Cockpit — short links, route safety and privacy-minimal analytics

[maximus]

Hi everyone,

I’m releasing Cockpit, an open-source short-link control center for ProcessWire.

Cockpit keeps campaign, social, email, print, and QR URLs stable while their destinations change. It requires no templates, fields, or frontend pages.

KEY FEATURES

• Custom or automatically generated single-level and nested paths
• 301, 302, 307, and 308 redirects with practical status guidance
• A ProcessWire admin workspace with Dashboard, Links, Analytics, and Audit views
• One management page per link with editing, traffic, QR, and audit history
• Aggregate lifetime and daily click statistics with rich filters and period comparison
• A local Campaign URL Builder for GA-compatible UTM parameters
• JSON/CSV export and transactional dry-run import
• CLI commands for CRUD, statistics, route inspection, diagnostics, migration, and retention
• Granular permissions and a privacy-minimal administrative audit log

ROUTE SAFETY

Cockpit resolves routes late in ProcessWire’s not-found lifecycle, so existing pages, URL segments, PagePathHistory, security/API hooks, and established redirect modules keep precedence.

Before an active link is saved, Cockpit checks known route owners, including ProcessWire pages and history, Ichiban, ProcessRedirects, and common hook namespaces. Destination validation is fail-closed by default. Private and reserved networks, localhost, URL credentials, unsafe schemes, ambiguous paths, and redirect cycles are rejected.

PRIVACY BY DESIGN

Cockpit stores lifetime counters and aggregate daily buckets. It does not store visitor IP addresses, cookies, User-Agent strings, referrers, or one row per request. Bots, previews, HEAD requests, and configured QA addresses can be excluded from counting.

QR INTEGRATION

Cockpit does not bundle a QR engine. When a compatible FieldtypeQRCode release is installed, Cockpit uses its documented public API to generate a verified QR for the stable short URL.

DOCUMENTATION AND SOURCE

The repository includes installation and operations documentation, API reference, known-good examples, AI-agent safety guidance, a threat model, privacy statement, production checklist, tests, and deterministic release tooling.

https://github.com/mxmsmnv/Cockpit

This is the first public release. Feedback on route integrations, admin workflow, analytics, accessibility, and real-world short-link use cases is very welcome.