Response body is a stream
+    // and can only be consumed once, so each call needs a fresh one.
+    fetchMock.mockImplementation(async () => upstreamReply('{}', { contentType: 'application/json' }));
+    await request(app)
+      .post('/api/analytics/tracker/track')
+      .set('content-type', 'application/json')
+      .send({ type: 'pageview' })
+      .expect(200);
+    expect(fetchMock.mock.calls[1][0]).toBe('https://rybbit.example.com/api/track');
+
+    await request(app).get('/api/analytics/tracker/site/tracking-config/abc-123').expect(200);
+    expect(fetchMock.mock.calls[2][0])
+      .toBe('https://rybbit.example.com/api/site/tracking-config/abc-123');
+  });
+
+  it('preserves a sub-path in the configured URL', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://example.com/umami/';
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(200);
+    expect(fetchMock.mock.calls[0][0]).toBe('https://example.com/umami/script.js');
+  });
+});
+
+describe('analytics tracker proxy — path allowlist', () => {
+  beforeEach(() => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://umami.example.com';
+  });
+
+  it.each([
+    ['/api/analytics/tracker/track'],
+    ['/api/analytics/tracker/api/auth/login'],
+    ['/api/analytics/tracker/site/tracking-config/abc'],
+    ['/api/analytics/tracker/'],
+    ['/api/analytics/tracker/script.js/../../secret'],
+    ['/api/analytics/tracker/%2e%2e/%2e%2e/secret'],
+    ['/api/analytics/tracker/index.html'],
+  ])('404s on a path outside the provider allowlist: %s', async (path) => {
+    await request(buildApp()).get(path).expect(404);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('404s when the method does not match the allowlisted path', async () => {
+    // /api/send is POST-only; a GET must not be relayed.
+    await request(buildApp()).get('/api/analytics/tracker/api/send').expect(404);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('relays the Umami beacon POST', async () => {
+    fetchMock.mockResolvedValue(upstreamReply('cache-token', { contentType: 'text/plain' }));
+
+    const res = await request(buildApp())
+      .post('/api/analytics/tracker/api/send')
+      .set('content-type', 'application/json')
+      .send({ type: 'event' })
+      .expect(200);
+
+    expect(fetchMock.mock.calls[0][0]).toBe('https://umami.example.com/api/send');
+    expect(fetchMock.mock.calls[0][1].method).toBe('POST');
+    expect(fetchMock.mock.calls[0][1].body.toString()).toBe(JSON.stringify({ type: 'event' }));
+    expect(res.headers['cache-control']).toBe('no-store');
+  });
+});
+
+describe('analytics tracker proxy — SSRF boundary', () => {
+  it('refuses a non-HTTP tracker URL', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'file:///etc/passwd';
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(404);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('refuses an unparseable tracker URL', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'not a url';
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(404);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('refuses a private/internal host in production', async () => {
+    const previous = process.env.NODE_ENV;
+    process.env.NODE_ENV = 'production';
+    mockIsHostAllowed.mockResolvedValue(false);
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'http://169.254.169.254';
+
+    try {
+      await request(buildApp()).get('/api/analytics/tracker/script.js').expect(404);
+      expect(mockIsHostAllowed).toHaveBeenCalledWith('169.254.169.254');
+      expect(fetchMock).not.toHaveBeenCalled();
+    } finally {
+      process.env.NODE_ENV = previous;
+    }
+  });
+
+  it('allows a localhost tracker outside production (dev parity with s3Storage)', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'http://localhost:3000';
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(200);
+    expect(mockIsHostAllowed).not.toHaveBeenCalled();
+  });
+
+  it('strips credentials, query and fragment from the configured URL', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://user:[email protected]/?a=1#frag';
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(200);
+    expect(fetchMock.mock.calls[0][0]).toBe('https://umami.example.com/script.js');
