Serve Tracking From Your Own Server

dig +short www.example.com

# /etc/nginx/snippets/axitrace-proxy.conf

proxy_pass                    https://$axitrace_host$request_uri;
proxy_http_version            1.1;
proxy_set_header              Connection "";

# Rule 1: the Host header selects the AxiTrace route AND decides the cookie
# domain. $axitrace_host is YOUR tracking subdomain, set in the server block.
proxy_set_header              Host $axitrace_host;

# Rule 3: SNI must carry the same name, or the TLS handshake fails.
proxy_ssl_server_name         on;
proxy_ssl_name                $axitrace_host;
proxy_ssl_verify              on;
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

# Rule 2: set the visitor address, never append. $proxy_add_x_forwarded_for
# would keep a value the visitor forged.
# BEHIND A CDN, $remote_addr is the CDN edge and not the visitor: use
# $http_cf_connecting_ip, or configure ngx_http_realip_module first.
proxy_set_header              X-Forwarded-For $remote_addr;
proxy_set_header              X-Real-IP $remote_addr;
proxy_set_header              X-Forwarded-Proto $scheme;
proxy_set_header              X-Client-IP "";

# Rule 4: nothing here touches ETag, Cache-Control or the CORS headers, and
# no proxy_cache is configured. Keep it that way.
proxy_buffering               off;
proxy_request_buffering       off;
proxy_connect_timeout         5s;
proxy_read_timeout            30s;

# Replace axi.example.com with YOUR AxiTrace tracking hostname. It must be a
# subdomain of your own domain. Never put one of our hostnames here: the cookie
# would come back scoped to a domain you do not own and be discarded silently.

resolver 1.1.1.1 8.8.8.8 valid=60s ipv6=off;
set $axitrace_host "axi.example.com";
gzip off;

# Exact paths
location = /axitrack.js          { include snippets/axitrace-proxy.conf; }
location = /axitrack.min.js      { include snippets/axitrace-proxy.conf; }
location = /velitrack-sdk.js     { include snippets/axitrace-proxy.conf; }
location = /axitrack-triggers.js { include snippets/axitrace-proxy.conf; }
location = /axitrack-surveys.js  { include snippets/axitrace-proxy.conf; }
location = /axitrack-tester.js   { include snippets/axitrace-proxy.conf; }
location = /sdk-config           { include snippets/axitrace-proxy.conf; }
location = /health               { include snippets/axitrace-proxy.conf; }
location = /ready                { include snippets/axitrace-proxy.conf; }

# Prefix paths. "= /track" plus "^~ /track/" matches whole path segments, the
# way our own routing does. A bare "location /track" would also swallow
# /trackpants.
location = /surveys       { include snippets/axitrace-proxy.conf; }
location ^~ /surveys/     { include snippets/axitrace-proxy.conf; }

location = /track         { include snippets/axitrace-proxy.conf; }
location ^~ /track/       { include snippets/axitrace-proxy.conf; }

# CHECK FIRST: if your own application serves /v1, this takes it over.
location = /v1            { include snippets/axitrace-proxy.conf; }
location ^~ /v1/          { include snippets/axitrace-proxy.conf; }

location ^~ /shopify/     { include snippets/axitrace-proxy.conf; }
location ^~ /woocommerce/ { include snippets/axitrace-proxy.conf; }
location ^~ /magento/     { include snippets/axitrace-proxy.conf; }
location ^~ /shopware/    { include snippets/axitrace-proxy.conf; }

# Add inside the existing <VirtualHost *:443> that serves the hostname
# visitors will request.
# Needs: mod_proxy, mod_proxy_http, mod_ssl, mod_headers
#   a2enmod proxy proxy_http ssl headers
#
# Replace axi.example.com with YOUR AxiTrace tracking hostname. It must be a
# subdomain of your own domain, never one of ours.

