0.4.2 — ingest at /api/d, and a header for proxies

The tracker posts to /api/d

Content blockers match /api/collect as a path on any domain — first-party included. A visitor running one sent nothing at all, even to a self-hosted install on the site's own domain. The tracker now sends events to /api/d.

/api/collect is unchanged and remains the same endpoint, so existing tags, server-side integrations and anything calling it directly keep working. A page still serving a cached older v.js keeps posting there until its cache expires.

X-Vitrus-Client-IP for proxies

If you serve the tracker through a proxy on your own domain, every request reaches the server from the proxy's address — and with Cloudflare in front, cf-connecting-ip is the proxy, not the visitor. All visitors then hash to one.

The client IP is now read in this order: X-Vitrus-Client-IP → cf-connecting-ip → the first value of X-Forwarded-For → X-Real-IP. Set the first one in your proxy:

location = /vs/api/d {
    proxy_pass https://your-vitrus-host/api/d;
    proxy_set_header X-Vitrus-Client-IP $remote_addr;
}

Like X-Forwarded-For, it can be set by the client. The IP only feeds a daily-salted visitor hash and IP exclusions; it is never stored and never used for an access decision.

Full proxy guide (nginx, Caddy, Cloudflare Workers, Next.js): https://vitrus.dev/docs/proxy

Fix

• The session-replay recorder URL was derived by trimming a fixed number of characters off the collect URL. It is now built from the endpoint base, so data-host and the new path both resolve correctly.