# Proxy with DigitalOcean App Platform

> Route /a on App Platform to a small proxy service that forwards the visitor IP from do-connecting-ip.

Source: https://metricraven.com/docs/proxy-digitalocean  
Markdown: https://metricraven.com/docs/proxy-digitalocean.md  
Section: Proxy

App Platform can route a path prefix to its own component. Send /a to a small proxy service and read the visitor IP from App Platform's header.

## Set it up

1. **Already running a server component?**

   If your app is Express, Flask, FastAPI, Laravel or another server, add that stack's recipe to it directly and skip the separate service. Take the visitor IP from `do-connecting-ip` (see the next step).

2. **Create a proxy service**

   For a static site, deploy the [Express recipe](https://metricraven.com/docs/proxy-express) as a service component, reading App Platform's visitor IP header:

   ```javascript title="metricraven-proxy.js"
   // The Express recipe, reading App Platform's visitor IP header.
   // Replace the first line of relay() with:
   const headers = { "x-visitor-ip": req.get("do-connecting-ip") || req.ip };
   ```

3. **Route /a to the service**

   In the app spec, or under **Settings → Components** in the control panel, give the service the `/a` route and keep the path prefix so it receives `/a/script` and `/a/event`:

   ```yaml title=".do/app.yaml"
   # .do/app.yaml (excerpt) · route /a to a small proxy service
   services:
     - name: metricraven-proxy
       github:
         repo: your-org/metricraven-proxy
         branch: main
       run_command: node metricraven-proxy.js
       http_port: 8080
       envs:
         - key: PORT
           value: "8080"
   ingress:
     rules:
       - match:
           path:
             prefix: /a
         component:
           name: metricraven-proxy
           preserve_path_prefix: true
       # ...your existing rules for the rest of the site
   ```

4. **Point your script tag at your own paths**

   Replace your MetricRaven tag with this one. `src` loads the tracker from your domain and `data-api` sends its events there too.

   ```html title="Your website's shared layout"
   <script defer src="/a/script" data-api="/a/event" data-site-id="YOUR_SITE_ID"></script>
   ```

> **Verify it works**
>
> Open your live site. In the browser's Network panel, `/a/script` loads the tracker and `/a/event` answers with `ok: true`. Nothing goes to `metricraven.com` from the browser.
>
> In **Traffic**, your own visit should show your real country and city. If every visit appears to come from your server's or host's location, the visitor IP isn't being forwarded.

## Notes

- DigitalOcean documents `do-connecting-ip` as the client IP on App Platform; `x-forwarded-for` there holds the ingress address, so don't use it.

How the proxy works and which headers it must send: [Use your own domain](https://metricraven.com/docs/proxy).

## Details

- The proxy forwards only `Content-Type`, `Origin`, `User-Agent` and the visitor's IP as `x-visitor-ip`. Your site's cookies and auth headers never leave your server.
- `Origin` matters: MetricRaven checks it against your site's allowed domains. A missing or wrong origin is refused with `domain_not_allowed`.
- MetricRaven allows about 120 events per minute per visitor IP. Without `x-visitor-ip`, all of your visitors share the proxy's IP, so busy sites lose events as well as locations.
- A proxy doesn't guarantee that every blocker will allow tracking.