SSLProxyEngine On
SSLProxyCheckPeerName On
SSLProxyCheckPeerCN On

# Rule 1 and Rule 3. ProxyPreserveHost Off is the default and is REQUIRED:
# it makes Apache send Host: axi.example.com, which selects the AxiTrace route
# and sets the cookie domain to .example.com. mod_ssl then takes the SNI from
# the same name. With it On, Apache forwards your own hostname instead, no
# route matches, and tracking stops.
ProxyPreserveHost Off

# Rule 2: unset the inbound header first, so mod_proxy writes exactly the peer
# address instead of appending to a value the visitor forged.
# BEHIND A CDN the peer is the CDN edge: configure mod_remoteip
# (RemoteIPHeader CF-Connecting-IP) BEFORE these lines, or every visitor
# collapses onto a few addresses.
RequestHeader unset X-Forwarded-For
RequestHeader unset X-Client-IP

# Rule 4: do not add Cache-Control, ETag or CORS headers here, and leave
# mod_cache off.

# Exact paths
ProxyPass        /axitrack.js          https://axi.example.com/axitrack.js
ProxyPassReverse /axitrack.js          https://axi.example.com/axitrack.js
ProxyPass        /axitrack.min.js      https://axi.example.com/axitrack.min.js
ProxyPassReverse /axitrack.min.js      https://axi.example.com/axitrack.min.js
ProxyPass        /velitrack-sdk.js     https://axi.example.com/velitrack-sdk.js
ProxyPassReverse /velitrack-sdk.js     https://axi.example.com/velitrack-sdk.js
ProxyPass        /axitrack-surveys.js https://axi.example.com/axitrack-surveys.js
ProxyPassReverse /axitrack-surveys.js https://axi.example.com/axitrack-surveys.js
ProxyPass        /axitrack-triggers.js https://axi.example.com/axitrack-triggers.js
ProxyPassReverse /axitrack-triggers.js https://axi.example.com/axitrack-triggers.js
ProxyPass        /axitrack-tester.js   https://axi.example.com/axitrack-tester.js
ProxyPassReverse /axitrack-tester.js   https://axi.example.com/axitrack-tester.js
ProxyPass        /sdk-config           https://axi.example.com/sdk-config
ProxyPassReverse /sdk-config           https://axi.example.com/sdk-config
ProxyPass        /health               https://axi.example.com/health
ProxyPassReverse /health               https://axi.example.com/health
ProxyPass        /ready                https://axi.example.com/ready
ProxyPassReverse /ready                https://axi.example.com/ready

# Prefix paths
ProxyPass        /surveys https://axi.example.com/surveys
ProxyPassReverse /surveys https://axi.example.com/surveys
ProxyPass        /track       https://axi.example.com/track
ProxyPassReverse /track       https://axi.example.com/track

# CHECK FIRST: if your own application serves /v1, this takes it over.
ProxyPass        /v1          https://axi.example.com/v1
ProxyPassReverse /v1          https://axi.example.com/v1

ProxyPass        /shopify     https://axi.example.com/shopify
ProxyPassReverse /shopify     https://axi.example.com/shopify
ProxyPass        /woocommerce https://axi.example.com/woocommerce
ProxyPassReverse /woocommerce https://axi.example.com/woocommerce
ProxyPass        /magento     https://axi.example.com/magento
ProxyPassReverse /magento     https://axi.example.com/magento
ProxyPass        /shopware    https://axi.example.com/shopware
ProxyPassReverse /shopware    https://axi.example.com/shopware

# Add to the site block that serves the hostname visitors will request:
# t.example.com for the subdomain configuration, or your store hostname for
# the main domain configuration.
#
# Replace axi.example.com with YOUR AxiTrace tracking hostname, the one with
# the CNAME to us. It must be a subdomain of your own domain, never one of
# ours: the cookie would come back scoped to a domain you do not own and the
# browser would discard it without saying so.

t.example.com {
	# Every path on ONE line. Inside a single named matcher, two "path" lines
	# are AND'ed and would match nothing at all; multiple arguments to ONE
	# "path" are OR'ed, which is what makes this work. "path" is an exact
	# match, so each prefix is written as a pair: /track AND /track/*.
	# CHECK FIRST: if your own application serves /v1, this takes it over.
	@axitrace path /axitrack.js /axitrack.min.js /velitrack-sdk.js /axitrack-triggers.js /axitrack-surveys.js /axitrack-tester.js /sdk-config /health /ready /surveys /surveys/* /track /track/* /v1 /v1/* /shopify /shopify/* /woocommerce /woocommerce/* /magento /magento/* /shopware /shopware/*

	handle @axitrace {
		reverse_proxy https://axi.example.com {
			# Rule 1. Caddy passes the VISITOR's Host through by default, so
			# this line is the whole ball game. Write the name literally.
			# Do NOT use {upstream_hostport}: it appends :443, and the route
			# would not match.
			header_up Host axi.example.com