+  });
+
+  it('never follows an upstream redirect', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://umami.example.com';
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(200);
+    expect(fetchMock.mock.calls[0][1].redirect).toBe('error');
+    expect(fetchMock.mock.calls[0][1].signal).toBeDefined();
+  });
+
+  it('rate-limits an unauthenticated client hammering the beacon', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://umami.example.com';
+    fetchMock.mockImplementation(async () => upstreamReply('ok', { contentType: 'text/plain' }));
+    const app = buildApp();
+
+    for (let i = 0; i < 120; i += 1) {
+      await request(app).get('/api/analytics/tracker/script.js').expect(200);
+    }
+    await request(app).get('/api/analytics/tracker/script.js').expect(429);
+    expect(fetchMock).toHaveBeenCalledTimes(120);
+  });
+
+  it('502s when the upstream request fails', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://umami.example.com';
+    fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(502);
+  });
+
+  it('502s rather than relaying an oversized upstream body', async () => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://umami.example.com';
+    fetchMock.mockResolvedValue(upstreamReply('x', {
+      headers: { 'content-length': String(50 * 1024 * 1024) },
+    }));
+
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(502);
+  });
+});
+
+describe('analytics tracker proxy — header and content-type handling', () => {
+  beforeEach(() => {
+    settings.analytics_tracker_provider = 'umami';
+    settings.analytics_umami_url = 'https://umami.example.com';
+  });
+
+  it('forwards the visitor IP and user agent, but not credentials', async () => {
+    await request(buildApp())
+      .get('/api/analytics/tracker/script.js')
+      .set('user-agent', 'Mozilla/5.0 (test)')
+      .set('accept-language', 'de-DE')
+      .set('cookie', 'picpeak_admin_token=secret')
+      .set('authorization', 'Bearer secret')
+      .set('referer', 'https://picpeak.example/gallery/wedding/SHARETOKEN')
+      .expect(200);
+
+    const headers = fetchMock.mock.calls[0][1].headers;
+    expect(headers['user-agent']).toBe('Mozilla/5.0 (test)');
+    expect(headers['accept-language']).toBe('de-DE');
+    // req.ip on a supertest connection is loopback — the point is that the
+    // client IP is forwarded at all, so the tracker keeps attributing visits.
+    expect(headers['x-forwarded-for']).toBeTruthy();
+    expect(headers['x-real-ip']).toBe(headers['x-forwarded-for']);
+    expect(Object.keys(headers).map((k) => k.toLowerCase()))
+      .toEqual(expect.not.arrayContaining(['cookie', 'authorization', 'referer', 'host']));
+  });
+
+  it('neutralises an HTML response from a hostile tracker host', async () => {
+    // Without this a tracker host could serve `<script>` HTML through
+    // PicPeak's own origin and get it rendered as same-origin content.
+    fetchMock.mockResolvedValue(upstreamReply('<html><body>xss</body></html>', {
+      contentType: 'text/html',
+    }));
+
+    const res = await request(buildApp()).get('/api/analytics/tracker/script.js').expect(200);
+    expect(res.headers['content-type']).toBe('application/octet-stream');
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+  });
+
+  it('passes the upstream status through', async () => {
+    fetchMock.mockResolvedValue(upstreamReply('nope', { status: 404, contentType: 'text/plain' }));
+    await request(buildApp()).get('/api/analytics/tracker/script.js').expect(404);
+  });
+});

backend/src/routes/analyticsTrackerProxy.js

@@ -0,0 +1,296 @@
+/**
+ * Same-origin proxy for the admin-configured analytics tracker.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Settings → Analytics lets an admin point PicPeak at a self-hosted Umami or
+ * Rybbit instance on an arbitrary domain, but the shipped CSP is a static
+ * allowlist (`script-src 'self' https://www.google.com …` in
+ * `frontend/nginx.conf` and in helmet's directives in `server.js`). Injecting
+ * `<script src="https://analytics.example.com/script.js">` was therefore
+ * ALWAYS blocked by the browser — silently, with only a console error, so
+ * "not configured" and "configured but broken" looked identical to the admin.
