coingate

deploy/catcrafts-analytics

@@ -27,9 +27,21 @@ STATE_DIR=/var/lib/goaccess
 OUT_PUBLIC=/var/www/analytics/index.html
 OUT_PRIVATE=/var/www/analytics-private/index.html
 
-# Log lines whose URI matches this never enter the public tier. Extend it
-# when the shop launches so order/payment URLs can never surface publicly.
-CENSOR_RE='"uri":"/api'
+# Log lines whose URI matches this never enter the public tier.
+#
+# /order MUST be here. An order token is not an identifier, it is the whole
+# capability: /order/<token> is the buyer's status page and
+# /order/<token>/invoice.md is their name, street, postal code and city. The
+# public report lists requested paths (only the HOSTS and REFERRERS panels are
+# suppressed, and --no-query-string does nothing for a token that lives in the
+# PATH), so an uncensored public tier would have published a harvestable index
+# of every buyer's address within an hour of the first sale.
+#
+# Filters apply at INGEST, so this must be correct BEFORE the shop opens.
+# Should an order URL ever reach the public DB, changing this line is not
+# enough — follow the re-filter procedure at the top of this file to rebuild
+# from the retained raw logs.
+CENSOR_RE='"uri":"/(api|order)'
 
 # Serialize runs: a manual run racing the hourly timer once ingested the same
 # rotated log twice (both processes passed the ledger check before either