			# Rule 2. Set, not append. "+X-Forwarded-For" would append.
			# Caddy already discards an inbound X-Forwarded-* by default,
			# which is the behaviour you want; this makes it explicit.
			header_up X-Forwarded-For {remote_host}

			# Rule 3. Forwarding to an https:// hostname already gives SNI
			# and certificate verification that name. These two lines state
			# it rather than relying on it.
			transport http {
				tls
				tls_server_name axi.example.com
			}
		}
	}

	handle {
		# Your existing site configuration stays here, untouched.
		# root * /var/www/html
		# file_server
	}
}

// Replace with YOUR AxiTrace tracking hostname. Rule 1 and Rule 3 are both
// satisfied by this one value: the upstream URL's hostname is what sets the
// Host header and what Cloudflare uses for TLS SNI. Do not override either.
const AXITRACE_HOST = "axi.example.com";

const EXACT_PATHS = new Set([
  "/axitrack.js",
  "/axitrack.min.js",
  "/velitrack-sdk.js",
  "/axitrack-triggers.js",
  "/axitrack-surveys.js",
  "/axitrack-tester.js",
  "/sdk-config",
  "/health",
  "/ready",
]);

// CHECK FIRST: if your own application serves /v1, this takes it over.
const PREFIX_PATHS = [
  "/surveys",
  "/track",
  "/v1",
  "/shopify",
  "/woocommerce",
  "/magento",
  "/shopware",
];

function isTrackingPath(pathname) {
  if (EXACT_PATHS.has(pathname)) return true;
  return PREFIX_PATHS.some(
    (p) => pathname === p || pathname.startsWith(p + "/"),
  );
}

export default {
  async fetch(request) {
    const url = new URL(request.url);
    if (!isTrackingPath(url.pathname)) {
      return fetch(request);
    }

    const headers = new Headers(request.headers);

    // Rule 1: the copied headers include the Host your visitor requested.
    // Inside one Cloudflare zone a Host header can redirect the subrequest,
    // so drop it and let the upstream URL below set it.
    headers.delete("Host");

    // Rule 2: CF-Connecting-IP is the visitor. Set, never append, and drop
    // anything the visitor sent under these names.
    const visitorIp = request.headers.get("CF-Connecting-IP");
    if (visitorIp) {
      headers.set("X-Forwarded-For", visitorIp);
      headers.set("X-Real-IP", visitorIp);
    }
    headers.delete("X-Client-IP");

    const upstream = new URL(
      url.pathname + url.search,
      "https://" + AXITRACE_HOST,
    );

    const response = await fetch(upstream.toString(), {
      method: request.method,
      headers,
      body: request.body,
      redirect: "manual",
      // Rule 4: no edge caching. /sdk-config answers no-store on purpose.
      cf: { cacheEverything: false },
    });

    // Rule 4: reuse the upstream response as-is. This keeps Set-Cookie, ETag,
    // Cache-Control and the CORS headers exactly as we sent them. Building a
    // fresh Headers object here is how those get lost.
    return new Response(response.body, response);
  },
};

t.example.com/*

www.example.com/axitrack*
www.example.com/velitrack-sdk.js*
www.example.com/sdk-config*
www.example.com/health*
www.example.com/ready*
www.example.com/track*
www.example.com/surveys/*
www.example.com/v1/*
www.example.com/shopify/*
www.example.com/woocommerce/*
www.example.com/magento/*
www.example.com/shopware/*

// CloudFront Function, runtime cloudfront-js-2.0, event type: VIEWER REQUEST.
//
// Rule 2, and on CloudFront it is not optional. CloudFront APPENDS the viewer
// address to any X-Forwarded-For the client sent, and there is no setting that
// makes it overwrite instead. We read the first public entry in that header,
// so without this function a visitor who sends their own X-Forwarded-For is
// believed and yours is ignored.
//
// Header names are lowercase here, and values are objects: {value: "..."}.

function handler(event) {
    var request = event.request;
    request.headers['x-forwarded-for'] = { value: event.viewer.ip };
    return request;
}

{
  "$schema": "https://openapi.vercel.sh/vercel.json",
  "proxy": {
    "entrypoint": "proxy.ts",
    "matcher": "/:path*"
  }
}

// proxy.ts, at the root of the project that serves your tracking hostname.
// Configured through the "proxy" property in vercel.json, which runs it on the
// Node.js runtime. You do not need a runtime export, and you should not add
// one: "export const runtime = 'edge'" is no longer supported as of
// Next.js 16.3.

import { ipAddress } from '@vercel/functions';

