From 0b4b22e9ae88e73a3f3b8407a1bdbf0ed4c3a735 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sun, 3 May 2026 01:18:23 +0300
Subject: feat(docs): add Cookiebot CMP and GTM with Consent Mode v2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Inject Cookiebot CMP, Google Consent Mode v2 defaults, and Google Tag
Manager into the Sphinx layout. Cookiebot loads first so its
auto-blocker can scan and block other tags before they execute;
Consent Mode v2 starts denied for all categories except security_storage
and updates only after Cookiebot fires the consent update.

🤖 Generated by [robots](https://vyos.io)
---
 docs/_templates/layout.html | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

(limited to 'docs')

diff --git a/docs/_templates/layout.html b/docs/_templates/layout.html
index 30a53d56..ca72005d 100644
--- a/docs/_templates/layout.html
+++ b/docs/_templates/layout.html
@@ -1,6 +1,37 @@
 {% extends "!layout.html" %}
 {%- set current_version = "1.4.x sagitta" %}
 {% block extrahead %}
+    {# Cookiebot CMP — must load first so its auto-blocker can scan/block other tags #}
+    <script id="Cookiebot"
+            src="https://consent.cookiebot.com/uc.js"
+            data-cbid="932cb8b9-5141-4dc9-9018-21fc31a0586f"
+            data-blockingmode="auto"
+            type="text/javascript"></script>
+
+    {# Google Consent Mode v2 defaults — deny everything until Cookiebot fires the update #}
+    <script>
+      window.dataLayer = window.dataLayer || [];
+      function gtag(){dataLayer.push(arguments);}
+      gtag('consent', 'default', {
+        'ad_storage':             'denied',
+        'ad_user_data':           'denied',
+        'ad_personalization':     'denied',
+        'analytics_storage':      'denied',
+        'functionality_storage':  'denied',
+        'personalization_storage':'denied',
+        'security_storage':       'granted',
+        'wait_for_update': 500
+      });
+      gtag('set', 'ads_data_redaction', true);
+    </script>
+
+    {# Google Tag Manager #}
+    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+    })(window,document,'script','dataLayer','GTM-T5VQHRT');</script>
+
     <style>#vyos-header-iframe{position:fixed;top:0;left:0;right:0;z-index:999999999;width:100%;border:none}</style>
     <style>#vyos-footer-iframe{width:100%;border:none}</style>
     <iframe src='https://vyos.io/iframes/header' id='vyos-header-iframe'></iframe>
@@ -30,3 +61,10 @@
     <script type="text/javascript" charset="utf8" src="{{ pathto("_static/js/footer.js", True) }}"></script>
     </script>
 {% endblock %}
+
+{% block body %}
+    {# GTM noscript fallback #}
+    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-T5VQHRT"
+                      height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
+    {{ super() }}
+{% endblock %}
-- 
cgit v1.2.3