Add unified analytics system with GeoIP geo-tracking

Full analytics platform with MaxMind GeoLite2 IP-to-location resolution,
cross-module dashboard (docs, video, photo), user drill-down, volunteer
self-service stats, and ANALYTICS_ADMIN role with feature flag controls.

- ANALYTICS_ADMIN role + ANALYTICS_ROLES group across backend and frontend
- GeoIP service (MaxMind GeoLite2, lazy-loaded, graceful degradation)
- Geo fields (country, region, city, lat/lng) on DocsPageView, VideoView, PhotoView
- IP resolved to geo before SHA-256 hashing (privacy-preserving)
- Unified analytics module: overview, geo, content, user engagement endpoints
- 4 admin dashboard pages: Overview, Geography (Leaflet map), Content, Users
- Volunteer MyAnalyticsPage for self-service activity stats
- Settings UI: enableAnalytics, analyticsGeoEnabled, trackAuthenticatedUsers, retentionDays
- Scheduled cleanup job respecting configurable retention period
- config.sh: Analytics + MaxMind prompt in configure_features()
- Control panel: enableAnalytics flag, template, discovery, wizard, detail page
- Docker: geoip volume mount, MaxMind env vars, entrypoint auto-download
- Nginx: X-Forwarded-For fix ($proxy_add_x_forwarded_for) for real client IP
- Express trust proxy set to 2 for Pangolin/Newt tunnel chain
- CORS updated for docs origin (cmlite.org + docs.cmlite.org)
- Lander page: added docs-analytics tracking snippet
- Prisma migration: 20260402100000_add_analytics_system

Bunker Admin

changemaker-control-panel/admin/src/pages/CreateWizardPage.tsx

@@ -287,6 +287,12 @@ export default function CreateWizardPage() {
               <span>Unified people management, contact linking (no additional containers)</span>
             </Space>
           </Card>
+          <Card size="small" title="Analytics & GeoIP">
+            <Space>
+              <Switch checked={data.enableAnalytics} onChange={(v) => update({ enableAnalytics: v })} />
+              <span>Unified analytics dashboard, visitor geo-tracking</span>
+            </Space>
+          </Card>
         </Space>
       ),
     },

changemaker-control-panel/admin/src/pages/InstanceDetailPage.tsx

@@ -587,6 +587,9 @@ export default function InstanceDetailPage() {
           <Tag color={instance.enablePeople ? 'red' : 'default'}>
             People CRM {instance.enablePeople ? 'ON' : 'OFF'}
           </Tag>
+          <Tag color={instance.enableAnalytics ? 'geekblue' : 'default'}>
+            Analytics {instance.enableAnalytics ? 'ON' : 'OFF'}
+          </Tag>
         </Space>
       </Card>
 
@@ -980,6 +983,19 @@ export default function InstanceDetailPage() {
               disabled={isRegistered}
             />
           </div>
+          <Divider style={{ margin: '4px 0' }} />
+          <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
+            <div>
+              <Typography.Text strong>Analytics & GeoIP</Typography.Text>
+              <br />
+              <Typography.Text type="secondary">Unified analytics, visitor geography, user drill-down</Typography.Text>
+            </div>
+            <Switch
+              checked={featureFlags.enableAnalytics}
+              onChange={(v) => setFeatureFlags((f) => ({ ...f, enableAnalytics: v }))}
+              disabled={isRegistered}
+            />
+          </div>
         </Space>
       </Card>
 

changemaker-control-panel/api/prisma/schema.prisma

@@ -90,6 +90,7 @@ model Instance {
   enableSms       Boolean        @default(false) @map("enable_sms")
   enableSocial    Boolean        @default(false) @map("enable_social")
   enablePeople    Boolean        @default(false) @map("enable_people")
+  enableAnalytics Boolean        @default(false) @map("enable_analytics")
   jvbAdvertiseIp  String?        @map("jvb_advertise_ip")
 
   // Admin config

changemaker-control-panel/api/src/services/discovery.service.ts

@@ -100,6 +100,7 @@ function extractFeatureFlags(envVars: Record<string, string>) {
     enableSms: isTrue(envVars.ENABLE_SMS),
     enableSocial: isTrue(envVars.ENABLE_SOCIAL),
     enablePeople: isTrue(envVars.ENABLE_PEOPLE),
+    enableAnalytics: isTrue(envVars.ENABLE_ANALYTICS),
     emailTestMode: isTrue(envVars.EMAIL_TEST_MODE),
   };
 }

changemaker-control-panel/api/src/services/template-engine.ts

@@ -79,6 +79,7 @@ export interface TemplateContext {
   enableSms: boolean;
   enableSocial: boolean;
   enablePeople: boolean;
+  enableAnalytics: boolean;
   jvbAdvertiseIp: string;
   enablePangolin: boolean;
 
@@ -190,6 +191,7 @@ export function buildTemplateContext(
     enableSms: instance.enableSms,
     enableSocial: instance.enableSocial,
     enablePeople: instance.enablePeople,
+    enableAnalytics: instance.enableAnalytics,
     jvbAdvertiseIp: instance.jvbAdvertiseIp || '',
     enablePangolin: !!(instance.pangolinEndpoint && instance.pangolinNewtId && instance.pangolinNewtSecret),
     pangolin: {

changemaker-control-panel/templates/env.hbs

@@ -236,6 +236,11 @@ ENABLE_SOCIAL={{#if enableSocial}}true{{else}}false{{/if}}
 # People CRM
 ENABLE_PEOPLE={{#if enablePeople}}true{{else}}false{{/if}}
 
+# Analytics & GeoIP
+ENABLE_ANALYTICS={{#if enableAnalytics}}true{{else}}false{{/if}}
+MAXMIND_ACCOUNT_ID=
+MAXMIND_LICENSE_KEY=
+
 # Monitoring
 GRAFANA_ADMIN_PASSWORD={{secrets.grafanaAdminPassword}}
 GRAFANA_ROOT_URL=https://grafana.{{domain}}