// Replace with YOUR AxiTrace tracking hostname, the one with the CNAME to us.
const UPSTREAM = 'https://axi.example.com';

const EXACT_PATHS = new Set([
  '/axitrack.js',
  '/axitrack.min.js',
  '/velitrack-sdk.js',
  '/axitrack-triggers.js',
  '/axitrack-surveys.js',
  '/axitrack-tester.js',
  '/sdk-config',
  '/health',
  '/ready',
]);

// CHECK FIRST: if your own application serves /v1, this takes it over.
const PREFIX_PATHS = ['/surveys', '/track', '/v1', '/shopify', '/woocommerce', '/magento', '/shopware'];

function isTrackingPath(pathname: string): boolean {
  if (EXACT_PATHS.has(pathname)) return true;
  return PREFIX_PATHS.some((p) => pathname === p || pathname.startsWith(p + '/'));
}

export default async function proxy(request: Request): Promise<Response> {
  const incoming = new URL(request.url);

  if (!isTrackingPath(incoming.pathname)) {
    return new Response('Not found', { status: 404 });
  }

  const target = new URL(incoming.pathname + incoming.search, UPSTREAM);
  const headers = new Headers(request.headers);

  // Rules 1 and 3. Do NOT try to set Host yourself: it is a forbidden header
  // name for fetch and Node refuses it. Deleting the inbound one and fetching
  // the target URL gives the correct Host AND the correct TLS SNI, both taken
  // from the hostname in that URL.
  headers.delete('host');

  // Rule 2. Vercel sets x-forwarded-for itself and does not forward an
  // external one, so this is the visitor and a client cannot forge it.
  // ipAddress() reads it for you. Set, never append.
  headers.set('x-forwarded-for', ipAddress(request) ?? '');
  headers.set('x-forwarded-proto', 'https');
  headers.set('x-forwarded-host', incoming.host);

  const upstream = await fetch(target, {
    method: request.method,
    headers,
    body: request.method === 'GET' || request.method === 'HEAD' ? undefined : request.body,
    redirect: 'manual',
    // @ts-expect-error required by undici when streaming a request body
    duplex: 'half',
  });

  // Rule 4. Rebuilt deliberately, one Set-Cookie at a time, rather than passed
  // through: see the note below on why copying the headers wholesale is a risk
  // on these platforms.
  const out = new Headers();
  for (const [k, v] of upstream.headers) {
    if (k.toLowerCase() !== 'set-cookie') out.append(k, v);
  }
  for (const c of upstream.headers.getSetCookie()) out.append('set-cookie', c);

  // Vercel has honoured upstream cache-control on external rewrites by default
  // for projects created on or after 6 April 2026. /sdk-config must not be
  // cached, so say so.
  out.set('cache-control', 'no-store');

  return new Response(upstream.body, {
    status: upstream.status,
    statusText: upstream.statusText,
    headers: out,
  });
}

// netlify/edge-functions/axitrace-proxy.ts
//
// An Edge Function rather than a redirect rule, because a redirect rule cannot
// put the visitor's address in a header. See the note above.

import type { Config, Context } from '@netlify/edge-functions';

// Replace with YOUR AxiTrace tracking hostname, the one with the CNAME to us.
const UPSTREAM = 'https://axi.example.com';

export default async (request: Request, context: Context) => {
  const incoming = new URL(request.url);
  const target = new URL(incoming.pathname + incoming.search, UPSTREAM);

  const headers = new Headers(request.headers);

  // Rules 1 and 3. Host cannot be set by hand here either, and does not need
  // to be: fetching the target URL sets both the Host header and the TLS SNI
  // from its hostname.
  headers.delete('host');

  // Rule 2. context.ip, not a header. Netlify adds no client headers to edge
  // function requests, and x-nf-client-connection-ip is NOT available here -
  // it belongs to the older Netlify Functions. Set, never append.
  headers.set('x-forwarded-for', context.ip);
  headers.set('x-forwarded-proto', 'https');
  headers.set('x-forwarded-host', incoming.host);

  // An explicit fetch is mandatory: context.next() can only rewrite to
  // same-site URLs and cannot reach axi.example.com at all.
  const upstream = await fetch(target, {
    method: request.method,
    headers,
    body: request.method === 'GET' || request.method === 'HEAD' ? undefined : request.body,
    redirect: 'manual',
  });

