Self-Host Plausible Analytics on Control Plane: Cookie-Free Stats Nobody Else Can Claim

To self-host Plausible Analytics on Control Plane, create three secrets (a signing key, PostgreSQL credentials and ClickHouse credentials) and install the Plausible template from the Template Catalog, Control Plane’s library of ready-to-install apps, into a Global Virtual Cloud (GVC), Control Plane’s term for the set of locations a workload runs in, with one location. You get Plausible Community Edition with its own PostgreSQL and ClickHouse, no public address until you have registered the owner account, and every credential kept in a Control Plane secret.

Visitors, referrers, top pages and countries, with no cookies and no third party holding your traffic data. That is the pitch of Plausible, an open-source alternative to Google Analytics whose script sets no cookies, and its repository has more than 29,000 GitHub stars. Plausible says its analytics need no cookie banner. The Community Edition is free to self-host, but it is more than one container. It wants PostgreSQL for accounts, ClickHouse for every pageview, three secrets that must stay secret, and a careful first minute, because whoever registers first owns the dashboard. This template installs the whole thing closed, so that first account is yours.

Why self-host Plausible on Control Plane

• Registration happens in private. The install has no public address until you create the owner account through a tunnel, then switch the dashboard on.
• Both databases come along. PostgreSQL and a single-node ClickHouse deploy with Plausible and talk to it over internal names.
• Three credentials, none in your values. A signing key and a login for each database are kept as Control Plane secrets and referenced only by name.
• An identity that opens only those secrets. A Control Plane identity and policy let Plausible reveal the secrets it reads and view its own GVC, nothing broader.
• Raw events stay on your own volume. ClickHouse stores them on a volume set, Control Plane’s managed persistent storage for a workload, so no bucket or cloud account is needed to start.
• Logs and metrics without an agent. Control Plane collects them for every workload in the release, and tracing is available to turn on.

Included out of the box

• Plausible Community Edition 3.2.1 (AGPL-3.0): dashboard, tracker script and event API on port 8000
• PostgreSQL 18 for users, sites and goals, on a 10 GiB volume
• ClickHouse 25.11 for events and sessions, on its own 10 GiB volume
• Invite-only sign-up by default, with closed and open modes one value away
• Optional SMTP for invitations, password resets and email reports
• Optional scheduled PostgreSQL backups to AWS S3, Google Cloud Storage or MinIO
• Country-level visitor locations from the bundled DB-IP data
• Stats API and shared dashboard links, for client reports

The chart also refuses Plausible Community Edition image tags older than v3.2.1. Earlier 3.x tags expose a /storybook endpoint with a remote code execution flaw (CVE-2026-8467), fixed in v3.2.1.

How to claim the Plausible owner account in private

Plausible has no setup password. Until an account exists, anyone who can open the URL can register as owner, so the template publishes nothing at first (publicAccess.enabled: false).

1. Install with the defaults.
2. Tunnel in with the cpln CLI, Control Plane’s command-line tool: cpln port-forward RELEASE_NAME-plausible 8000:8000 --gvc GVC_NAME. Open http://localhost:8000, create the owner account and add your first site. Use that exact address, since Plausible accepts browser connections only from the host of its base URL.
3. Run cpln helm upgrade with publicAccess.enabled: true. Firewall changes take a few minutes to propagate.
4. Log in again at the workload’s canonical endpoint. Your account and sites carry over, and the dashboard shows the snippet to paste into your pages.

After that, registration: invite_only admits only users you invite from the dashboard. Tracking needs public access on, because visitors’ browsers must reach the tracker script and /api/event. To serve Plausible on your own domain, set app.baseUrl to it with https://.

How to query Plausible events with SQL

Every pageview is a row in ClickHouse, and the template lets you read them. Apps in the same GVC can reach http://RELEASE_NAME-clickhouse-server.GVC_NAME.cpln.local:8123 as user default, with the password from your ClickHouse secret. Plausible itself answers inside the GVC at http://RELEASE_NAME-plausible.GVC_NAME.cpln.local:8000; set internalAccess.type to none, same-org or workload-list to change who can reach it.

Why Plausible runs as one replica in one location

Plausible keeps each visitor’s open session in memory, and nothing pins a visitor to one replica, so the template runs a single replica by design; several would split visits and distort bounce rate and visit duration. Upgrades start the new replica before the old one stops, but a restart is a short outage, and tracker hits during it are lost.

