Nginx

Add a couple of location blocks to your Nginx server block. Snow’s Settings → Proxy tab generates the ready-to-paste config for your site.

Simple mode (recommended)

Proxy only the script. Events go directly from the visitor’s browser to the Snow API, so locations work accurately with no extra setup.


server {
  # ... your existing server block ...
 
  location = /sa/sa.js {
    proxy_pass https://api.snowanalytics.app/sa.js;
    proxy_set_header Host api.snowanalytics.app;
    proxy_ssl_server_name on;
  }
}

Then update your embed to set data-api-url:


<script defer
  src="https://yourdomain.com/sa/sa.js"
  data-site="YOUR_SITE_ID"
  data-api-url="https://api.snowanalytics.app/api/collect"
  data-domain="yourdomain.com"></script>

The data-api-url attribute tells sa.js to post events directly to the Snow API. The browser sends them; Nginx is not in the path for events, so the real visitor IP reaches Snow untouched.

Full mode (script and events)

Proxy both paths. You must forward the real visitor IP. Otherwise every visitor geolocates to your server’s city.

Enable Secure proxy in Settings → Proxy before adding the X-Snow-Proxy-Secret header. The secret is shown once when you enable it, so store it somewhere safe.


server {
  # ... your existing server block ...
 
  location = /sa/sa.js {
    proxy_pass https://api.snowanalytics.app/sa.js;
    proxy_set_header Host api.snowanalytics.app;
    proxy_ssl_server_name on;
  }
 
  location = /sa/api/collect {
    proxy_pass https://api.snowanalytics.app/api/collect;
    proxy_set_header Host api.snowanalytics.app;
    proxy_ssl_server_name on;
 
    # Forward the real visitor IP
    proxy_set_header X-Snow-Client-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
 
    # Secure proxy secret (from Settings → Proxy)
    proxy_set_header X-Snow-Proxy-Secret YOUR_PROXY_SECRET;
 
    # Do not forward visitor cookies or auth headers
    proxy_set_header Cookie "";
    proxy_set_header Authorization "";
  }
}

Then update your embed to point events through your domain:


<script defer
  src="https://yourdomain.com/sa/sa.js"
  data-site="YOUR_SITE_ID"
  data-api-url="/sa/api/collect"
  data-domain="yourdomain.com"></script>

$remote_addr is the IP of the connection your Nginx server actually receives. If Nginx itself sits behind a load balancer or another proxy, $remote_addr may be the internal IP of that upstream proxy. In that case, configure your upstream to set X-Forwarded-For correctly and read from it here. See Forwarding the visitor IP for the full details.

Key directives explained

Directive	Why it’s here
`proxy_set_header Host`	Sends the correct `Host` header to the Snow API. Required for SNI.
`proxy_ssl_server_name on`	Enables SNI for TLS connections to the upstream Snow host. Without this, the TLS handshake may fail.
`X-Snow-Client-IP`	The real visitor IP, used by Snow when the secure secret matches.
`X-Forwarded-For`	Standard IP forwarding header, used as a fallback.
`X-Snow-Proxy-Secret`	Authenticates your proxy. Snow only trusts `X-Snow-Client-IP` when this matches.

Verify

Generate some traffic, then check Analytics → Locations. A correct setup shows a realistic country distribution, not everything from one city. See Verify it’s working.