  // Rule 4, one Set-Cookie at a time. See the note below.
  const out = new Headers();
  for (const [k, v] of upstream.headers) {
    if (k.toLowerCase() !== 'set-cookie') out.append(k, v);
  }
  for (const c of upstream.headers.getSetCookie()) out.append('set-cookie', c);

  // Netlify's CDN caches a proxied response that carries an ETag or a
  // Last-Modified, and /axitrack.js carries an ETag. Say no-store.
  out.set('cache-control', 'no-store');

  return new Response(upstream.body, {
    status: upstream.status,
    statusText: upstream.statusText,
    headers: out,
  });
};

// CHECK FIRST: if your own application serves /v1, this takes it over.
export const config: Config = {
  path: [
    '/axitrack.js',
    '/axitrack.min.js',
    '/velitrack-sdk.js',
    '/axitrack-triggers.js',
    '/axitrack-surveys.js',
    '/axitrack-tester.js',
    '/sdk-config',
    '/health',
    '/ready',
    '/surveys',
    '/surveys/*',
    '/track',
    '/track/*',
    '/v1',
    '/v1/*',
    '/shopify/*',
    '/woocommerce/*',
    '/magento/*',
    '/shopware/*',
  ],
  method: ['GET', 'POST', 'OPTIONS'],
};

// main.ts, deployed as the entrypoint of a Deno Deploy app.
//
// Use Deno.serve() at the top level. It works whichever way the platform
// starts your entrypoint, which "export default { fetch }" does not.

// Replace with YOUR AxiTrace tracking hostname, the one with the CNAME to us.
const UPSTREAM = 'https://axi.example.com';

const EXACT_PATHS = new Set([
  '/axitrack.js',
  '/axitrack.min.js',
  '/velitrack-sdk.js',
  '/axitrack-triggers.js',
  '/axitrack-surveys.js',
  '/axitrack-tester.js',
  '/sdk-config',
  '/health',
  '/ready',
]);

// CHECK FIRST: if your own application serves /v1, this takes it over.
const PREFIX_PATHS = ['/surveys', '/track', '/v1', '/shopify', '/woocommerce', '/magento', '/shopware'];

function isTrackingPath(pathname: string): boolean {
  if (EXACT_PATHS.has(pathname)) return true;
  return PREFIX_PATHS.some((p) => pathname === p || pathname.startsWith(p + '/'));
}

function visitorIp(req: Request, info: Deno.ServeHandlerInfo): string {
  // Rule 2. Take the FIRST entry: that is the original client. See the
  // warning below before you trust this in production.
  const xff = req.headers.get('x-forwarded-for');
  if (xff) return xff.split(',')[0].trim();
  const addr = info.remoteAddr;
  return addr.transport === 'tcp' ? addr.hostname : '';
}

Deno.serve(async (req, info) => {
  const incoming = new URL(req.url);

  if (!isTrackingPath(incoming.pathname)) {
    return new Response('Not found', { status: 404 });
  }

  const headers = new Headers(req.headers);

  // Rules 1 and 3. Deno's fetch SILENTLY IGNORES a Host header you set: the
  // Headers object keeps the value, the wire does not, so a test that asserts
  // on the object passes while nothing reached us. Delete the inbound one and
  // let the target URL supply both the Host header and the TLS SNI.
  headers.delete('host');
  headers.delete('accept-encoding');

  const ip = visitorIp(req, info);
  if (ip) headers.set('x-forwarded-for', ip);
  else headers.delete('x-forwarded-for');
  headers.set('x-forwarded-proto', 'https');
  headers.set('x-forwarded-host', incoming.host);

  const upstream = await fetch(new URL(incoming.pathname + incoming.search, UPSTREAM), {
    method: req.method,
    headers,
    body: req.method === 'GET' || req.method === 'HEAD' ? null : req.body,
    redirect: 'manual',
    // @ts-ignore required by the spec when streaming a request body
    duplex: 'half',
  });

  // Rule 4. Copying the headers preserves every Set-Cookie, the ETag and the
  // CORS headers. Two deletions are MANDATORY, and this is the single most
  // surprising line on this page:
  const out = new Headers(upstream.headers);
  out.delete('content-encoding');
  out.delete('content-length');

  // Deno Deploy has its own CDN cache in FRONT of your app. A GET with no
  // Set-Cookie is cacheable there, which would break /sdk-config.
  out.set('cache-control', 'no-store');
  out.set('deno-cdn-cache-control', 'no-store');

  return new Response(upstream.body, {
    status: upstream.status,
    statusText: upstream.statusText,
    headers: out,
  });
});