ClickHouse also runs as one node in one location. Install into a GVC with exactly one location and name it in clickhouse.locations. Plausible refuses to start otherwise, because the bundled PostgreSQL would run a separate, empty copy in every other location, and a Plausible replica on an empty copy would offer owner registration to anyone. There is no failover. To grow, raise the CPU and memory values and grow the volumes with cpln volumeset expand.

How to back up Plausible

Scheduled backups are off by default and cover PostgreSQL only: accounts, sites and goals. Set postgres.backup.enabled: true and pick a provider (aws, gcp or minio). A cron workload then writes a gzip-compressed pg_dumpall to your bucket, daily at 02:00 UTC by default. Restore follows the steps on the postgres template page.

Analytics events live only on the ClickHouse volume, with no scheduled backup or snapshot. Uninstalling deletes both volumes, and each keeps one final snapshot for 7 days; after that the data is gone. Never change the signing key later, because a new one logs everyone out and breaks two-factor login for every enrolled user.

What Plausible Community Edition leaves out

Community Edition is the AGPL-3.0 build Plausible publishes for self-hosting. Plausible lists marketing funnels, user journeys, ecommerce revenue goals, SSO and the Sites API as features it keeps out of Community Edition; those are in Plausible’s paid cloud plans. The Stats API and shared dashboard links work. Without SMTP configured, Plausible sends no invitations, password resets or email reports.

How to deploy Plausible on Control Plane

Sign up for Control Plane and pick a GVC with a single location. Create the three secrets from the docs first: an opaque secret of at least 32 bytes for the signing key, and two dictionary secrets (secrets that hold named key-value pairs) for the databases. If one is missing, the install reports success and the workload waits without logging anything. Then choose Plausible in the Template Catalog in the Control Plane Console, or run:

cpln helm install RELEASE_NAME oci://ghcr.io/controlplane-com/templates/plausible \
  --version 1.0.0 --gvc GVC_NAME \
  --set app.secretKeyBaseSecretName=KEY_SECRET_NAME \
  --set postgres.config.credentialsSecretName=DB_SECRET_NAME \
  --set clickhouse.database.credentialsSecretName=CLICKHOUSE_SECRET_NAME \
  --set 'clickhouse.locations[0].name=GVC_LOCATION' \
  --set 'clickhouse.locations[0].replicas=1'

The Plausible template documentation has the secret commands, email setup, backups and troubleshooting.

FAQ

Answers to common questions about running Plausible Analytics on Control Plane.

How do I self-host Plausible Analytics?

Create a signing-key secret and credentials secrets for PostgreSQL and ClickHouse, then install the Plausible template from the Template Catalog into a GVC with one location. The template deploys Plausible Community Edition, PostgreSQL and ClickHouse, with no public address until you turn it on.

Is Plausible free to self-host?

Yes. Plausible Community Edition is open source under AGPL-3.0 and costs nothing to license. You pay only for the compute and storage it uses on Control Plane.

How do I stop someone else from registering as the Plausible owner?

Register before you publish. The template starts with public access off, so you create the owner account through cpln port-forward at http://localhost:8000, then set publicAccess.enabled: true with cpln helm upgrade.

How do I back up Plausible?

Turn on postgres.backup.enabled to send daily pg_dumpall backups of accounts, sites and goals to S3, Google Cloud Storage or MinIO. Analytics events in ClickHouse have no scheduled backup or snapshot.

Can I run Plausible on Kubernetes?

Yes. On Control Plane you install the template with cpln helm install and Control Plane runs it, so there is no Kubernetes cluster for you to operate. Control Plane can also run workloads on a Kubernetes cluster you already run through BYOK (Bring Your Own Kubernetes).

Does Plausible on Control Plane scale?

Vertically. Plausible runs as one replica because it keeps visitor sessions in memory, and ClickHouse runs as one node, so you raise CPU and memory and grow the volumes.

Can Plausible run in more than one location?

No. The GVC must have exactly one location, and Plausible refuses to start in a GVC with more, because each extra location would run its own empty PostgreSQL.

What is missing from Plausible Community Edition?

Marketing funnels, user journeys, ecommerce revenue goals, SSO and the Sites API are Plausible Cloud features. The Stats API and shared dashboard links are included.

Which clouds can I deploy Plausible on?

AWS, GCP, Azure and Oracle Cloud Infrastructure (OCI). You choose the location when you create the GVC, and the template runs Plausible there.