+ * The tracker's beacon endpoint had the same problem against `connect-src`.
+ *
+ * The CSP itself can't be made dynamic in the default Docker deployment:
+ * nginx serves `index.html` off disk (`try_files … /index.html`) and strips
+ * the backend's CSP with `proxy_hide_header Content-Security-Policy`, so
+ * nginx's static header is the only policy governing the SPA document, and
+ * the tracker URL lives in the DB rather than the environment.
+ *
+ * So instead of widening the policy, we remove the need to: the tracker
+ * script and every endpoint it talks to are served from PicPeak's own origin
+ * and proxied here. `script-src 'self'` and `connect-src 'self'` already
+ * cover that, unchanged. This is the same first-party proxy setup both
+ * vendors document (and recommend — it also survives ad blockers).
+ *
+ * SECURITY MODEL
+ * --------------
+ * The upstream base URL is admin-supplied, so this is an SSRF surface. It is
+ * bounded by:
+ *   - scheme restricted to http/https; userinfo (`https://u:p@host`) dropped
+ *     by rebuilding from `origin` + `pathname`;
+ *   - a DNS-resolving private/internal-address check (`isHostAllowed`) in
+ *     production, matching the `s3Storage` precedent — development keeps
+ *     working against a localhost tracker;
+ *   - a per-provider allowlist of the exact paths each tracker's script
+ *     actually calls, so this is not an open relay to the tracker host;
+ *   - `redirect: 'error'`, a request timeout, a request-body cap and a
+ *     streamed response-body cap;
+ *   - a fixed forwarded-header set (never cookies, Authorization or
+ *     arbitrary client headers);
+ *   - a sanitised response Content-Type plus `nosniff`, so a tracker host
+ *     cannot serve HTML/SVG through PicPeak's origin and get it rendered.
+ */
+
+const express = require('express');
+const rateLimit = require('express-rate-limit');
+const { getAppSetting } = require('../utils/appSettings');
+const { isHostAllowed } = require('../utils/networkValidation');
+const { clientIpForAudit } = require('../utils/clientIp');
+const logger = require('../utils/logger');
+
+const router = express.Router();
+
+const REQUEST_TIMEOUT_MS = 5000;
+// Beacon payloads are a few hundred bytes; 64 KB is generous headroom.
+const MAX_REQUEST_BYTES = 64 * 1024;
+// Umami's script.js is ~6 KB; Rybbit's full bundle (rrweb session replay)
+// is a few hundred KB. 2 MB caps a hostile/broken upstream.
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+// The settings read happens per beacon, so cache the resolved upstream.
+// Short enough that saving Settings → Analytics takes effect without a
+// restart, which is the whole point of not templating this at boot.
+const CONFIG_TTL_MS = 30 * 1000;
+
+/**
+ * Per-provider mapping. `prefix` is what the tracker's own path is relative
+ * to on the upstream, and `routes` is the closed set of method + path pairs
+ * the tracker script is known to call.
+ *
+ * Umami   — `<script-dir>/script.js`, collect at `<script-dir>/api/send`
+ *           (tracker: `host = data-host-url || currentScript.src` dir,
+ *           `endpoint = host + '/api/send'`).
+ * Rybbit  — `<prefix>/script.js` upstream `/api/script.js`, and the script
+ *           derives `analyticsHost = src.split('/script.js')[0]`, then calls
+ *           `<prefix>/track`, `<prefix>/site/tracking-config/<id>` and
+ *           `<prefix>/site/<id>/feature-flags/evaluate`. That matches the
+ *           mapping in Rybbit's own proxy guide.
+ *           Session replay (`<prefix>/session-replay/record/<id>`) is
+ *           deliberately NOT proxied: replaying gallery pages would ship the
+ *           share token in the recording (GHSA-7m6c).