<?php
// axi-probe.php - upload this next to your application's index.php, request it
// once in a browser, then delete it. It answers the three questions that decide
// whether the rest of this section will work, and where its files have to go.

header('Content-Type: text/plain');

echo 'curl extension:  ', extension_loaded('curl') ? 'yes' : 'NO', "\n";
echo 'document root:   ', $_SERVER['DOCUMENT_ROOT'] ?? '(unknown)', "\n";
echo 'this file is in: ', __DIR__, "\n";
echo 'REMOTE_ADDR:     ', $_SERVER['REMOTE_ADDR'] ?? '(none)', "\n";

# A throwaway test. Put it at the TOP of the .htaccess that serves your site,
# request https://www.example.com/health, then remove it either way.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^health$ https://axi.example.com/health [P,L]
</IfModule>

<?php

/**
 * AxiTrace first-party proxy.
 *
 * Purpose: make tracking requests come from this server instead of from a
 * hostname that CNAMEs to AxiTrace. Safari shortens the lifetime of a cookie
 * set in a response that arrives through a CNAME pointing off this domain, or
 * from an IP unrelated to the one serving the page. Answering from our own
 * server removes both conditions, so vt_vid keeps its full expiry.
 *
 * Reached through the rewrite rules in the document-root .htaccess. The rewrite
 * is internal, so REQUEST_URI still holds the path the visitor asked for, which
 * is what gets forwarded - not the name of this script.
 */

declare(strict_types=1);

const AXITRACE_UPSTREAM = 'axi.example.com';

// ---------------------------------------------------------------------------
// 1. Which paths may be forwarded
// ---------------------------------------------------------------------------
// A second, independent allow-list. The .htaccess rules already limit what
// reaches this file; this exists so that a future rewrite rule sending
// something unexpected here gets a 404 instead of being proxied blindly.

$EXACT_PATHS = [
    '/axitrack.js',
    '/axitrack.min.js',
    '/velitrack-sdk.js',
    '/axitrack-triggers.js',
    '/axitrack-surveys.js',
    '/axitrack-tester.js',
    '/sdk-config',
    '/health',
    '/ready',
];

$PREFIX_PATHS = ['/surveys', '/track', '/v1', '/shopify', '/woocommerce', '/magento', '/shopware'];

$path = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH);
if (!is_string($path) || $path === '') {
    $path = '/';
}

$allowed = in_array($path, $EXACT_PATHS, true);
if (!$allowed) {
    foreach ($PREFIX_PATHS as $prefix) {
        if ($path === $prefix || strncmp($path, $prefix . '/', strlen($prefix) + 1) === 0) {
            $allowed = true;
            break;
        }
    }
}

if (!$allowed) {
    http_response_code(404);
    exit;
}

// ---------------------------------------------------------------------------
// 2. Who the visitor is
// ---------------------------------------------------------------------------
// REMOTE_ADDR is the address of the LAST hop. On this host nginx sits in front
// of Apache, so it can be a private address belonging to that local proxy
// rather than the visitor. Only in that case do we trust the header the local
// proxy set. When REMOTE_ADDR is already a public address it IS the visitor,
// and no header is trusted, because a client can forge those freely.
//
// Inside that case, take the LAST X-Forwarded-For entry, not the first: a local
// reverse proxy APPENDS the address it saw on the connection it accepted, while
// the first entry is whatever the visitor sent. X-Real-IP is the other
// convention for the same thing and is the fallback.
//
// Getting this wrong is silent: every visitor would be reported to AxiTrace
// under one address, and attribution would quietly collapse.

$remoteAddr = $_SERVER['REMOTE_ADDR'] ?? '';
$remoteIsPublic = filter_var(
        $remoteAddr,
        FILTER_VALIDATE_IP,
        FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
    ) !== false;

$clientIp = $remoteAddr;

if (!$remoteIsPublic) {
    $forwarded = '';
    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $parts = explode(',', (string) $_SERVER['HTTP_X_FORWARDED_FOR']);
        $forwarded = trim($parts[count($parts) - 1]);
    }

    if (filter_var($forwarded, FILTER_VALIDATE_IP) === false
        && !empty($_SERVER['HTTP_X_REAL_IP'])) {
        $forwarded = trim((string) $_SERVER['HTTP_X_REAL_IP']);
    }

    if (filter_var($forwarded, FILTER_VALIDATE_IP) !== false) {
        $clientIp = $forwarded;
    }
}

// ---------------------------------------------------------------------------
// 3. Build the upstream request
// ---------------------------------------------------------------------------
// Host must be the hostname AxiTrace provisioned for this workspace. It selects
// the route on their side and the cookie domain is derived from it. Sending
// this site's own hostname instead matches no route and tracking stops.
//
// X-Forwarded-For is SET, never appended, so a value forged by the client
// cannot end up first in the list.

