Set up the Triggerbee proxy with PHP

<?php
// Serves Triggerbee from your own domain, forwarding only Triggerbee's own cookies and the headers it reads
// Set $prefix to where you want it mounted, and $trustedProxyHops to the number of proxies (load balancer, CDN) in front of PHP.
// Nothing else in this file needs changes. Needs PHP 8 with the curl extension.

(static function (): void {
    $prefix = '/tb';
    $trustedProxyHops = 0;

    $upstream = 'https://t.myvisitors.se';
    $eventPaths = '#^/((3/|4/)?t)$#';
    $forwardedHeaders = [
        'accept', 'accept-language', 'content-type', 'origin', 'referer', 'user-agent',
        'access-control-request-headers', 'access-control-request-method', 'if-modified-since', 'if-none-match', 'x-application-id',
    ];
    $forwardedHeaderPrefix = 'x-triggerbee-';
    $forwardedCookies = ['_smtruid', '_mtruid'];
    $forwardedCookiePrefix = 'triggerbee';
    // curl negotiates compression with Triggerbee and decodes the body, so the web server compresses it for the browser as usual.
    $droppedResponseHeaders = [
        'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade',
        'content-encoding', 'content-length', 'nel', 'report-to',
    ];

    $uri = $_SERVER['REQUEST_URI'] ?? '/';
    $queryStart = strpos($uri, '?');
    $pathname = $queryStart === false ? $uri : substr($uri, 0, $queryStart);
    $query = $queryStart === false ? '' : substr($uri, $queryStart);
    $path = str_starts_with($pathname, "$prefix/") ? substr($pathname, strlen($prefix)) : null;

    if ($path === null) {
        // Run as the rewrite target, any other path is not ours; required from a front controller, the site carries on.
        if (get_included_files()[0] === __FILE__) {
            http_response_code(404);
            exit;
        }
        return;
    }

    $headers = ['Expect:'];
    foreach (getallheaders() as $name => $value) {
        $lowerName = strtolower($name);
        if (in_array($lowerName, $forwardedHeaders, true) || str_starts_with($lowerName, $forwardedHeaderPrefix)) {
            $headers[] = "$name: $value";
        }
    }

    // The raw header rather than $_COOKIE, which renames cookies with dots or spaces in their names.
    $cookies = array_filter(
        array_map('trim', explode(';', $_SERVER['HTTP_COOKIE'] ?? '')),
        static function (string $pair) use ($forwardedCookies, $forwardedCookiePrefix): bool {
            $name = trim(explode('=', $pair, 2)[0]);
            return in_array($name, $forwardedCookies, true) || str_starts_with($name, $forwardedCookiePrefix);
        }
    );
    if ($cookies) {
        $headers[] = 'Cookie: ' . implode('; ', $cookies);
    }

    $clientIp = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'] ?? '';
    $https = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
    if ($trustedProxyHops > 0) {
        // Counted from our end: entries further left are ones a visitor could have put there.
        $chain = array_values(array_filter(array_map('trim', explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'] ?? ''))));
        $clientIp = $chain[count($chain) - $trustedProxyHops] ?? $clientIp;
        $https = $https || strtolower(trim(explode(',', $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')[0])) === 'https';
    }
    $headers[] = 'X-Forwarded-Host: ' . ($_SERVER['HTTP_HOST'] ?? '');
    $headers[] = 'X-Forwarded-Proto: ' . ($https ? 'https' : 'http');
    $headers[] = "X-Client-IP: $clientIp";

    $method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
    $responseHeaders = [];
    // Appended, never resolved as a relative URL, so /tb//other.example/x still goes to Triggerbee.
    $curl = curl_init($upstream . $path . $query);
    curl_setopt_array($curl, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_ENCODING => '',
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CONNECTTIMEOUT => 5,
        CURLOPT_TIMEOUT => 10,
        CURLOPT_HEADERFUNCTION => static function ($handle, string $line) use (&$responseHeaders): int {
            if (str_starts_with($line, 'HTTP/')) {
                $responseHeaders = [];
            } elseif (str_contains($line, ':')) {
                [$name, $value] = explode(':', $line, 2);
                $responseHeaders[] = [trim($name), trim($value)];
            }
            return strlen($line);
        },
    ]);
    if ($method === 'HEAD') {
        curl_setopt($curl, CURLOPT_NOBODY, true);
    }
    $requestBody = file_get_contents('php://input');
    if ($requestBody !== '' && $requestBody !== false) {
        curl_setopt($curl, CURLOPT_POSTFIELDS, $requestBody);
    }

    $body = curl_exec($curl);
    if ($body === false) {
        // Tracking must never break the site.
        http_response_code(502);
        exit;
    }

    http_response_code(curl_getinfo($curl, CURLINFO_RESPONSE_CODE));
    foreach ($responseHeaders as [$name, $value]) {
        if (!in_array(strtolower($name), $droppedResponseHeaders, true)) {
            header("$name: $value", false);
        }
    }
    // This answer is on your own origin, so a page from Triggerbee must not run as your site; scripts and JSON ignore it.
    header('Content-Security-Policy: sandbox');
    if (preg_match($eventPaths, $path)) {
        header('Cache-Control: no-store');
    }
    echo $body;
    exit;
})();

RewriteEngine On RewriteRule ^tb/ /triggerbee-proxy.php [L]

location ^~ /tb/ {     
include fastcgi_params;     
fastcgi_param SCRIPT_FILENAME /var/www/html/triggerbee-proxy.php;     
fastcgi_pass unix:/run/php/php8.2-fpm.sock; 
}

require __DIR__ . '/triggerbee-proxy.php';