Proxying the collector

The tracker talks to exactly one origin, set by data-api. Point it at a hostname you control and every request becomes first-party.

<script defer
  data-site="pk_live_xxxxxxxx"
  data-api="https://tt.acme.com"
  src="https://tt.acme.com/t.js"></script>

Why

Reason	Effect
Ad blockers	Filter lists block known analytics hostnames, not tt.acme.com. Blocked traffic is missing traffic, and it skews by audience.
Content-Security-Policy	script-src 'self' and connect-src 'self' need no exception.
Latency	One fewer DNS lookup and TLS handshake on the critical path.

A proxy is not a way around consent

Proxying changes where a request goes, not what is collected. The default install stores no cookie and no raw IP either way. If your legal basis depends on that, it depends on it equally before and after a proxy.

What has to be proxied

Path	Method	Notes
/t.js	GET	The tracker bundle. Cacheable — max-age=3600, stale-while-revalidate=86400, with an ETag.
/c/:key	GET	The identity probe. Cacheable for 60 s.
/e	POST	Every hit. Never cache.
/api/send	POST	Only if you use the umami-compatible alias.

The client IP must survive

The visitor hash and every geo lookup are derived from the address the collector sees. A proxy that hides it will file every visitor in the world under one hash and one location.

On Cloudflare, cf-connecting-ip is set for you. Anywhere else, forward X-Forwarded-For — the collector’s Node entry reads the first hop of X-Forwarded-For, then X-Real-IP, then the socket address.

Geo resolution also depends on it: a Cloudflare-fronted collector reads request.cf, which describes the client Cloudflare terminated. Chaining another CDN in front can turn that into the address of your proxy. See Geo.

Recipes

Subdomain (CNAME)

The simplest option, and the one that needs no code. Create a hostname in your own zone and point it at the collector.

tt.acme.com.   CNAME   ingest.tracing.tools.

Then:

<script defer
  data-site="pk_live_xxxxxxxx"
  data-api="https://tt.acme.com"
  src="https://tt.acme.com/t.js"></script>

This is first-party by domain, which is what blocklists key on. It is not same-origin, so the requests still go through CORS — which the collector allows from everywhere.

Next.js rewrite

next.config.ts

import type { NextConfig } from "next";

const INGEST = "https://ingest.tracing.tools";

const config: NextConfig = {
  async rewrites() {
    return [
      { source: "/tt/t.js", destination: `${INGEST}/t.js` },
      { source: "/tt/c/:key", destination: `${INGEST}/c/:key` },
      { source: "/tt/e", destination: `${INGEST}/e` },
    ];
  },
};

export default config;

<script defer
  data-site="pk_live_xxxxxxxx"
  data-api="/tt"
  src="/tt/t.js"></script>

A relative data-api works: the tracker only concatenates, so "/tt" becomes /tt/e and /tt/c/<key>, resolved against the current origin.

Cloudflare Worker

worker.js

const INGEST = "https://ingest.tracing.tools";
const ALLOWED = new Set(["/t.js", "/e", "/api/send"]);

export default {
  async fetch(request) {
    const url = new URL(request.url);
    const path = url.pathname.replace(/^\/tt/, "") || "/";

    if (!ALLOWED.has(path) && !path.startsWith("/c/")) {
      return new Response("Not found", { status: 404 });
    }

    return fetch(`${INGEST}${path}${url.search}`, request);
  },
};

Cloudflare sets cf-connecting-ip on the outgoing subrequest, so the client address survives.

Nginx

/etc/nginx/conf.d/tracing.conf

location /tt/ {
    proxy_pass         https://ingest.tracing.tools/;
    proxy_set_header   Host ingest.tracing.tools;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_ssl_server_name on;

    # /t.js is cacheable, /e is not
    proxy_cache_bypass $http_upgrade;
    proxy_buffering    off;
}

<script defer
  data-site="pk_live_xxxxxxxx"
  data-api="/tt"
  src="/tt/t.js"></script>

Caddy

Caddyfile

acme.com {
    handle_path /tt/* {
        reverse_proxy https://ingest.tracing.tools {
            header_up Host ingest.tracing.tools
            header_up X-Real-IP {remote_host}
        }
    }
}

Caddy sets X-Forwarded-For on a reverse_proxy by default.

Content-Security-Policy after proxying

With a same-origin path proxy, both directives collapse to 'self':

Content-Security-Policy

script-src 'self';
connect-src 'self';

With a CNAME subdomain you still name the host, but it is yours:

Content-Security-Policy

script-src 'self' https://tt.acme.com;
connect-src 'self' https://tt.acme.com;

Verifying

1. curl -I https://tt.acme.com/t.js → 200, content-type: application/javascript.
2. curl https://tt.acme.com/c/pk_live_xxxxxxxx → {"m":"hash"}.
3. Load a page and confirm a 202 from POST /tt/e.
4. Open Sessions and check that visits are not all coming from the same city — if they are, the client IP is not surviving the proxy.

Related

• Script configuration
• Geo