$query = $_SERVER['QUERY_STRING'] ?? '';
$url = 'https://' . AXITRACE_UPSTREAM . $path . ($query !== '' ? '?' . $query : '');

$headers = [
    'Host: ' . AXITRACE_UPSTREAM,
    'X-Forwarded-For: ' . $clientIp,
    'X-Forwarded-Proto: https',
];

// Hop-by-hop headers and anything we set ourselves above. Accept-Encoding is
// dropped so the upstream answers uncompressed and the body can be passed
// through untouched.
$skipRequestHeaders = [
    'host',
    'x-forwarded-for',
    'x-forwarded-proto',
    'connection',
    'content-length',
    'accept-encoding',
];

foreach ($_SERVER as $key => $value) {
    if (strncmp($key, 'HTTP_', 5) !== 0) {
        continue;
    }

    $name = strtolower(str_replace('_', '-', substr($key, 5)));
    if (in_array($name, $skipRequestHeaders, true)) {
        continue;
    }

    // Carries Origin, Content-Type, the X-VeliTrack-* authentication headers,
    // If-None-Match for the SDK file, and Access-Control-Request-* so that a
    // CORS preflight is answered by AxiTrace rather than by this script.
    $headers[] = $name . ': ' . $value;
}

$body = file_get_contents('php://input');

$ch = curl_init($url);
if ($ch === false) {
    http_response_code(502);
    exit;
}

$options = [
    CURLOPT_CUSTOMREQUEST  => $_SERVER['REQUEST_METHOD'] ?? 'GET',
    CURLOPT_HTTPHEADER     => $headers,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER         => true,
    CURLOPT_FOLLOWLOCATION => false,
    CURLOPT_CONNECTTIMEOUT => 5,
    CURLOPT_TIMEOUT        => 30,
];

if (is_string($body) && $body !== '') {
    $options[CURLOPT_POSTFIELDS] = $body;
}

curl_setopt_array($ch, $options);

$raw = curl_exec($ch);

if ($raw === false) {
    // Tracking must never take the page down with it. A failed hop is a lost
    // event, logged here and nowhere else.
    error_log('axitrace-proxy: upstream request failed: ' . curl_error($ch));
    curl_close($ch);
    http_response_code(502);
    exit;
}

$headerSize = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// ---------------------------------------------------------------------------
// 4. Relay the response
// ---------------------------------------------------------------------------

http_response_code($status);

$dropResponseHeaders = [
    'transfer-encoding',
    'content-encoding',
    'content-length',
    'connection',
    'keep-alive',
];

foreach (explode("\r\n", substr($raw, 0, $headerSize)) as $line) {
    if ($line === '' || stripos($line, 'HTTP/') === 0) {
        continue;
    }

    $parts = explode(':', $line, 2);
    if (count($parts) !== 2) {
        continue;
    }

    if (in_array(strtolower(trim($parts[0])), $dropResponseHeaders, true)) {
        continue;
    }

    // The second argument is false on purpose: it means "add", not "replace".
    // Set-Cookie can legitimately appear several times, and relaying those
    // headers intact is the entire reason this proxy exists.
    header($line, false);
}

echo substr($raw, $headerSize);

# /home/you/yourstore/.htaccess          THE PROJECT ROOT, next to composer.json
#
# The two AxiTrace rules MUST stay ABOVE the rule that rewrites everything into
# public/. Below it they can never match: by then /track has already become
# public/track and no longer looks like any of the paths listed here.

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteRule ^(axitrack\.js|axitrack\.min\.js|velitrack-sdk\.js|axitrack-triggers\.js|axitrack-surveys\.js|axitrack-tester\.js|sdk-config|health|ready)$ public/axitrace-proxy.php [L,QSA]
    RewriteRule ^(surveys|track|v1|shopify|woocommerce|magento|shopware)(/.*)?$ public/axitrace-proxy.php [L,QSA]

    # Your application's own rule, unchanged. Yours may be written slightly
    # differently; what matters is that it stays BELOW the two lines above.
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# /home/you/yourstore/public/.htaccess   THE DOCUMENT ROOT ITSELF
#
# The same two rules without the public/ prefix in the target, above the front
# controller rule. Below it they never run, because the front controller rule
# ends with [L] and has already claimed the request.

