Todo

• Every report and admin page shows the warning “You are currently viewing Matomo over a secure SSL connection (using HTTPS), but Matomo could only detect a non secure connection on the server”: the front proxy terminates TLS and reaches the container over plain HTTP, and config/config.ini.php sets none of assume_secure_protocol, proxy_scheme_headers[], proxy_client_headers[] or force_ssl (measured with grep in the running container). Options: set assume_secure_protocol = 1 in [General], or proxy_scheme_headers[] = HTTP_X_FORWARDED_PROTO plus proxy_client_headers[] = HTTP_X_FORWARDED_FOR, through ./console config:set in a role task next to tasks/06_patch_trusted_hosts.yml.

• Six tasks report changed on every role sync of an unchanged tree (measured in two consecutive syncs): the four sed -i tasks 🔄 Update DB host, name, user and password in tasks/05_patch_database.yml and 🔧 Matomo | Set trusted hosts in tasks/06_patch_trusted_hosts.yml carry no changed_when and notify compose-up each run, and 🔐 Matomo install | Make config writable by web user in tasks/03_install_path.yml sets changed_when: true. Options: write the config lines through community.general.ini_file or check the current value first and report a change only on a real edit, and chown only when stat shows another owner.