Skip to Content
First-Party ProxyCaddy

Caddy

Add a couple of handle directives to your Caddyfile. Caddy handles TLS automatically, so there’s no ssl_server_name equivalent to worry about.

Snow’s Settings → Proxy tab generates the ready-to-paste config for your site.

Proxy only the script. Events go directly from the visitor’s browser to the Snow API.

yourdomain.com {
  # ... your existing site config ...

  handle /sa/sa.js {
    rewrite * /sa.js
    reverse_proxy https://api.snowanalytics.app {
      header_up Host api.snowanalytics.app
    }
  }
}

Then update your embed to set data-api-url:

<script defer
  src="https://yourdomain.com/sa/sa.js"
  data-site="YOUR_SITE_ID"
  data-api-url="https://api.snowanalytics.app/api/collect"
  data-domain="yourdomain.com"></script>

The data-api-url attribute tells sa.js to post events directly to the Snow API. Caddy is not in the path for events, so the real visitor IP reaches Snow untouched.

Full mode (script and events)

Proxy both paths. You must forward the real visitor IP. Otherwise every visitor geolocates to your server’s city.

Enable Secure proxy in Settings → Proxy before adding the X-Snow-Proxy-Secret header. The secret is shown once when you enable it.

yourdomain.com {
  # ... your existing site config ...

  handle /sa/sa.js {
    rewrite * /sa.js
    reverse_proxy https://api.snowanalytics.app {
      header_up Host api.snowanalytics.app
    }
  }

  handle /sa/api/collect {
    rewrite * /api/collect
    reverse_proxy https://api.snowanalytics.app {
      header_up Host api.snowanalytics.app

      # Forward the real visitor IP
      header_up X-Snow-Client-IP {remote_host}
      header_up X-Forwarded-For {remote_host}

      # Secure proxy secret (from Settings → Proxy)
      header_up X-Snow-Proxy-Secret YOUR_PROXY_SECRET

      # Do not forward visitor cookies or auth
      header_up -Cookie
      header_up -Authorization
    }
  }
}

Then update your embed to point events through your domain:

<script defer
  src="https://yourdomain.com/sa/sa.js"
  data-site="YOUR_SITE_ID"
  data-api-url="/sa/api/collect"
  data-domain="yourdomain.com"></script>

{remote_host} is the IP of the connection Caddy actually receives. If Caddy sits behind a load balancer or another proxy, this may be the upstream proxy’s IP rather than the visitor’s. In that case, read from the appropriate header instead (e.g. {header.X-Forwarded-For}). See Forwarding the visitor IP for the full details.

Key directives explained

DirectiveWhy it’s here
rewrite * /sa.jsStrips the /sa prefix before proxying upstream.
header_up HostSends the correct Host to the Snow API.
header_up X-Snow-Client-IPThe real visitor IP, trusted by Snow when the secret matches.
header_up X-Snow-Proxy-SecretAuthenticates your proxy so Snow trusts X-Snow-Client-IP.
header_up -CookieStrips visitor cookies. Do not forward them upstream.

Verify

Generate some traffic, then check Analytics → Locations. A correct setup shows a realistic country distribution, not everything from one city. See Verify it’s working.

NginxApache