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteRule ^(axitrack\.js|axitrack\.min\.js|velitrack-sdk\.js|axitrack-triggers\.js|axitrack-surveys\.js|axitrack-tester\.js|sdk-config|health|ready)$ axitrace-proxy.php [L,QSA]
    RewriteRule ^(surveys|track|v1|shopify|woocommerce|magento|shopware)(/.*)?$ axitrace-proxy.php [L,QSA]

    # Your framework's front controller, unchanged. Symfony writes
    # "RewriteRule ^ index.php [L]", WordPress "RewriteRule . /index.php [L]".
    RewriteRule ^ index.php [L]
</IfModule>

<script src="https://axi.example.com/axitrack.js"></script>
<script>
    Axitrace.init({
        apiUrl: 'https://www.example.com',
        publicKey: 'pk_live_YOUR_PUBLIC_KEY'
    });
</script>

curl -sI https://www.example.com/health

# Expect: HTTP/2 200, and a small JSON body if you drop the -I.
# A 404 from your own application means the rewrite rules are in the wrong
# file, or below the rule that claims the request first.
# A bare 404 with no HTML means the request did reach us but carried the wrong
# Host header, so no workspace route matched.

curl -s "https://www.example.com/sdk-config?pk=pk_live_YOUR_PUBLIC_KEY"

# Expect: a JSON body describing YOUR workspace's own tracking policy.
# An empty or error body means the key and the route disagree: the request
# reached us, but not as the workspace you think you are testing.

# GET, never HEAD. "curl -I" sends HEAD, and /axitrack.js answers HEAD with
# 405 Method Not Allowed BY DESIGN - which reads exactly like a broken proxy
# when nothing at all is wrong.

curl -s -D proxy.head  -o proxy.js  "https://www.example.com/axitrack.js"
curl -s -D direct.head -o direct.js "https://axi.example.com/axitrack.js"

ls -l proxy.js direct.js                  # the two sizes must be identical
grep -i '^etag' proxy.head direct.head    # the two ETags must be identical

curl -s -o /dev/null -w '%{http_code}\n' \
     -H 'If-None-Match: "PASTE-THE-ETAG-FROM-THE-PREVIOUS-STEP"' \
     "https://www.example.com/axitrack.js"

# Expect: 304

curl -s -D - -o /dev/null -X OPTIONS \
     -H 'Origin: https://www.example.com' \
     -H 'Access-Control-Request-Method: POST' \
     -H 'Access-Control-Request-Headers: content-type,x-velitrack-public-key' \
     "https://www.example.com/track"

# The response MUST carry both of these:
#   access-control-allow-origin: https://www.example.com
#   access-control-allow-credentials: true

curl -s -D - -o /dev/null -X POST "https://www.example.com/track" \
     -H 'Content-Type: application/json' \
     -H 'Origin: https://www.example.com' \
     -H 'X-VeliTrack-Public-Key: pk_live_YOUR_PUBLIC_KEY' \
     -d '{"event":"page.view","label":"proxy-check"}'

# Expect: HTTP 400, and a response that STILL carries the visitor cookie:
#   set-cookie: vt_vid=...; Path=/; Domain=example.com; Max-Age=63072000;
#               HttpOnly; Secure; SameSite=Lax

# Your own public address, for the comparison in the admin panel:
curl -s https://api.ipify.org; echo

<script src="https://axi.example.com/axitrack.js"></script>
<script>
    Axitrace.init({
        apiUrl: 'https://axi.example.com',
        publicKey: 'pk_live_YOUR_PUBLIC_KEY'
    });
</script>

<script src="https://t.example.com/axitrack.js"></script>
<script>
    Axitrace.init({
        apiUrl: 'https://t.example.com',
        publicKey: 'pk_live_YOUR_PUBLIC_KEY'
    });
</script>

dig +short t.example.com
dig +short www.example.com

# The two must print the same thing. If your main site is a CNAME, the
# target must match as well, not just the address underneath it.

curl -i https://t.example.com/health

# Expect HTTP 200 and a small JSON body.
# A 404 from your own server means the proxy rule did not match the path.
# A 404 that looks like it came from us means the Host header is wrong.