From 39724d2c7919dd1e7d16d2306f92b414870ebcb0 Mon Sep 17 00:00:00 2001
From: manager <alexanyanwolf@gmail.com>
Date: Wed, 12 Aug 2026 15:04:52 +0000
Subject: [PATCH] fix(csp): allow the self-hosted Umami tracker

The Umami script tag shipped in #176 is blocked by our own CSP: neither
script-src nor connect-src allows analytics.administration.ae, so browsers
refuse to load the tracker and to send events. Adds the host to both.
---
 next.config.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/next.config.js b/next.config.js
index 0721bfe..06fcb6d 100644
--- a/next.config.js
+++ b/next.config.js
@@ -33,6 +33,8 @@ module.exports = withBundleAnalyzer({
       'https://www.googletagmanager.com',
       'https://www.google-analytics.com',
       'https://cdn.mxpnl.com',
+      // Self-hosted Umami tracker.
+      'https://analytics.administration.ae',
     ]
       .filter(Boolean)
       .join(' ');
@@ -42,6 +44,8 @@ module.exports = withBundleAnalyzer({
       isDev ? 'ws:' : '',
       'https://*.keepsimple.io',
       'https://metrics.administration.ae',
+      // Self-hosted Umami event collection.
+      'https://analytics.administration.ae',
       'https://api.mixpanel.com',
       'https://api-js.mixpanel.com',
       'https://www.google-analytics.com',