+ */
+const PROVIDERS = {
+  umami: {
+    urlKey: 'analytics_umami_url',
+    prefix: '',
+    routes: [
+      ['GET', /^\/script\.js$/],
+      ['POST', /^\/api\/send$/],
+    ],
+  },
+  rybbit: {
+    urlKey: 'analytics_rybbit_url',
+    prefix: '/api',
+    routes: [
+      ['GET', /^\/script\.js$/],
+      ['POST', /^\/track$/],
+      ['GET', /^\/site\/tracking-config\/[A-Za-z0-9_-]{1,64}$/],
+      ['POST', /^\/site\/[A-Za-z0-9_-]{1,64}\/feature-flags\/evaluate$/],
+    ],
+  },
+};
+
+// Client request headers forwarded upstream. `user-agent` and the client IP
+// are what let the tracker keep doing device/geo attribution once traffic is
+// first-party; `x-umami-cache` is an opaque session token Umami's own script
+// echoes back. Everything else — cookies, Authorization, Referer, Origin —
+// is dropped.
+const FORWARDED_HEADERS = ['accept', 'accept-language', 'content-type', 'user-agent', 'x-umami-cache'];
+
+// Response Content-Types we are willing to re-serve from our own origin.
+// Anything else (text/html, image/svg+xml, …) becomes an inert download.
+const SAFE_CONTENT_TYPES = new Set([
+  'text/javascript',
+  'application/javascript',
+  'application/json',
+  'text/plain',
+]);
+
+let cache = { at: 0, value: undefined };
+
+/**
+ * Read the tracker settings and turn them into `{ base, spec }`, or null when
+ * no proxyable tracker is configured. Mirrors `services/trackers/index.js`'s
+ * back-compat: a pre-#663 install with only `analytics_umami_enabled` set
+ * still resolves to Umami.
+ */
+async function loadUpstream() {
+  const explicit = await getAppSetting('analytics_tracker_provider', null);
+  let provider = typeof explicit === 'string' && PROVIDERS[explicit] ? explicit : null;
+  if (!explicit) {
+    const legacy = await getAppSetting('analytics_umami_enabled', false);
+    if (legacy === true || legacy === 'true') provider = 'umami';
+  }
+  if (!provider) return null;
+
+  const spec = PROVIDERS[provider];
+  const raw = await getAppSetting(spec.urlKey, null);
+  if (!raw || typeof raw !== 'string') return null;
+
+  let parsed;
+  try {
+    parsed = new URL(raw.trim());
+  } catch {
+    logger.warn('Analytics tracker proxy: configured URL is not a valid URL', { provider });
+    return null;
+  }
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    logger.warn('Analytics tracker proxy: refusing non-HTTP tracker URL', {
+      provider,
+      protocol: parsed.protocol,
+    });
+    return null;
+  }
+
+  // SSRF: resolve-and-vet the host. Prod-only, matching the s3Storage /
+  // MinIO gate — a dev install legitimately points at a localhost tracker,
+  // and a tracker that is only reachable on an internal network could never
+  // have worked from the browser anyway.
+  if (process.env.NODE_ENV === 'production' && !(await isHostAllowed(parsed.hostname))) {
+    logger.warn('Analytics tracker proxy: tracker host resolves to a private or internal address', {
+      provider,
+      host: parsed.hostname,
+    });
+    return null;
+  }
+
+  // Rebuild from origin + pathname: drops any userinfo, query and fragment
+  // the admin may have pasted along with the base URL.
+  const base = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}`;
+  return { base, spec };
+}
+
+async function resolveUpstream() {
+  if (cache.value !== undefined && Date.now() - cache.at < CONFIG_TTL_MS) {
+    return cache.value;
+  }
+  const value = await loadUpstream();
+  cache = { at: Date.now(), value };
+  return value;
+}
+
+/**
+ * Drain an upstream response body, aborting once it exceeds `max` bytes so a
+ * hostile or broken tracker can't stream us out of memory.
