Proxy with Nginx

Two exact-match location blocks relay the script and events, sending only the headers MetricRaven needs.

Set it up

1. Create the shared proxy settings

   /etc/nginx/snippets/metricraven-proxy.conf

   Copy

   1

   2

   3

   4

   5

   6

   7

   8

   9

   10

   11

   # /etc/nginx/snippets/metricraven-proxy.conf
   proxy_ssl_server_name on;
   proxy_http_version 1.1;
   # Send only what the collector needs; your site's cookies stay on your server.
   proxy_pass_request_headers off;
   proxy_set_header Host metricraven.com;
   proxy_set_header Content-Type $content_type;
   proxy_set_header Origin $http_origin;
   proxy_set_header User-Agent $http_user_agent;
   # The visitor's IP. Behind a CDN or load balancer, configure the realip module first.
   proxy_set_header X-Visitor-IP $remote_addr;

2. Add the locations to your server block

   sites-available/example.com

   Copy

   1

   2

   3

   4

   5

   6

   7

   8

   9

   10

   11

   12

   13

   14

   15

   16

   # Inside your site's existing server { } block
   location = /a/script {
       limit_except GET { deny all; }
       proxy_pass https://metricraven.com/js/script.js;
       include /etc/nginx/snippets/metricraven-proxy.conf;
       proxy_hide_header Cache-Control;
       add_header Cache-Control "public, max-age=3600" always;
   }
   
   location = /a/event {
       limit_except POST { deny all; }
       proxy_pass https://metricraven.com/api/v1/collect;
       include /etc/nginx/snippets/metricraven-proxy.conf;
       proxy_hide_header Cache-Control;
       add_header Cache-Control "no-store" always;
   }

3. Test and reload

   terminal

   Copy

   1

   sudo nginx -t && sudo systemctl reload nginx

4. Point your script tag at your own paths

   Replace your MetricRaven tag with this one. src loads the tracker from your domain and data-api sends its events there too.

   Your website's shared layout

   Copy

   1

   <script defer src="/a/script" data-api="/a/event" data-site-id="YOUR_SITE_ID"></script>

Notes

• proxy_ssl_server_name on is required: MetricRaven is served over HTTPS behind a CDN that needs the hostname during the TLS handshake.
• Behind a CDN or load balancer, $remote_addr is that proxy. Configure set_real_ip_from and real_ip_header (the realip module) so it becomes the visitor.
• proxy_pass_request_headers off stops Nginx from forwarding your site's cookies. The headers set after it are the only ones sent.

How the proxy works and which headers it must send: Use your own domain.