ansible/roles/podman/defaults/main.yml

@@ -329,3 +329,6 @@ cifs_watchdog_mounts:
   - "{{ photos_path }}/storage"
   - "{{ photos_path }}/immich"
 
+# GA4 property for the fulfillr portal Traffic & funnel tab (SCRUM-196, non-secret).
+# Shared by dev and prod. The service-account key `fulfillr_ga4_credentials_json` lives in the vault.
+fulfillr_ga4_property_id: "353859448"

ansible/roles/podman/tasks/main.yml

@@ -81,13 +81,13 @@
 
 - import_tasks: containers/debyltech/fulfillr.yml
   vars:
-    image: git.debyl.io/debyltech/fulfillr:20260827.2009
+    image: git.debyl.io/debyltech/fulfillr:20260914.2149
   tags: debyltech, fulfillr
 
 # Staging back-office (fulfillr-dev.debyltech.com) — same image, staging Turso config.
 - import_tasks: containers/debyltech/fulfillr-dev.yml
   vars:
-    image: git.debyl.io/debyltech/fulfillr:20260827.2009
+    image: git.debyl.io/debyltech/fulfillr:20260914.2149
   tags: debyltech, fulfillr-dev
 
 - import_tasks: containers/debyltech/uptime-kuma.yml

ansible/roles/podman/templates/fulfillr/dev.json.j2

@@ -53,5 +53,13 @@
   "recovery": {
     "schedule_name": "cart-recovery-dev",
     "schedule_group": "default"
+  }{%- if fulfillr_ga4_credentials_json is defined %},
+  {# GA4 Data API for the portal Traffic & funnel tab (SCRUM-196). Renders only once the
+     service-account key `fulfillr_ga4_credentials_json` (the key JSON, as a mapping or string)
+     is in the vault; without it the traffic endpoint reports configured:false. #}
+  "analytics": {
+    "ga4_property_id": "{{ fulfillr_ga4_property_id }}",
+    "ga4_credentials": {{ (fulfillr_ga4_credentials_json if fulfillr_ga4_credentials_json is mapping else (fulfillr_ga4_credentials_json | from_json)) | to_json }}
   }
+{%- endif %}
 }

ansible/roles/podman/templates/fulfillr/production.json.j2

@@ -53,5 +53,13 @@
   "recovery": {
     "schedule_name": "cart-recovery-prod",
     "schedule_group": "default"
+  }{%- if fulfillr_ga4_credentials_json is defined %},
+  {# GA4 Data API for the portal Traffic & funnel tab (SCRUM-196). Renders only once the
+     service-account key `fulfillr_ga4_credentials_json` (the key JSON, as a mapping or string)
+     is in the vault; without it the traffic endpoint reports configured:false. #}
+  "analytics": {
+    "ga4_property_id": "{{ fulfillr_ga4_property_id }}",
+    "ga4_credentials": {{ (fulfillr_ga4_credentials_json if fulfillr_ga4_credentials_json is mapping else (fulfillr_ga4_credentials_json | from_json)) | to_json }}
   }
+{%- endif %}
 }