+ */
+async function readBounded(response, max) {
+  const declared = Number(response.headers.get('content-length'));
+  if (Number.isFinite(declared) && declared > max) return null;
+
+  if (!response.body) return Buffer.alloc(0);
+  const chunks = [];
+  let total = 0;
+  const reader = response.body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.length;
+    if (total > max) {
+      await reader.cancel();
+      return null;
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks);
+}
+
+function safeContentType(raw) {
+  const base = String(raw || '').split(';')[0].trim().toLowerCase();
+  return SAFE_CONTENT_TYPES.has(base)
+    ? `${base}; charset=utf-8`
+    : 'application/octet-stream';
+}
+
+// Gallery visitors are anonymous, so this route has to be unauthenticated —
+// cap how hard one client can make PicPeak fetch from the tracker. A real
+// visitor fires a handful of beacons a minute; this only bites abuse. Its own
+// limiter rather than the app-wide one because that is created asynchronously
+// after the database is up, long after this router is mounted.
+router.use(rateLimit({
+  windowMs: 60 * 1000,
+  max: 120,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (req, res) => res.sendStatus(429),
+}));
+
+// Raw body: mounted before the app-wide express.json so the tracker's beacon
+// payload (JSON, or text/plain from navigator.sendBeacon) reaches us intact.
+router.use(express.raw({ type: () => true, limit: MAX_REQUEST_BYTES }));
+
+router.all('*', async (req, res) => {
+  const upstream = await resolveUpstream();
+  if (!upstream) return res.sendStatus(404);
+
+  const path = req.path;
+  const allowed = upstream.spec.routes.some(([method, re]) => method === req.method && re.test(path));
+  if (!allowed) return res.sendStatus(404);
+
+  const headers = {};
+  for (const name of FORWARDED_HEADERS) {
+    const value = req.get(name);
+    if (value) headers[name] = value;
+  }
+  // Let the tracker keep attributing visitors now that every request arrives
+  // from PicPeak's server. req.ip (not the raw header) so Express's
+  // trust-proxy configuration decides what is trustworthy.
+  const ip = clientIpForAudit(req);
+  if (ip) {
+    headers['x-forwarded-for'] = ip;
+    headers['x-real-ip'] = ip;
+  }
+
+  const body = Buffer.isBuffer(req.body) && req.body.length ? req.body : undefined;
+  const controller = new AbortController();
+  // The timeout deliberately stays armed across the body read too, so a
+  // slow-loris upstream can't pin a request open past REQUEST_TIMEOUT_MS.
+  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+
+  let buffer;
+  try {
+    const response = await fetch(`${upstream.base}${upstream.spec.prefix}${path}`, {
+      method: req.method,
+      headers,
+      body,
+      // Never follow a redirect: an upstream 30x would move the request (and
+      // the visitor's forwarded IP) to a host that never passed the checks
+      // above.
+      redirect: 'error',
+      signal: controller.signal,
+    });
+    buffer = await readBounded(response, MAX_RESPONSE_BYTES);
+    if (buffer === null) {
+      logger.warn('Analytics tracker proxy: upstream response exceeds the size cap', { path });
+      return res.sendStatus(502);
+    }
+    res.status(response.status);
+    res.setHeader('Content-Type', safeContentType(response.headers.get('content-type')));
+  } catch (err) {
+    logger.debug('Analytics tracker proxy: upstream request failed', {
+      path,
+      error: err.message,
+    });
+    return res.sendStatus(502);
+  } finally {
+    clearTimeout(timer);
+  }
+
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  // Only the tracker script is safe to cache; beacons and per-site config
+  // responses never are.
+  res.setHeader('Cache-Control', path === '/script.js' ? 'public, max-age=300' : 'no-store');
+  return res.send(buffer);
+});
+
+module.exports = router;